Multiple vulnerabilities in MIT Kerberos 5 might allow remote unauthenticated users to execute arbitrary code with root privileges.
|Package||app-crypt/mit-krb5 on all architectures|
|Affected versions||< 1.6.3-r6|
|Unaffected versions||>= 1.6.3-r6|
MIT Kerberos 5 is a suite of applications that implement the Kerberos network protocol. kadmind is the MIT Kerberos 5 administration daemon, KDC is the Key Distribution Center.
Multiple vulnerabilities have been reported in MIT Kerberos 5:
A remote unauthenticated attacker could exploit the first vulnerability to cause a Denial of Service or, in unlikely circumstances, execute arbitrary code on the host running krb5kdc or kadmind with root privileges and compromise the Kerberos key database. Exploitation of the other vulnerabilities might lead to a Denial of Service in kadmind, krb5kdc, or other daemons performing authorization against Kerberos that utilize GSS-API or an information disclosure.
There is no known workaround at this time.
All MIT Kerberos 5 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-crypt/mit-krb5-1.6.3-r6"