Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

fstec логотип

BDU:2023-04390

Опубликовано: 21 июн. 2023
Источник: fstec
CVSS3: 9.8
CVSS2: 10
EPSS Низкий

Описание

Уязвимость модуля pam_krb5 операционных систем FreeBSD связана с некорректной реализацией алгоритма аутентификации. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, получить несанкционированный доступ к системе

Вендор

FreeBSD Project

Наименование ПО

FreeBSD

Версия ПО

до 12.4 (FreeBSD)
от 13.0 до 13.1 (FreeBSD)
12.4 p1 (FreeBSD)
12.4 p2 (FreeBSD)
12.4 rc2-p1 (FreeBSD)
12.4 rc2-p2 (FreeBSD)
13.1 b1-p1 (FreeBSD)
13.1 b2-p2 (FreeBSD)
13.1 p1 (FreeBSD)
13.1 p2 (FreeBSD)
13.1 p3 (FreeBSD)
13.1 p4 (FreeBSD)
13.1 p5 (FreeBSD)
13.1 p6 (FreeBSD)
13.1 p7 (FreeBSD)
13.1 rc1-p1 (FreeBSD)

Тип ПО

Операционная система

Операционные системы и аппаратные платформы

-

Уровень опасности уязвимости

Критический уровень опасности (базовая оценка CVSS 2.0 составляет 10)
Критический уровень опасности (базовая оценка CVSS 3.0 составляет 9,8)

Возможные меры по устранению уязвимости

Использование рекомендаций:
https://www.freebsd.org/security/advisories/FreeBSD-SA-23:04.pam_krb5.asc

Статус уязвимости

Подтверждена производителем

Наличие эксплойта

Данные уточняются

Информация об устранении

Уязвимость устранена

Идентификаторы других систем описаний уязвимостей

EPSS

Процентиль: 62%
0.00433
Низкий

9.8 Critical

CVSS3

10 Critical

CVSS2

Связанные уязвимости

CVSS3: 9.8
ubuntu
больше 2 лет назад

pam_krb5 authenticates a user by essentially running kinit with the password, getting a ticket-granting ticket (tgt) from the Kerberos KDC (Key Distribution Center) over the network, as a way to verify the password. However, if a keytab is not provisioned on the system, pam_krb5 has no way to validate the response from the KDC, and essentially trusts the tgt provided over the network as being valid. In a non-default FreeBSD installation that leverages pam_krb5 for authentication and does not have a keytab provisioned, an attacker that is able to control both the password and the KDC responses can return a valid tgt, allowing authentication to occur for any user on the system.

CVSS3: 9.8
nvd
больше 2 лет назад

pam_krb5 authenticates a user by essentially running kinit with the password, getting a ticket-granting ticket (tgt) from the Kerberos KDC (Key Distribution Center) over the network, as a way to verify the password. However, if a keytab is not provisioned on the system, pam_krb5 has no way to validate the response from the KDC, and essentially trusts the tgt provided over the network as being valid. In a non-default FreeBSD installation that leverages pam_krb5 for authentication and does not have a keytab provisioned, an attacker that is able to control both the password and the KDC responses can return a valid tgt, allowing authentication to occur for any user on the system.

CVSS3: 9.8
debian
больше 2 лет назад

pam_krb5 authenticates a user by essentially running kinit with the pa ...

CVSS3: 9.8
github
больше 2 лет назад

pam_krb5 authenticates a user by essentially running kinit with the password, getting a ticket-granting ticket (tgt) from the Kerberos KDC (Key Distribution Center) over the network, as a way to verify the password. However, if a keytab is not provisioned on the system, pam_krb5 has no way to validate the response from the KDC, and essentially trusts the tgt provided over the network as being valid. In a non-default FreeBSD installation that leverages pam_krb5 for authentication and does not have a keytab provisioned, an attacker that is able to control both the password and the KDC responses can return a valid tgt, allowing authentication to occur for any user on the system.

EPSS

Процентиль: 62%
0.00433
Низкий

9.8 Critical

CVSS3

10 Critical

CVSS2