In association with heise online

09 August 2006, 14:30

MIT patches Kerberos

  • Twitter
  • Facebook
  • submit to slashdot
  • StumbleUpon
  • submit to reddit

The Massachusetts Institute of Technology has pointed out multiple vulnerabilities in its Kerberos implementation, which can be exploited by unprivileged users of a system to escalate their privileges. According to error reports, a number of applications which do not always check setuid() and seteuid() calls correctly are included in the Kerberos 5 source code distribution . These would enable an attacker to achieve root privileges.

The actual risk, however, depends on the operating system. So, for example, under Linux and AIX, only the unchecked setuid() calls present a problem. Indeed AIX is only affected if the MIT Kerberos implementation, rather than the IBM implementation, is used. The errors are present in all versions up to and including 1.5 and 1.4.x. The errors have been corrected in rb5-1.5.1 and krb5-1.4.4.

See also:


Print Version | Send by email | Permalink:

  • July's Community Calendar

The H Open

The H Security

The H Developer

The H Internet Toolkit