CVE-2023-3326 (GCVE-0-2023-3326)

Vulnerability from cvelistv5 – Published: 2023-06-22 16:37 – Updated: 2024-12-05 17:45
VLAI
Title
Network authentication attack via pam_krb5
Summary
pam_krb5 authenticates a user by essentially running kinit with the password, getting a ticket-granting ticket (tgt) from the Kerberos KDC (Key Distribution Center) over the network, as a way to verify the password. However, if a keytab is not provisioned on the system, pam_krb5 has no way to validate the response from the KDC, and essentially trusts the tgt provided over the network as being valid. In a non-default FreeBSD installation that leverages pam_krb5 for authentication and does not have a keytab provisioned, an attacker that is able to control both the password and the KDC responses can return a valid tgt, allowing authentication to occur for any user on the system.
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: yes Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-12-05 17:45 UTC
CWE
  • CWE-303 - Incorrect Implementation of Authentication Algorithm
Assigner
References
Impacted products
Vendor Product Version
FreeBSD FreeBSD Affected: 13.2-RELEASE , < 13.2-RELEASE-p1 (release)
Affected: 13.1-RELEASE , < 13.1-RELEASE-p8 (release)
Affected: 12.4-RELEASE , < 12.4-RELEASE-p3 (release)
Create a notification for this product.
Date Public
2023-06-21 06:00
Credits
Taylor R Campbell <riastradh@NetBSD.org>
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T06:55:03.226Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-23:04.pam_krb5.asc"
          },
          {
            "tags": [
              "third-party-advisory",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230714-0005/"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-23:09.pam_krb5.asc"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-3326",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-05T17:45:11.407919Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-05T17:45:19.729Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "pam_krb5"
          ],
          "product": "FreeBSD",
          "vendor": "FreeBSD",
          "versions": [
            {
              "lessThan": "13.2-RELEASE-p1",
              "status": "affected",
              "version": "13.2-RELEASE",
              "versionType": "release"
            },
            {
              "lessThan": "13.1-RELEASE-p8",
              "status": "affected",
              "version": "13.1-RELEASE",
              "versionType": "release"
            },
            {
              "lessThan": "12.4-RELEASE-p3",
              "status": "affected",
              "version": "12.4-RELEASE",
              "versionType": "release"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eExposure only occurs if pam_krb5 is enabled in the PAM configuration, an /etc/krb5.conf is installed, and the system does not have a system keytab.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eFor FreeBSD, the default installation has pam_krb5 commented out and does not have an /etc/krb5.conf.\u003c/div\u003e"
            }
          ],
          "value": "Exposure only occurs if pam_krb5 is enabled in the PAM configuration, an /etc/krb5.conf is installed, and the system does not have a system keytab.\n\n\n\n\nFor FreeBSD, the default installation has pam_krb5 commented out and does not have an /etc/krb5.conf.\n\n"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Taylor R Campbell \u003criastradh@NetBSD.org\u003e"
        }
      ],
      "datePublic": "2023-06-21T06:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "pam_krb5 authenticates a user by essentially running kinit with the password, getting a ticket-granting ticket (tgt) from the Kerberos KDC (Key Distribution Center) over the network, as a way to verify the password. However, if a keytab is not provisioned on the system, pam_krb5 has no way to validate the response from the KDC, and essentially trusts the tgt provided over the network as being valid. In a non-default FreeBSD installation that leverages pam_krb5 for authentication and does not have a keytab provisioned, an attacker that is able to control both the password and the KDC responses can return a valid tgt, allowing authentication to occur for any user on the system.\u003cbr\u003e"
            }
          ],
          "value": "pam_krb5 authenticates a user by essentially running kinit with the password, getting a ticket-granting ticket (tgt) from the Kerberos KDC (Key Distribution Center) over the network, as a way to verify the password. However, if a keytab is not provisioned on the system, pam_krb5 has no way to validate the response from the KDC, and essentially trusts the tgt provided over the network as being valid. In a non-default FreeBSD installation that leverages pam_krb5 for authentication and does not have a keytab provisioned, an attacker that is able to control both the password and the KDC responses can return a valid tgt, allowing authentication to occur for any user on the system.\n"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-114",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-114 Authentication Abuse"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-303",
              "description": "CWE-303  Incorrect Implementation of Authentication Algorithm",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-08-01T22:40:58.267Z",
        "orgId": "63664ac6-956c-4cba-a5d0-f46076e16109",
        "shortName": "freebsd"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-23:04.pam_krb5.asc"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20230714-0005/"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-23:09.pam_krb5.asc"
        }
      ],
      "source": {
        "advisory": "FreeBSD-SA-23:04.pam_krb5",
        "discovery": "UNKNOWN"
      },
