krb5 security update

CentOS Errata and Security Advisory CESA-2006:0612

Kerberos is a network authentication system which allows clients and
servers to authenticate to each other through use of symmetric encryption
and a trusted third party, the KDC.

A flaw was found where some bundled Kerberos-aware applications would fail
to check the result of the setuid() call. On Linux 2.6 kernels, the
setuid() call can fail if certain user limits are hit. A local attacker
could manipulate their environment in such a way to get the applications to
continue to run as root, potentially leading to an escalation of
privileges. (CVE-2006-3083).

Users are advised to update to these erratum packages which contain a
backported fix to correct this issue.

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2006-August/075291.html
https://lists.centos.org/pipermail/centos-announce/2006-August/075292.html
https://lists.centos.org/pipermail/centos-announce/2006-August/075293.html
https://lists.centos.org/pipermail/centos-announce/2006-August/075295.html
https://lists.centos.org/pipermail/centos-announce/2006-August/075296.html

Affected packages:
krb5-devel
krb5-libs
krb5-server
krb5-workstation

Upstream details at:
https://access.redhat.com/errata/RHSA-2006:0612