Buffer overflow in OpenSSH before 2.9.9 and 3.x before 3.2.1 with Kerberos/AFS support and KerberosTgtPassing or AFSTokenPassing enabled allows remote and local authenticated users to gain privileges.