Executive brief
MIT Kerberos 5, a widely used authentication protocol for securing network communications, contains a vulnerability in how it handles security tokens. An unauthenticated attacker can send specially crafted messages to trigger memory errors, potentially leading to the exposure of sensitive information or causing a system crash. This impact can extend to various enterprise systems and industrial hardware, such as Siemens SIMATIC controllers, that rely on this library for secure access.
Technical details
An out-of-bounds read vulnerability (CWE-125) exists in MIT Kerberos 5 (krb5) within the GSS-API message token handling logic. The flaw is triggered when the library processes message tokens with invalid length fields, specifically within functions like gss_krb5int_unseal_token_v3() and kg_unseal_iov_token(). A remote, unauthenticated attacker can exploit this by sending malformed tokens over the network. Successful exploitation can result in unauthorized access to sensitive memory contents or a denial-of-service (DoS) condition via a crash. The vulnerability was introduced in version 1.3 and is fixed in version 1.21.3.
Affected products
- MIT Kerberos 5 (krb5) 1.3 to 1.21.2
- Siemens S7-1500 CPU 1518-4 PN/DP MFP >= V3.1.5
Timeline
- 2024-06-28: disclosed
- 2024-06-28: advisory
- 2024-06-28: patched: Fixed in krb5 version 1.21.3