• info
• discussion
• exploit
• solution
• references

KTH Kerberos 4 Arbitrary Proxy Usage Vulnerability

Solution:
Upgrade to KTH Kerberos 4 version 1.0.4. NetBSD has released a patch for NetBSD 1.5.


KTH Kerberos 4 1.0

• FreeBSD 3.5.1 telnetd-krb.3.5.1.patch
  ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-01:25/telnetd-krb.3. 5.1.patch


• FreeBSD 4.2 telnetd-krb.4.2.patch
  ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-01:25/telnetd-krb.4. 2.patch

KTH Kerberos 4 1.0.3

• KTH Kerberos 4 1.0.4
  ftp://ftp.pdc.kth.se/pub/krb/src/krb4-1.0.4.tar.gz


• NetBSD 20001220-krb
  ftp://ftp.NetBSD.ORG/pub/NetBSD/misc/security/patches/20001220-krb