Key management errors in heimdal - CVE-2019-12098

Vulnerability identifier: #VU29242

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-12098

CWE-ID: CWE-320

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a Man-in-the-Middle (MitM) attack.

The vulnerability exists due to Heimdal fails to verify anonymous PKINIT PA-PKINIT-KX key exchange within the krb5_init_creds_step() function in lib/krb5/init_creds_pw.c. A remote attacker can perform a MitM attack against the Heimdal client.

heimdal
cflinuxfs3
Fedora
Ubuntu
SUSE Linux
Opensuse
heimdal (Alpine package)
libkrb5-26-heimdal (Ubuntu package)
libgssapi3-heimdal (Ubuntu package)
heimdal-clients-x (Ubuntu package)
heimdal-servers (Ubuntu package)
heimdal-kcm (Ubuntu package)
heimdal-servers-x (Ubuntu package)
heimdal-kdc (Ubuntu package)
heimdal-clients (Ubuntu package)
libkdc2-heimdal (Ubuntu package)
heimdal

Install updates from vendor's website.

heimdal - update to 7.6.0
cflinuxfs3 - update to 0.328.0
heimdal (Alpine package) - addressed in versions 7.4.0-r4, 7.5.0-r3
libkrb5-26-heimdal (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 7.5.0+dfsg-1ubuntu0.1, 7.7.0+dfsg-1ubuntu1.1
libgssapi3-heimdal (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 7.5.0+dfsg-1ubuntu0.1, 7.7.0+dfsg-1ubuntu1.1
heimdal-clients-x (Ubuntu package) - update to Ubuntu Pro (Infra-only)
heimdal-servers (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 7.5.0+dfsg-1ubuntu0.1, 7.7.0+dfsg-1ubuntu1.1
heimdal-kcm (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 7.5.0+dfsg-1ubuntu0.1, 7.7.0+dfsg-1ubuntu1.1
heimdal-servers-x (Ubuntu package) - update to Ubuntu Pro (Infra-only)
heimdal-kdc (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 7.5.0+dfsg-1ubuntu0.1, 7.7.0+dfsg-1ubuntu1.1
heimdal-clients (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 7.5.0+dfsg-1ubuntu0.1, 7.7.0+dfsg-1ubuntu1.1
libkdc2-heimdal (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 7.5.0+dfsg-1ubuntu0.1, 7.7.0+dfsg-1ubuntu1.1
heimdal - addressed in versions 7.7.0-2.el6_10, 7.7.0-2.el7, 7.7.0-2.fc30, 7.7.0-2.fc31

• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00002.html
• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00003.html
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00026.html
• http://www.h5l.org/pipermail/heimdal-announce/2019-May/000009.html
• https://github.com/heimdal/heimdal/commit/2f7f3d9960aa6ea21358bdf3687cee5149aa35cf
• https://github.com/heimdal/heimdal/compare/3e58559...bbafe72
• https://github.com/heimdal/heimdal/releases/tag/heimdal-7.6.0
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GIXEDVVMPD6ZAJSMI2EZ7FNEIVNWE5PD/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SLXXIF4LOQEAEDAF4UGP2AO6WDNTDFUB/
• https://seclists.org/bugtraq/2019/Jun/1
• https://www.debian.org/security/2019/dsa-4455

• MitM attack in Heimdal
• OpenSUSE Linux update for libheimdal
• OpenSUSE Linux update for libheimdal
• OpenSUSE Linux update for libheimdal
• Key management errors in heimdal (Alpine package)
• Ubuntu update for heimdal
• Multiple vulnerabilities in cflinuxfs3
• Fedora 31 update for heimdal
• Fedora 30 update for heimdal
• Fedora EPEL 7 update for heimdal
• Fedora EPEL 6 update for heimdal