Multiple critical vulnerabilities have been discovered in version five of the widely-used Kerberos authentication protocol. The most serious of the bugs create a means to either compromise or crash vulnerable systems.

Exploits are yet to surface and patches are available. All releases of MIT Kerberos 5 up to and including krb5-1.6.3 are affected.

A further two bugs in the Kerberos RPC library, involving the handling of open file descriptors, might be exploited to cause memory corruption.

Developers are advised to update to version krb5-1.6.4 or apply workarounds.

A overview of the bugs by security clearing house Secunia can be found here. A summary of the products affected - along with responses from vendors - has been published by US CERT here and here.

Kerberos was developed by MIT and is a popular means for securely authenticating a request for a service in a computer network. The name derives from Greek mythology, where Cerberus is the three-headed dog guarding the gates of Hades. ®

Related stories

• RSA DHS chief goes nuclear on cyber security (9 April 2008)
• Apple unleashes monster patch batch on Mac faithful (19 March 2008)
• Network access control with fewer delays (7 March 2007)
• Critical Kerberos bugs surface (2 September 2004)
• Kerberos Redux? (7 May 2003)