krb5 - multiple vulnerabilities

Several remote vulnerabilities have been discovered in the kdc component
of the krb5, a system for authenticating users and services on a
network. The Common Vulnerabilities and Exposures project identifies the
following problems:

• CVE-2008-0062
  An unauthenticated remote attacker may cause a krb4-enabled KDC to
  crash, expose information, or execute arbitrary code. Successful
  exploitation of this vulnerability could compromise the Kerberos key
  database and host security on the KDC host.
• CVE-2008-0063
  An unauthenticated remote attacker may cause a krb4-enabled KDC to
  expose information. It is theoretically possible for the exposed
  information to include secret key data on some platforms.
• CVE-2008-0947
  An unauthenticated remote attacker can cause memory corruption in the
  kadmind process, which is likely to cause kadmind to crash, resulting in
  a denial of service. It is at least theoretically possible for such
  corruption to result in database corruption or arbitrary code execution,
  though we have no such exploit and are not aware of any such exploits in
  use in the wild. In versions of MIT Kerberos shipped by Debian, this
  bug can only be triggered in configurations that allow large numbers of
  open file descriptors in a process.

For the old stable distribution (sarge), these problems have been fixed
in version krb5 1.3.6-2sarge6.

For the stable distribution (etch), these problems have been fixed in
version 1.4.4-7etch5.

We recommend that you upgrade your krb5 packages.