A possible buffer overflow in the Kerberos 4 component of Heimdal has been discovered.
|Package||app-crypt/heimdal on all architectures|
|Affected versions||< 0.6.2|
|Unaffected versions||>= 0.6.2|
Heimdal is a free implementation of Kerberos.
A buffer overflow was discovered in kadmind, a server for administrative access to the Kerberos database.
By sending a specially formatted message to kadmind, a remote attacker may be able to crash kadmind causing a denial of service, or execute arbitrary code with the permissions of the kadmind process.
For a temporary workaround, providing you do not require Kerberos 4 support, you may turn off Kerberos 4 kadmin by running kadmind with the --no-kerberos4 option.
All Heimdal users should upgrade to the latest stable version:
# emerge sync # emerge -pv ">=app-crypt/heimdal-0.6.2" # emerge ">=app-crypt/heimdal-0.6.2"
May 27, 2004
May 27, 2004: 01