MIT Kerberos 5 contains a flaw that may allow a malicious user to gain access to unauthorized privileges. The issue is triggered when the setuid() call fails in the krshd program. This flaw may lead to a loss of confidentiality and/or integrity.
Classification
Location:
Local Access Required
Attack Type:
Information Disclosure,
Input Manipulation
Impact:
Loss of Confidentiality,
Loss of Integrity
Exploit:
Exploit Unknown
Solution
Upgrade to version 1.4.4, 1.5.1 or higher, as it has been reported to fix this
vulnerability. Additionally, the vendor has released a patch to address this
issue, or users may opt to apply the following workaround: Disable the affected program by removing the SUID bit
suse.de -
