Headline
Ubuntu Security Notice USN-6467-2
Ubuntu Security Notice 6467-2 - USN-6467-1 fixed a vulnerability in Kerberos. This update provides the corresponding update for Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 23.04. Robert Morris discovered that Kerberos did not properly handle memory access when processing RPC data through kadmind, which could lead to the freeing of uninitialized memory. An authenticated remote attacker could possibly use this issue to cause kadmind to crash, resulting in a denial of service.
==========================================================================
Ubuntu Security Notice USN-6467-2
November 06, 2023
krb5 vulnerability
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.04
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
Kerberos could be made to crash if it received specially crafted
network traffic.
Software Description:
- krb5: MIT Kerberos Network Authentication Protocol
Details:
USN-6467-1 fixed a vulnerability in Kerberos. This update provides the
corresponding update for Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu
23.04.
Original advisory details:
Robert Morris discovered that Kerberos did not properly handle memory
access when processing RPC data through kadmind, which could lead to the
freeing of uninitialized memory. An authenticated remote attacker could
possibly use this issue to cause kadmind to crash, resulting in a denial
of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.04:
krb5-admin-server 1.20.1-1ubuntu0.1
krb5-kdc 1.20.1-1ubuntu0.1
krb5-kdc-ldap 1.20.1-1ubuntu0.1
krb5-otp 1.20.1-1ubuntu0.1
krb5-pkinit 1.20.1-1ubuntu0.1
krb5-user 1.20.1-1ubuntu0.1
libgssapi-krb5-2 1.20.1-1ubuntu0.1
libgssrpc4 1.20.1-1ubuntu0.1
libk5crypto3 1.20.1-1ubuntu0.1
libkadm5clnt-mit12 1.20.1-1ubuntu0.1
libkadm5srv-mit12 1.20.1-1ubuntu0.1
libkdb5-10 1.20.1-1ubuntu0.1
libkrad0 1.20.1-1ubuntu0.1
libkrb5-3 1.20.1-1ubuntu0.1
libkrb5support0 1.20.1-1ubuntu0.1
Ubuntu 22.04 LTS:
krb5-admin-server 1.19.2-2ubuntu0.3
krb5-kdc 1.19.2-2ubuntu0.3
krb5-kdc-ldap 1.19.2-2ubuntu0.3
krb5-otp 1.19.2-2ubuntu0.3
krb5-pkinit 1.19.2-2ubuntu0.3
krb5-user 1.19.2-2ubuntu0.3
libgssapi-krb5-2 1.19.2-2ubuntu0.3
libgssrpc4 1.19.2-2ubuntu0.3
libk5crypto3 1.19.2-2ubuntu0.3
libkadm5clnt-mit12 1.19.2-2ubuntu0.3
libkadm5srv-mit12 1.19.2-2ubuntu0.3
libkdb5-10 1.19.2-2ubuntu0.3
libkrad0 1.19.2-2ubuntu0.3
libkrb5-3 1.19.2-2ubuntu0.3
libkrb5support0 1.19.2-2ubuntu0.3
Ubuntu 20.04 LTS:
krb5-admin-server 1.17-6ubuntu4.4
krb5-kdc 1.17-6ubuntu4.4
krb5-kdc-ldap 1.17-6ubuntu4.4
krb5-otp 1.17-6ubuntu4.4
krb5-pkinit 1.17-6ubuntu4.4
krb5-user 1.17-6ubuntu4.4
libgssapi-krb5-2 1.17-6ubuntu4.4
libgssrpc4 1.17-6ubuntu4.4
libk5crypto3 1.17-6ubuntu4.4
libkadm5clnt-mit11 1.17-6ubuntu4.4
libkadm5srv-mit11 1.17-6ubuntu4.4
libkdb5-9 1.17-6ubuntu4.4
libkrad0 1.17-6ubuntu4.4
libkrb5-3 1.17-6ubuntu4.4
libkrb5support0 1.17-6ubuntu4.4
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6467-2
https://ubuntu.com/security/notices/USN-6467-1
CVE-2023-36054
Package Information:
https://launchpad.net/ubuntu/+source/krb5/1.20.1-1ubuntu0.1
https://launchpad.net/ubuntu/+source/krb5/1.19.2-2ubuntu0.3
https://launchpad.net/ubuntu/+source/krb5/1.17-6ubuntu4.4
Related news
Gentoo Linux Security Advisory 202405-11 - Multiple vulnerabilities have been discovered in MIT krb5, the worst of which could lead to remote code execution. Versions greater than or equal to 1.21.2 are affected.
Dell vApp Manger, versions prior to 9.2.4.x contain an arbitrary file read vulnerability. A remote attacker could potentially exploit this vulnerability to read arbitrary files from the target system.
Ubuntu Security Notice 6467-1 - Robert Morris discovered that Kerberos did not properly handle memory access when processing RPC data through kadmind, which could lead to the freeing of uninitialized memory. An authenticated remote attacker could possibly use this issue to cause kadmind to crash, resulting in a denial of service.
lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.