      "title": "Network authentication attack via pam_krb5",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "If you are not using Kerberos at all, ensure /etc/krb5.conf is missing from your system. Additionally, ensure pam_krb5 is commented out of your PAM configuration located as documented in pam.conf(5), generally /etc/pam.d. Note, the default FreeBSD PAM configuration has pam_krb5 commented out.\u003cbr\u003e\u003cbr\u003eIf you are using Kerberos, but not using pam_krb5, ensure pam_krb5 is commented out of your PAM configuration located as documented in pam.conf(5), generally /etc/pam.d. Note, the default FreeBSD PAM configuration has pam_krb5 commented out.\u003cbr\u003e\u003cbr\u003eIf you are using pam_krb5, ensure you have a keytab on your system as provided by your Kerberos administrator.\u003cbr\u003e"
            }
          ],
          "value": "If you are not using Kerberos at all, ensure /etc/krb5.conf is missing from your system. Additionally, ensure pam_krb5 is commented out of your PAM configuration located as documented in pam.conf(5), generally /etc/pam.d. Note, the default FreeBSD PAM configuration has pam_krb5 commented out.\n\nIf you are using Kerberos, but not using pam_krb5, ensure pam_krb5 is commented out of your PAM configuration located as documented in pam.conf(5), generally /etc/pam.d. Note, the default FreeBSD PAM configuration has pam_krb5 commented out.\n\nIf you are using pam_krb5, ensure you have a keytab on your system as provided by your Kerberos administrator.\n"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "63664ac6-956c-4cba-a5d0-f46076e16109",
    "assignerShortName": "freebsd",
    "cveId": "CVE-2023-3326",
    "datePublished": "2023-06-22T16:37:51.360Z",
    "dateReserved": "2023-06-19T16:14:36.133Z",
    "dateUpdated": "2024-12-05T17:45:19.729Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-3326",
      "date": "2026-10-07",
      "epss": "0.01098",
      "percentile": "0.64587"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "modules": [
                  "pam_krb5"
                ],
                "product": "FreeBSD",
                "vendor": "FreeBSD",
                "versions": [
                  {
                    "lessThan": "13.2-RELEASE-p1",
                    "status": "affected",
                    "version": "13.2-RELEASE",
                    "versionType": "release"
                  },
                  {
                    "lessThan": "13.1-RELEASE-p8",
                    "status": "affected",
                    "version": "13.1-RELEASE",
                    "versionType": "release"
                  },
                  {
                    "lessThan": "12.4-RELEASE-p3",
                    "status": "affected",
                    "version": "12.4-RELEASE",
                    "versionType": "release"
                  }
                ]
              }
            ],
            "source": "secteam@freebsd.org"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A7F6C8B0-9D75-476C-ADBA-754416FBC186",
                    "versionEndExcluding": "12.4",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D79AAEBE-0D5A-4C9C-95FD-6287A53EE1C0",
                    "versionEndExcluding": "13.1",
                    "versionStartIncluding": "13.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:freebsd:freebsd:12.4:-:*:*:*:*:*:*",
                    "matchCriteriaId": "24920B4D-96C0-401F-B679-BEB086760EAF",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:freebsd:freebsd:12.4:p1:*:*:*:*:*:*",
                    "matchCriteriaId": "3CE32730-A9F5-4E8D-BDA4-6B8232F84787",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:freebsd:freebsd:12.4:p2:*:*:*:*:*:*",
                    "matchCriteriaId": "552E81DE-D409-475F-8ED0-E10A0BE43D29",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:freebsd:freebsd:12.4:rc2-p1:*:*:*:*:*:*",
                    "matchCriteriaId": "BA821886-B26B-47A6-ABC9-B8F70CE0ACFB",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:freebsd:freebsd:12.4:rc2-p2:*:*:*:*:*:*",
                    "matchCriteriaId": "220629AD-32CC-4303-86AE-1DD27F0E4C65",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:freebsd:freebsd:13.1:-:*:*:*:*:*:*",
                    "matchCriteriaId": "DEEE6D52-27E4-438D-AE8D-7141320B5973",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:freebsd:freebsd:13.1:b1-p1:*:*:*:*:*:*",
                    "matchCriteriaId": "66364EA4-83B1-4597-8C18-D5633B361A9C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:freebsd:freebsd:13.1:b2-p2:*:*:*:*:*:*",
                    "matchCriteriaId": "EF9292DD-EFB1-4B50-A941-7485D901489F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:freebsd:freebsd:13.1:p1:*:*:*:*:*:*",
                    "matchCriteriaId": "EFB18F55-4F5C-4166-9A7E-6F6617179A90",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:freebsd:freebsd:13.1:p2:*:*:*:*:*:*",
                    "matchCriteriaId": "66E1C269-841F-489A-9A0A-5D145B417E0A",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:freebsd:freebsd:13.1:p3:*:*:*:*:*:*",
                    "matchCriteriaId": "ECF1B567-F764-45F5-A793-BEA93720F952",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:freebsd:freebsd:13.1:p4:*:*:*:*:*:*",
                    "matchCriteriaId": "DAFE3F33-2C57-4B52-B658-82572607BD8C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:freebsd:freebsd:13.1:p5:*:*:*:*:*:*",
                    "matchCriteriaId": "C925DF75-2785-44BD-91CA-66D29C296689",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:freebsd:freebsd:13.1:p6:*:*:*:*:*:*",
                    "matchCriteriaId": "BCE2DAEC-81A5-49E9-B7E7-4F143FA6B3F7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:freebsd:freebsd:13.1:p7:*:*:*:*:*:*",
                    "matchCriteriaId": "7725D503-1437-4F90-B30C-007193D5F0E1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:freebsd:freebsd:13.1:rc1-p1:*:*:*:*:*:*",
                    "matchCriteriaId": "B536EE52-ED49-4A85-BC9D-A27828D5A961",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:freebsd:freebsd:13.2:-:*:*:*:*:*:*",
