Bug 1179857 (CVE-2014-9421)

Upstream reports that if the MIT krb5 kadmind daemon receives invalid XDR
data from an authenticated user, it may perform use-after-free and
double-free memory access violations while cleaning up the partial
deserialization results.  Other libgssrpc server applications may also
be vulnerable if they contain insufficiently defensive XDR functions.

An authenticated attacker could cause kadmind or other
vulnerable server application to crash or to execute arbitrary code.
Exploiting a double-free event to execute arbitrary code is believed
to be difficult.

libgssrpc applications use the XDR serialization format.  XDR data is
serialized, deserialized, and freed using an application function,
often generated by the rpcgen command.  If an application receives
incorrectly serialized data from the client, the XDR function will
return false to report a deserialization failure, perhaps leaving
behind partial deserialization results.  To avoid a memory leak, these
partial results must be freed with another invocation of the XDR
function.

In a server application, this cleanup is performed automatically by
svc_getargs().  If the AUTH_GSSAPI authentication flavor is used, the
cleanup is also erroneously performed by the internal unwrap function,
so the XDR function is invoked twice to clean up the partial results.

XDR functions can be defensive about being invoked twice for cleanup
by assigning pointer values to NULL after freeing them.  Most XDR
functions do this, but the XDR functions within libkadm5 for principal
names and tag-length data do not.  When these functions are invoked
twice by libgssrpc to clean up a value, the second invocations perform
use-after-free and double-free memory access violations.  These XDR
functions are only exposed to an authenticated attacker.  This
vulnerability could theoretically lead to the execution of malicious
code, but that is believed to be difficult.

Client applications are not believed to be vulnerable because
clnt_call() and client stub functions do not free partial
deserialization results.

Suggested patch to fix this vulnerability as well as 
CVE-2014-5352, CVE-2014-9422 and CVE-2014-9423 is attached to https://bugzilla.redhat.com/show_bug.cgi?id=1179856