Critical bugs bite Kerberos
Multiple critical vulnerabilities have been discovered in version five of the widely-used Kerberos authentication protocol. The most serious of the bugs create a means to either compromise or crash vulnerable systems.
Exploits are yet to surface and patches are available. All releases of MIT Kerberos 5 up to and including krb5-1.6.3 are affected.
Two of the bugs involve errors in processing krb4 requests in MIT Kerberos 5 implementation's Key Distribution Center (KDC) program and libraries. The flaws create a possible mechanism for hackers to execute arbitrary code on targeted systems.
A further two bugs in the Kerberos RPC library, involving the handling of open file descriptors, might be exploited to cause memory corruption.
Developers are advised to update to version krb5-1.6.4 or apply workarounds.
Kerberos was developed by MIT and is a popular means for securely authenticating a request for a service in a computer network. The name derives from Greek mythology, where Cerberus is the three-headed dog guarding the gates of Hades. ®