CVE-2023-3326

Description

pam_krb5 authenticates a user by essentially running kinit with the password, getting a ticket-granting ticket (tgt) from the Kerberos KDC (Key Distribution Center) over the network, as a way to verify the password. However, if a keytab is not provisioned on the system, pam_krb5 has no way to validate the response from the KDC, and essentially trusts the tgt provided over the network as being valid. In a non-default FreeBSD installation that leverages pam_krb5 for authentication and does not have a keytab provisioned, an attacker that is able to control both the password and the KDC responses can return a valid tgt, allowing authentication to occur for any user on the system.

Read the notes from the security team

Mitigation

Per the documentation, set verify_ap_req_nofail to true in the [libdefaults] section of /etc/krb5.conf.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
sssd	25.10 questing	Vulnerable, fix deferred
	25.04 plucky	Vulnerable, fix deferred
	24.10 oracular	Ignored end of life, was deferred
	24.04 LTS noble	Vulnerable, fix deferred
	23.10 mantic	Ignored end of life, was deferred [2024-05-27]
	23.04 lunar	Ignored end of life, was deferred [2024-05-27]
	22.10 kinetic	Ignored end of life, was deferred [2024-05-27]
	22.04 LTS jammy	Vulnerable, fix deferred
	20.04 LTS focal	Vulnerable, fix deferred
	18.04 LTS bionic	Vulnerable, fix deferred
	16.04 LTS xenial	Vulnerable, fix deferred
	14.04 LTS trusty	Ignored end of standard support
libpam-krb5	25.10 questing	Vulnerable, fix deferred
	25.04 plucky	Vulnerable, fix deferred
	24.10 oracular	Ignored end of life, was deferred
	24.04 LTS noble	Vulnerable, fix deferred
	23.10 mantic	Ignored end of life, was deferred [2024-05-27]
	23.04 lunar	Ignored end of life, was deferred [2024-05-27]
	22.10 kinetic	Ignored end of life, was deferred [2024-05-27]
	22.04 LTS jammy	Vulnerable, fix deferred
	20.04 LTS focal	Vulnerable, fix deferred
	18.04 LTS bionic	Vulnerable, fix deferred
	16.04 LTS xenial	Vulnerable, fix deferred
	14.04 LTS trusty	Vulnerable, fix deferred

Notes

mdeslaur

per the comments on the oss-sec post, "pam_krb5 and sssd-krb5 are both affected by the same attack, but they have always been _documented_ to be affected". See the "verify_ap_req_nofail" option in the man page. Deferring this CVE to see if a fix will be available, or if this isn't something that will ever get a fix because it works as documented. See https://www.openwall.com/lists/oss-security/2023/06/22/2

Severity score breakdown

Parameter	Value
Base score	9.8 · Critical
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity impact	High
Availability impact	High
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Cvss 3 Severity Score