Received: from SOUTH-STATION-ANNEX.MIT.EDU by po7.MIT.EDU (5.61/4.7) id AA00862; Sat, 24 Feb 96 15:01:11 EST
Received: by MIT.EDU 
	id AB29718; Sat, 24 Feb 96 15:00:35 EST
Date: Sat, 24 Feb 96 15:00:35 EST
From: MAILER-DAEMON@MIT.EDU (Mail Delivery Subsystem)
Subject: Returned mail: Cannot send message for 3 days
Message-Id: <9602242000.AB29718@MIT.EDU>
To: <owner-kerberos@MIT.EDU>
To: hartmans@PO9.LOCAL
To: proven@PO7.LOCAL
To: tytso@PO9.LOCAL
To: basch@lehman.com
To: jis@E40-PO.LOCAL
To: tlyu@PO9.LOCAL

   ----- Transcript of session follows -----
421 sci.uma.es.tcp... Deferred: Address family not supported by protocol family
451 jcrey@sci.uma.es... Cannot send message for 3 days
jcrey@sci.uma.es... Cannot send message for 3 days

   ----- Unsent message follows -----
Received: from pad-thai.cam.ov.com by MIT.EDU with SMTP
	id AA09249; Wed, 21 Feb 96 14:59:57 EST
Received:  by pad-thai.cam.ov.com (8.6.12/)
	id <PAA11090@pad-thai.cam.ov.com>; Wed, 21 Feb 1996 15:04:02 -0500
Received: from GATEWAY by pad-thai.cam.ov.com with netnews
	for kerberos-wrapper@cam.ov.com (kerberos@mit.edu)
To: kerberos@MIT.EDU
Date: 21 Feb 1996 17:48:59 GMT
From: john@iastate.edu (John Hascall)
Message-Id: <4gflub$ome@news.iastate.edu>
Organization: Iowa State University, Ames, Iowa USA
Sender: usenet@cam.ov.com
References: <4gd97f$gdi@srvr1.engin.umich.edu>, <4gdc46$9tn@narnia.cs.purdue.edu>, <312AA5FD.2E1A@dnai.com>
Subject: Re: Kerberos Weakness (COAST Findings)

Michael Sierchio  <kudzu@dnai.com> wrote:
}Steve Lodin wrote:
}> 
}> There is information available on the Kerberos vulnerability incident at:
}
}I am not sure, but I believe that this is nothing new.  Steve Bellovin at
}AT&T had a paper a number of years ago on weaknesses in the Kerberos
}Authentication Suite.

   I don't recall it being in the Bellovin paper, but
   it's definitely not new.  Anyone who has looked at
   that section of the code has surely had the flaw
   practically leap out and slap them in the face.

   It's been fixed in (at least) a couple of commercial KrbIV
   implementations for years.

John
-- 
John Hascall                ``An ill-chosen word is the fool's messenger.''
Moderator, comp.unix.wizards
Systems Software Engineer, ISU Comp Center + Ames, IA  50011 + 515/294-9551
<a href="http://www.cc.iastate.edu/staff/systems/john/">My Homepage</a>