A vulnerability has been reported in Kerberos, which can be exploited by malicious users to cause a DoS (Denial of Service) or potentially compromise a vulnerable system.

The vulnerability is caused due an array-indexing error within the "merge_authdata()" function (kdc_authdata.c) when processing authorization data from Kerberos TGS request messages. This can be exploited to dereference an uninitialized pointer causing the KDC process to crash.

The vulnerability is reported in versions krb5-1.8 through krb5-1.8.3.

Solution
Apply patch or update to version krb5-1.8.4 when it becomes available.
Further details available to Secunia VIM customers

Provided and/or discovered by
The vendor credits Mike Roszkowski.

Original Advisory
MITKRB5-SA-2010-006:
http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-006.txt

Deep Links
Links available to Secunia VIM customers