Ubuntu update for krb5

1) Access of Uninitialized Pointer

EUVDB-ID: #VU79586

Risk: Medium

CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-36054

CWE-ID: CWE-824 - Access of Uninitialized Pointer

Exploit availability: No

Description

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to the  _xdr_kadm5_principal_ent_rec() function in lib/kadm5/kadm_rpc_xdr.c does not validate the relationship between n_key_data and the key_data array count and frees an uninitialized pointer. A remote user can send a specially crafted request to the application and perform a denial of service (DoS) attack.

Mitigation

Update the affected package krb5 to the latest version.

Vulnerable software versions

Ubuntu: 20.04 - 23.04

libkdb5-9 (Ubuntu package): before 1.17-6ubuntu4.4

libkadm5srv-mit11 (Ubuntu package): before 1.17-6ubuntu4.4

libkadm5clnt-mit11 (Ubuntu package): before 1.17-6ubuntu4.4

libkrb5support0 (Ubuntu package): before 1.17-6ubuntu4.4

libkrb5-3 (Ubuntu package): before 1.17-6ubuntu4.4

libkrad0 (Ubuntu package): before 1.17-6ubuntu4.4

libkdb5-10 (Ubuntu package): before 1.19.2-2ubuntu0.3

libkadm5srv-mit12 (Ubuntu package): before 1.19.2-2ubuntu0.3

libkadm5clnt-mit12 (Ubuntu package): before 1.19.2-2ubuntu0.3

libk5crypto3 (Ubuntu package): before 1.17-6ubuntu4.4

libgssrpc4 (Ubuntu package): before 1.17-6ubuntu4.4

libgssapi-krb5-2 (Ubuntu package): before 1.17-6ubuntu4.4

krb5-user (Ubuntu package): before 1.17-6ubuntu4.4

krb5-pkinit (Ubuntu package): before 1.17-6ubuntu4.4

krb5-otp (Ubuntu package): before 1.17-6ubuntu4.4

krb5-kdc-ldap (Ubuntu package): before 1.17-6ubuntu4.4

krb5-kdc (Ubuntu package): before 1.17-6ubuntu4.4

krb5-admin-server (Ubuntu package): before 1.17-6ubuntu4.4

CPE2.3

• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:*
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:*
• cpe:2.3:o:canonical:ubuntu:23.04:*:*:*:*:*:*:*
• cpe:2.3:a:canonical:libkdb5-9_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:a:canonical:libkadm5srv-mit11_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:a:canonical:libkadm5clnt-mit11_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:a:canonical:libkrb5support0_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:a:canonical:libkrb5-3_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:a:canonical:libkrad0_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:a:canonical:libkdb5-10_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:a:canonical:libkadm5srv-mit12_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:a:canonical:libkadm5clnt-mit12_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:a:canonical:libk5crypto3_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:a:canonical:libgssrpc4_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:a:canonical:libgssapi-krb5-2_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:a:canonical:krb5-user_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:a:canonical:krb5-pkinit_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:a:canonical:krb5-otp_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:a:canonical:krb5-kdc-ldap_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:a:canonical:krb5-kdc_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:a:canonical:krb5-admin-server_ubuntu_package:*:*:*:*:*:ubuntu:*:*

External links

https://ubuntu.com/security/notices/USN-6467-2

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.