Reachable Assertion in Kerberos 5 - CVE-2018-20217

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU17350

Reachable Assertion in Kerberos 5 - CVE-2018-20217

Published: February 1, 2019


Vulnerability identifier: #VU17350
CSH Severity: Low
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-20217
CWE-ID: CWE-617
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a reachable assertion in in the KDC. A remote attacker can obtain a krbtgt ticket using an older encryption type (single-DES, triple-DES, or RC4) and crash the KDC by making an S4U2Self request.


Affected software

Kerberos 5
VMware Tanzu Application Service for VMs
Isolation Segment
Amazon Linux AMI
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power, big endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Ubuntu
Opensuse
Fedora
krb5 (Red Hat package)
krb5 (Alpine package)
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
libkdb5-7 (Ubuntu package)
libkdb5-8 (Ubuntu package)
krb5-admin-server (Ubuntu package)
krb5-kdc (Ubuntu package)
krb5-user (Ubuntu package)
libgssapi-krb5-2 (Ubuntu package)
krb5
libkdb5-9 (Ubuntu package)
libkdb5-10 (Ubuntu package)
IBM Security Verify Access
VMware Tanzu Operations Manager
Platform Automation Toolkit
Dell EMC Unity Operating Environment (OE)
Dell EMC Unity VSA Operating Environment (OE)

How to mitigate CVE-2018-20217

Install updates from vendor's website.

krb5 (Red Hat package) - update to 1.15.1-37.el7_7.2
krb5 (Alpine package) - update to 1.14.3-r3
IBM Security Verify Access - update to 10.0.4.0
libkdb5-7 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
libkdb5-8 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
krb5-admin-server (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1.16-2ubuntu0.3, 1.17-6ubuntu4.2, 1.19.2-2ubuntu0.1, 1.20-1ubuntu0.1
krb5-kdc (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1.16-2ubuntu0.3, 1.17-6ubuntu4.2, 1.19.2-2ubuntu0.1, 1.20-1ubuntu0.1
krb5-user (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1.16-2ubuntu0.3, 1.17-6ubuntu4.2, 1.19.2-2ubuntu0.1, 1.20-1ubuntu0.1
libgssapi-krb5-2 (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1.16-2ubuntu0.3, 1.17-6ubuntu4.2, 1.19.2-2ubuntu0.1, 1.20-1ubuntu0.1
krb5 - addressed in versions 1.16.1-22.fc28, 1.16.1-22.fc29, 1.16.1-24.fc28
libkdb5-9 (Ubuntu package) - addressed in versions 1.16-2ubuntu0.3, 1.17-6ubuntu4.2
libkdb5-10 (Ubuntu package) - addressed in versions 1.19.2-2ubuntu0.1, 1.20-1ubuntu0.1
VMware Tanzu Operations Manager - addressed in versions 2.10.53, 3.0.4
Platform Automation Toolkit - addressed in versions 4.4.31, 5.0.24, 5.1.0
Dell EMC Unity Operating Environment (OE) - update to 5.0.0.0.5.116
Dell EMC Unity VSA Operating Environment (OE) - update to 5.0.0.0.5.116

External References

Related Security Bulletins