CVE-2023-3326 Network authentication attack via pam_krb5

2023-06-2216:37:51

CWE-303

freebsd

www.cve.org

pam_krb5

authentication

vulnerability

unauthorized access

kerberos

network.

9.9 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

55.2%

JSON

pam_krb5 authenticates a user by essentially running kinit with the password, getting a ticket-granting ticket (tgt) from the Kerberos KDC (Key Distribution Center) over the network, as a way to verify the password. However, if a keytab is not provisioned on the system, pam_krb5 has no way to validate the response from the KDC, and essentially trusts the tgt provided over the network as being valid. In a non-default FreeBSD installation that leverages pam_krb5 for authentication and does not have a keytab provisioned, an attacker that is able to control both the password and the KDC responses can return a valid tgt, allowing authentication to occur for any user on the system.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "modules": [
      "pam_krb5"
    ],
    "product": "FreeBSD",
    "vendor": "FreeBSD",
    "versions": [
      {
        "lessThan": "13.2-RELEASE-p1",
        "status": "affected",
        "version": "13.2-RELEASE",
        "versionType": "release"
      },
      {
        "lessThan": "13.1-RELEASE-p8",
        "status": "affected",
        "version": "13.1-RELEASE",
        "versionType": "release"
      },
      {
        "lessThan": "12.4-RELEASE-p3",
        "status": "affected",
        "version": "12.4-RELEASE",
        "versionType": "release"
      }
    ]
  }
]