CVE-2023-3326

Summary

pam_krb5 authenticates a user by essentially running kinit with the password, getting a ticket-granting ticket (tgt) from the Kerberos KDC (Key Distribution Center) over the network, as a way to verify the password. However, if a keytab is not provisioned on the system, pam_krb5 has no way to validate the response from the KDC, and essentially trusts the tgt provided over the network as being valid. In a non-default FreeBSD installation that leverages pam_krb5 for authentication and does not have a keytab provisioned, an attacker that is able to control both the password and the KDC responses can return a valid tgt, allowing authentication to occur for any user on the system.

Affected Software

VendorProductVersion RangeStatus
FreeBSDFreeBSD13.2-RELEASE < 13.2-RELEASE-p1affected
FreeBSDFreeBSD13.1-RELEASE < 13.1-RELEASE-p8affected
FreeBSDFreeBSD12.4-RELEASE < 12.4-RELEASE-p3affected

Weaknesses

  • CWE-303: CWE-303 Incorrect Implementation of Authentication Algorithm

Workarounds

If you are not using Kerberos at all, ensure /etc/krb5.conf is missing from your system. Additionally, ensure pam_krb5 is commented out of your PAM configuration located as documented in pam.conf(5), generally /etc/pam.d. Note, the default FreeBSD PAM configuration has pam_krb5 commented out.

If you are using Kerberos, but not using pam_krb5, ensure pam_krb5 is commented out of your PAM configuration located as documented in pam.conf(5), generally /etc/pam.d. Note, the default FreeBSD PAM configuration has pam_krb5 commented out.

If you are using pam_krb5, ensure you have a keytab on your system as provided by your Kerberos administrator.

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: total

References