krb5 -- RFC 3961 key-derivation checksum handling vulnerability

The MIT Kerberos team reports:

MIT krb5 (releases incorrectly accepts RFC 3961
key-derivation checksums using RC4 keys when verifying AD-SIGNEDPATH
and AD-KDC-ISSUED authorization data.
An authenticated remote attacker that controls a legitimate service
principal has a 1/256 chance of forging the AD-SIGNEDPATH signature
if the TGT key is RC4, allowing it to use self-generated “evidence”
tickets for S4U2Proxy, instead of tickets obtained from the user or
with S4U2Self. Configurations using RC4 for the TGT key are
believed to be rare.
An authenticated remote attacker has a 1/256 chance of forging
AD-KDC-ISSUED signatures on authdata elements in tickets having
an RC4 service key, resulting in privilege escalation against
a service that relies on these signatures. There are no known
uses of the KDC-ISSUED authdata container at this time.