Thanks to Nalin Dahyabhai of Redhat for pointing out some other buffer overruns and coming up with patches. The most significant impact of these vulnerabilities may allow a remote intruder to gain root access to systems running vulnerable services, including the KDC for the domain. This vulnerability may be exploited by remote users to gain root privileges on systems running services linked against the vulnerable library. Local users can execute arbitrary code as root on systems where v4rcp is installed setuid root. Remote users may be able to execute arbitrary code as root on systems running a vulnerable version of krshd.
Local users can can gain root privileges by exploiting the buffer overflow in ksu.
Appendix A contains information provided by vendors for this advisory. We will update the appendix as we receive more information. Please contact your vendor directly. Apply the MIT patches If you are running the Kerberos 5 distribution from MIT, and can rebuild your binaries from source, you can apply the source code patches from MIT to correct these problems. You will also need to recompile any programs that have been statically linked with the vulnerable libraries.