Some vulnerabilities have been reported in Kerberos, which can be exploited by malicious users to conduct spoofing attacks and cause a DoS (Denial of Service).

1) A NULL-pointer dereference error in the implementation of cross-realm referrals can be exploited to crash KDC via a specially crafted request.

2) An error within the MIT krb5 KDC can be exploited to obtain a valid service ticket by intercepting a TGS-REQ for another client and then impersonating the client.

Successful exploitation requires that the attacker is authenticated and controls a legitimate service principal.

Solution
Update to version krb5-1.7.1.

Provided and/or discovered by
1) The vendor credits Jeff Blaine, Radoslav Bodo, Jakob Haufe, and Jorgen Wahlsten.
2) Reported by the vendor.

Changelog
Further details available to Secunia VIM customers

Original Advisory
1) http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2009-003.txt
2) http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2010-007.txt

Deep Links
Links available to Secunia VIM customers