pam_krb5 bug fix update

An updated pam_krb5 package that fixes various bugs is now available.

The pam_krb5 module allows Pluggable Authentication Modules (PAM) aware
applications to use Kerberos to verify user identities by obtaining user
credentials at log in time.

This updated package fixes the following bugs:

* when a user or calling application supplied '""' as the value for a
user's password, and libkrb5 attempted to invoke a callback function to
verify that this was intended as a password value, pam_krb5 did not confirm
that this was the case. The resulting error was incorrectly treated as a
system-level error, rather than an authentication error, which in many
cases caused a subsequent PAM account management function to fail,
incorrectly denying log in.

* when configured to make use of externally-provided credentials, and
to convert Kerberos 5 credentials to Kerberos IV credentials, the module
would cause the calling application to crash if the externally-provided
Kerberos 5 ticket-granting ticket (TGT) was not directly suitable for
conversion.

* when configured to disable attempts to obtain Kerberos IV credentials,
and AFS was detected, the module would still attempt to obtain them, either
using an AS request, or with the help of a Kerberos 524 server. In this
updated package, the "no_krb4_use_as_req" and "no_krb4_convert_524"
options have been backported, which allows this functionality to be
disabled. For further details on these options, refer to the pam_krb5 man
pages.

Users of pam_krb5 are advised to upgrade to this updated package, which
resolves these issues.

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

244641 - Problem for ssh for kerberos users with PermitEmptyPasswords yes
428439 - sshd segfaults during kerberos auth with krb4 credentials

convert, external, prompter