There is a serious flaw in the widely used Kerberos authentication protocol that enables intruders to gain root privileges on vulnerable machines. This, in turn, allows attackers to execute any code they choose on the machine.
This vulnerability is especially serious in that the attacker does not need to be authenticated to the Kerberos daemon to execute an attack. All releases of MIT Kerberos 5 are vulnerable, as are all Kerberos 4 implementations derived from MIT Kerberos 4.
The flaw is a stack buffer overrun in the implementation of the Kerberos 4 compatibility administration daemon in Kerberos 5. To exploit this vulnerability, an attacker would need to construct a request that would cause the authent.length value to become either negative or greater than the size of the stack buffer that is allocated for it.
There is a known exploit for this flaw circulating on the Internet, according to the advisory published by the Kerberos team at the Massachusetts Institute of Technology.
Developed by MIT, Kerberos is a popular network authentication protocol. Available as freeware from MIT, it is also included in numerous commercial products.
The Kerberos team has posted an advisory and a patch for this vulnerability, both of which are available here.