CVE-2023-3326

Publication date 22 June 2023

Last updated 24 July 2024

Ubuntu priority

Low

Why this priority?

Cvss 3 Severity Score

9.8 · Critical

Score breakdown

pam_krb5 authenticates a user by essentially running kinit with the password, getting a ticket-granting ticket (tgt) from the Kerberos KDC (Key Distribution Center) over the network, as a way to verify the password. However, if a keytab is not provisioned on the system, pam_krb5 has no way to validate the response from the KDC, and essentially trusts the tgt provided over the network as being valid. In a non-default FreeBSD installation that leverages pam_krb5 for authentication and does not have a keytab provisioned, an attacker that is able to control both the password and the KDC responses can return a valid tgt, allowing authentication to occur for any user on the system.

Read the notes from the security team

Mitigation

Per the documentation, set verify_ap_req_nofail to true in the [libdefaults] section of /etc/krb5.conf.

Status

Package Ubuntu Release Status
libpam-krb5 24.10 oracular
Vulnerable, fix deferred
24.04 LTS noble
Vulnerable, fix deferred
23.10 mantic Ignored end of life, was deferred [2024-05-27]
23.04 lunar Ignored end of life, was deferred [2024-05-27]
22.10 kinetic Ignored end of life, was deferred [2024-05-27]
22.04 LTS jammy
Vulnerable, fix deferred
20.04 LTS focal
Vulnerable, fix deferred
18.04 LTS bionic
Vulnerable, fix deferred
16.04 LTS xenial
Vulnerable, fix deferred
14.04 LTS trusty Ignored end of ESM support, was deferred
sssd 24.10 oracular
Vulnerable, fix deferred
24.04 LTS noble
Vulnerable, fix deferred
23.10 mantic Ignored end of life, was deferred [2024-05-27]
23.04 lunar Ignored end of life, was deferred [2024-05-27]
22.10 kinetic Ignored end of life, was deferred [2024-05-27]
22.04 LTS jammy
Vulnerable, fix deferred
20.04 LTS focal
Vulnerable, fix deferred
18.04 LTS bionic
Vulnerable, fix deferred
16.04 LTS xenial
Vulnerable, fix deferred
14.04 LTS trusty Ignored end of standard support

Notes

mdeslaur

per the comments on the oss-sec post, "pam_krb5 and sssd-krb5 are both affected by the same attack, but they have always been _documented_ to be affected". See the "verify_ap_req_nofail" option in the man page. Deferring this CVE to see if a fix will be available, or if this isn't something that will ever get a fix because it works as documented. See https://www.openwall.com/lists/oss-security/2023/06/22/2

Severity score breakdown

Parameter Value
Base score 9.8 · Critical
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Scope Unchanged
Confidentiality High
Integrity impact High
Availability impact High
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H