Debian DSA 269-2: Critical Heimdal Cryptographic Weakness Remote Threat

Due to overzealous applied patches, the security update DSA 269-1
introduced problems in some installations, causing the hprop service
to fail. This is corrected with the update below.

For completeness, here is the original advisory text:

A cryptographic weakness in version 4 of the Kerberos protocol allows
an attacker to use a chosen-plaintext attack to impersonate any
principal in a realm. Additional cryptographic weaknesses in the krb4
implementation permit the use of cut-and-paste attacks to fabricate
krb4 tickets for unauthorized client principals if triple-DES keys are
used to key krb4 services. These attacks can subvert a site's entire
Kerberos authentication infrastructure.

This version of the heimdal package changes the default behavior and
disallows cross-realm authentication for Kerberos version 4. Because
of the fundamental nature of the problem, cross-realm authentication
in Kerberos version 4 cannot be made secure and sites should avoid its
use. A new opt...