Headline
Ubuntu Security Notice USN-6467-1
Ubuntu Security Notice 6467-1 - Robert Morris discovered that Kerberos did not properly handle memory access when processing RPC data through kadmind, which could lead to the freeing of uninitialized memory. An authenticated remote attacker could possibly use this issue to cause kadmind to crash, resulting in a denial of service.
==========================================================================
Ubuntu Security Notice USN-6467-1
November 01, 2023
krb5 vulnerability
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
- Ubuntu 14.04 LTS (Available with Ubuntu Pro)
Summary:
Kerberos could be made to crash if it received specially crafted
network traffic.
Software Description:
- krb5: MIT Kerberos Network Authentication Protocol
Details:
Robert Morris discovered that Kerberos did not properly handle memory
access when processing RPC data through kadmind, which could lead to the
freeing of uninitialized memory. An authenticated remote attacker could
possibly use this issue to cause kadmind to crash, resulting in a denial
of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS (Available with Ubuntu Pro):
krb5-admin-server 1.16-2ubuntu0.4+esm1
krb5-kdc 1.16-2ubuntu0.4+esm1
krb5-kdc-ldap 1.16-2ubuntu0.4+esm1
krb5-otp 1.16-2ubuntu0.4+esm1
krb5-pkinit 1.16-2ubuntu0.4+esm1
krb5-user 1.16-2ubuntu0.4+esm1
libgssapi-krb5-2 1.16-2ubuntu0.4+esm1
libgssrpc4 1.16-2ubuntu0.4+esm1
libk5crypto3 1.16-2ubuntu0.4+esm1
libkadm5clnt-mit11 1.16-2ubuntu0.4+esm1
libkadm5srv-mit11 1.16-2ubuntu0.4+esm1
libkdb5-9 1.16-2ubuntu0.4+esm1
libkrad0 1.16-2ubuntu0.4+esm1
libkrb5-3 1.16-2ubuntu0.4+esm1
libkrb5support0 1.16-2ubuntu0.4+esm1
Ubuntu 16.04 LTS (Available with Ubuntu Pro):
krb5-admin-server 1.13.2+dfsg-5ubuntu2.2+esm4
krb5-kdc 1.13.2+dfsg-5ubuntu2.2+esm4
krb5-kdc-ldap 1.13.2+dfsg-5ubuntu2.2+esm4
krb5-otp 1.13.2+dfsg-5ubuntu2.2+esm4
krb5-pkinit 1.13.2+dfsg-5ubuntu2.2+esm4
krb5-user 1.13.2+dfsg-5ubuntu2.2+esm4
libgssapi-krb5-2 1.13.2+dfsg-5ubuntu2.2+esm4
libgssrpc4 1.13.2+dfsg-5ubuntu2.2+esm4
libk5crypto3 1.13.2+dfsg-5ubuntu2.2+esm4
libkadm5clnt-mit9 1.13.2+dfsg-5ubuntu2.2+esm4
libkadm5srv-mit9 1.13.2+dfsg-5ubuntu2.2+esm4
libkdb5-8 1.13.2+dfsg-5ubuntu2.2+esm4
libkrad0 1.13.2+dfsg-5ubuntu2.2+esm4
libkrb5-3 1.13.2+dfsg-5ubuntu2.2+esm4
libkrb5support0 1.13.2+dfsg-5ubuntu2.2+esm4
Ubuntu 14.04 LTS (Available with Ubuntu Pro):
krb5-admin-server 1.12+dfsg-2ubuntu5.4+esm4
krb5-kdc 1.12+dfsg-2ubuntu5.4+esm4
krb5-kdc-ldap 1.12+dfsg-2ubuntu5.4+esm4
krb5-otp 1.12+dfsg-2ubuntu5.4+esm4
krb5-pkinit 1.12+dfsg-2ubuntu5.4+esm4
krb5-user 1.12+dfsg-2ubuntu5.4+esm4
libgssapi-krb5-2 1.12+dfsg-2ubuntu5.4+esm4
libgssrpc4 1.12+dfsg-2ubuntu5.4+esm4
libk5crypto3 1.12+dfsg-2ubuntu5.4+esm4
libkadm5clnt-mit9 1.12+dfsg-2ubuntu5.4+esm4
libkadm5srv-mit8 1.12+dfsg-2ubuntu5.4+esm4
libkadm5srv-mit9 1.12+dfsg-2ubuntu5.4+esm4
libkdb5-7 1.12+dfsg-2ubuntu5.4+esm4
libkrad0 1.12+dfsg-2ubuntu5.4+esm4
libkrb5-3 1.12+dfsg-2ubuntu5.4+esm4
libkrb5support0 1.12+dfsg-2ubuntu5.4+esm4
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6467-1
CVE-2023-36054
Related news
Gentoo Linux Security Advisory 202405-11 - Multiple vulnerabilities have been discovered in MIT krb5, the worst of which could lead to remote code execution. Versions greater than or equal to 1.21.2 are affected.
Dell vApp Manger, versions prior to 9.2.4.x contain an arbitrary file read vulnerability. A remote attacker could potentially exploit this vulnerability to read arbitrary files from the target system.
Ubuntu Security Notice 6467-2 - USN-6467-1 fixed a vulnerability in Kerberos. This update provides the corresponding update for Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 23.04. Robert Morris discovered that Kerberos did not properly handle memory access when processing RPC data through kadmind, which could lead to the freeing of uninitialized memory. An authenticated remote attacker could possibly use this issue to cause kadmind to crash, resulting in a denial of service.
lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.