MIT patches Kerberos
The Massachusetts Institute of Technology has pointed out multiple vulnerabilities in its Kerberos implementation, which can be exploited by unprivileged users of a system to escalate their privileges. According to error reports, a number of applications which do not always check setuid() and seteuid() calls correctly are included in the Kerberos 5 source code distribution . These would enable an attacker to achieve root privileges.
The actual risk, however, depends on the operating system. So, for example, under Linux and AIX, only the unchecked setuid() calls present a problem. Indeed AIX is only affected if the MIT Kerberos implementation, rather than the IBM implementation, is used. The errors are present in all versions up to and including 1.5 and 1.4.x. The errors have been corrected in rb5-1.5.1 and krb5-1.4.4.
- Multiple local privilege escalation vulnerabilities, MIT error report
(ehe)
![Kernel Log: Coming in 3.10 (Part 3) [--] Infrastructure](/imgs/43/1/0/4/2/6/7/2/comingin310_4_kicker-4977194bfb0de0d7.png)
![Kernel Log: Coming in 3.10 (Part 3) [--] Infrastructure](/imgs/43/1/0/4/2/3/2/3/comingin310_3_kicker-151cd7b9e9660f05.png)
