Description
The (1) krshd and (2) v4rcp applications in (a) MIT Kerberos 5 (krb5) up to 1.5, and 1.4.x before 1.4.4, when running on Linux and AIX, and (b) Heimdal 0.7.2 and earlier, do not check return codes for setuid calls, which allows local users to gain privileges by causing setuid to fail to drop privileges using attacks such as resource exhaustion.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | krb5 | 1.4.3-9 | — |
| Debian 13 | krb5 | 1.4.3-9 | — |
| Debian 12 | krb5 | 1.4.3-9 | — |
| Debian 3.1 | krb5 | 1.3.6-2sarge3 | DSA-1146-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | krb5 +4 | 1.3.4-33 | RHSA-2006:0612 |
Advisories 2
- RHSA-2006:0612 Red Hat Security Advisory: krb5 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1146-1 krb5 - programming error Debian Security (DSA / DLA) · Mar 9, 2026
References
- MDKSA-2006:139 vendor-advisory
- VU#580124 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2006-211.htm
- http://web.mit.edu/Kerberos/advisories/MITKRB5-SA-2006-001-setuid.txt
- 27869 vdb-entry
- 21847 third-party-advisory
- SUSE-SR:2006:020 vendor-advisory
- GLSA-200608-21 vendor-advisory
- 21461 third-party-advisory
- 21467 third-party-advisory
- DSA-1146 vendor-advisory
- RHSA-2006:0612 vendor-advisory
- 21436 third-party-advisory
- ADV-2006-3225 vdb-entry
- 21527 third-party-advisory
- 27870 vdb-entry
- http://www.pdc.kth.se/heimdal/advisory/2006-08-08/
- 20060808 MITKRB-SA-2006-001: multiple local privilege escalation vulnerabilities mailing-list
- oval:org.mitre.oval:def:9515 vdb-entry signature
- 21439 third-party-advisory
- 21402 third-party-advisory
- 20060816 UPDATED: MITKRB5-SA-2006-001: multiple local privilege escalation vulnerabilities mailing-list
- 21613 third-party-advisory
- SUSE-SR:2006:022 vendor-advisory
- 1016664 vdb-entry
- 21441 third-party-advisory
- 22291 third-party-advisory
- 21456 third-party-advisory
- GLSA-200608-15 vendor-advisory
- 21423 third-party-advisory
- USN-334-1 vendor-advisory
- 19427 vdb-entry