[1503] in WWW Security List Archive
Re: Kerberos Vulnerability
daemon@ATHENA.MIT.EDU (Jeffrey I. Schiller)
Mon Feb 19 20:14:33 1996
Date: Mon, 19 Feb 1996 16:45:51 -0500
To: David Kennedy <76702.3557@compuserve.com>
From: jis@mit.edu (Jeffrey I. Schiller)
Cc: <www-security@ns2.rutgers.edu>
Errors-To: owner-www-security@ns2.rutgers.edu
There will be a fix distributed by MIT later this week. The problem is that
the random number generator in V4 is worse then we thought! The fix is to
retrofit the V5 generator (which is decent) into the V4 KDC. Note: Only the
KDC needs to be updated, clients and servers are unaffected.
-Jeff
