Executive brief
MIT Kerberos 5 is a widely used authentication protocol that allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. A vulnerability in how it handles secure message tokens could allow an attacker to modify network traffic, causing applications to receive incomplete or truncated data. This could lead to information disclosure or disrupt the normal operation of services relying on Kerberos for secure communication.
Technical details
A vulnerability exists in MIT Kerberos 5 (krb5) before version 1.21.3 within the GSS-API implementation. The root cause is the insufficient verification of the plaintext 'Extra Count' field in confidential GSS krb5 wrap tokens (CFX wrap tokens). An unauthenticated remote attacker can modify this field, which is not properly validated against the encrypted header during the unwrapping process in functions such as gss_krb5int_unseal_token_v3(). This manipulation causes the unwrapped token to appear truncated to the receiving application. While the primary impact is categorized as confidentiality loss in some assessments, it effectively allows for data integrity manipulation that results in truncated application data. The issue is fixed in MIT krb5 version 1.21.3.
Affected products
- MIT Kerberos 5 (krb5) up to (excluding) 1.21.3
- Siemens SIMATIC S7-1500 CPU 1518 PN/DP MFP >= V3.1.5
Timeline
- 2024-06-28: disclosed
- 2024-06-28: advisory
- 2024-06-28: patched: Fixed in MIT krb5 1.21.3