CVE-2023-3326
Summary
| CVE | CVE-2023-3326 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2023-06-22 17:15:00 UTC |
| Updated | 2023-08-01 23:15:00 UTC |
| Description | pam_krb5 authenticates a user by essentially running kinit with the password, getting a ticket-granting ticket (tgt) from the Kerberos KDC (Key Distribution Center) over the network, as a way to verify the password. However, if a keytab is not provisioned on the system, pam_krb5 has no way to validate the response from the KDC, and essentially trusts the tgt provided over the network as being valid. In a non-default FreeBSD installation that leverages pam_krb5 for authentication and does not have a keytab provisioned, an attacker that is able to control both the password and the KDC responses can return a valid tgt, allowing authentication to occur for any user on the system. |
Risk And Classification
Problem Types: CWE-287
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Freebsd | Freebsd | All | All | All | All |
| Operating System | Freebsd | Freebsd | 12.4 | - | All | All |
| Operating System | Freebsd | Freebsd | 12.4 | p1 | All | All |
| Operating System | Freebsd | Freebsd | 12.4 | p2 | All | All |
| Operating System | Freebsd | Freebsd | 12.4 | rc2-p1 | All | All |
| Operating System | Freebsd | Freebsd | 12.4 | rc2-p2 | All | All |
| Operating System | Freebsd | Freebsd | 13.1 | - | All | All |
| Operating System | Freebsd | Freebsd | 13.1 | b1-p1 | All | All |
| Operating System | Freebsd | Freebsd | 13.1 | b2-p2 | All | All |
| Operating System | Freebsd | Freebsd | 13.1 | p1 | All | All |
| Operating System | Freebsd | Freebsd | 13.1 | p2 | All | All |
| Operating System | Freebsd | Freebsd | 13.1 | p3 | All | All |
| Operating System | Freebsd | Freebsd | 13.1 | p4 | All | All |
| Operating System | Freebsd | Freebsd | 13.1 | p5 | All | All |
| Operating System | Freebsd | Freebsd | 13.1 | p6 | All | All |
| Operating System | Freebsd | Freebsd | 13.1 | p7 | All | All |
| Operating System | Freebsd | Freebsd | 13.1 | rc1-p1 | All | All |
| Operating System | Freebsd | Freebsd | 13.2 | - | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| security.FreeBSD.org/advisories/FreeBSD-SA-23:04.pam_krb5.asc | MISC | security.FreeBSD.org | |
| security.FreeBSD.org/advisories/FreeBSD-SA-23:09.pam_krb5.asc | MISC | security.FreeBSD.org | |
| 403 Forbidden | MISC | security.netapp.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.