secalert received a message from the MIT Kerberos Development Team detailing a vulnerability. The MIT Kerberos 5 administration library (libkadm5srv) contains a heap buffer overflow in password history handling code which could be exploited to execute arbitrary code on a Key Distribution Center (KDC) host. The overflow occurs during a password change of a principal with a certain password history state. An administrator must have performed a certain password policy change in order to create the vulnerable state. There is currently no patch for this issue. I'll attach one as soon as it becomes available. The MIT team wants to realease their update sometimes around 2004-12-21 since this issue is technically public (we are however treating it as embargoed).
This issue should also affect RHEL2.1
removing embargo
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHSA-2005-012.html