MIT krb5 CVE-2017-7562 Authentication Bypass Vulnerability

Bugtraq ID:	100511
Class:	Design Error
CVE:	CVE-2017-7562
Remote:	Yes
Local:	No
Published:	Aug 25 2017 12:00AM
Updated:	Aug 25 2017 12:00AM
Credit:	greghudson
Vulnerable:	MIT krb5 0
Not Vulnerable:

MIT krb5 CVE-2017-7562 Authentication Bypass Vulnerability

MIT krb5 is prone to an authentication-bypass vulnerability.

Attackers may exploit this issue to gain unauthorized access or bypass intended security restrictions.

MIT krb5 CVE-2017-7562 Authentication Bypass Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

MIT krb5 CVE-2017-7562 Authentication Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

MIT krb5 CVE-2017-7562 Authentication Bypass Vulnerability

References:

• Add PKINIT test case for generic client cert (greghudson)
  
• Add test cert with no extensions (greghudson)
  
• Fix certauth built-in module returns (greghudson)
  
• Kerberos Homepage (MIT)
  
• CVE-2017-7562 krb5: Authentication bypass by improper validation of certificate (Red Hat)
  
• Oracle Linux Bulletin - April 2018 (Oracle)