                    "matchCriteriaId": "A87EFA20-DD6B-41C5-98FD-A29F67D2E732",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "pam_krb5 authenticates a user by essentially running kinit with the password, getting a ticket-granting ticket (tgt) from the Kerberos KDC (Key Distribution Center) over the network, as a way to verify the password. However, if a keytab is not provisioned on the system, pam_krb5 has no way to validate the response from the KDC, and essentially trusts the tgt provided over the network as being valid. In a non-default FreeBSD installation that leverages pam_krb5 for authentication and does not have a keytab provisioned, an attacker that is able to control both the password and the KDC responses can return a valid tgt, allowing authentication to occur for any user on the system.\n"
          }
        ],
        "id": "CVE-2023-3326",
        "lastModified": "2026-06-17T06:13:49.523",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2023-3326",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-05T17:45:11.407919Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2023-06-22T17:15:44.833",
        "references": [
          {
            "source": "secteam@freebsd.org",
            "tags": [
              "Mitigation",
              "Vendor Advisory"
            ],
            "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-23:04.pam_krb5.asc"
          },
          {
            "source": "secteam@freebsd.org",
            "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-23:09.pam_krb5.asc"
          },
          {
            "source": "secteam@freebsd.org",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230714-0005/"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mitigation",
              "Vendor Advisory"
            ],
            "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-23:04.pam_krb5.asc"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-23:09.pam_krb5.asc"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230714-0005/"
          }
        ],
        "sourceIdentifier": "secteam@freebsd.org",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-303"
              }
            ],
            "source": "secteam@freebsd.org",
            "type": "Secondary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-287"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T06:55:03.226Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "vendor-advisory",
                  "x_transferred"
                ],
                "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-23:04.pam_krb5.asc"
              },
              {
                "tags": [
                  "third-party-advisory",
                  "x_transferred"
                ],
                "url": "https://security.netapp.com/advisory/ntap-20230714-0005/"
              },
              {
                "tags": [
                  "vendor-advisory",
                  "x_transferred"
                ],
                "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-23:09.pam_krb5.asc"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2023-3326",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-12-05T17:45:11.407919Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-12-05T17:45:16.098Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "modules": [
                "pam_krb5"
              ],
              "product": "FreeBSD",
              "vendor": "FreeBSD",
              "versions": [
                {
                  "lessThan": "13.2-RELEASE-p1",
                  "status": "affected",
                  "version": "13.2-RELEASE",
                  "versionType": "release"
                },
                {
                  "lessThan": "13.1-RELEASE-p8",
                  "status": "affected",
                  "version": "13.1-RELEASE",
                  "versionType": "release"
                },
                {
                  "lessThan": "12.4-RELEASE-p3",
                  "status": "affected",
                  "version": "12.4-RELEASE",
                  "versionType": "release"
                }
              ]
            }
          ],
          "configurations": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cdiv\u003eExposure only occurs if pam_krb5 is enabled in the PAM configuration, an /etc/krb5.conf is installed, and the system does not have a system keytab.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eFor FreeBSD, the default installation has pam_krb5 commented out and does not have an /etc/krb5.conf.\u003c/div\u003e"
                }
              ],
              "value": "Exposure only occurs if pam_krb5 is enabled in the PAM configuration, an /etc/krb5.conf is installed, and the system does not have a system keytab.\n\n\n\n\nFor FreeBSD, the default installation has pam_krb5 commented out and does not have an /etc/krb5.conf.\n\n"
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "user": "00000000-0000-4000-9000-000000000000",
              "value": "Taylor R Campbell \u003criastradh@NetBSD.org\u003e"
            }
          ],
          "datePublic": "2023-06-21T06:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "pam_krb5 authenticates a user by essentially running kinit with the password, getting a ticket-granting ticket (tgt) from the Kerberos KDC (Key Distribution Center) over the network, as a way to verify the password. However, if a keytab is not provisioned on the system, pam_krb5 has no way to validate the response from the KDC, and essentially trusts the tgt provided over the network as being valid. In a non-default FreeBSD installation that leverages pam_krb5 for authentication and does not have a keytab provisioned, an attacker that is able to control both the password and the KDC responses can return a valid tgt, allowing authentication to occur for any user on the system.\u003cbr\u003e"
                }
              ],
              "value": "pam_krb5 authenticates a user by essentially running kinit with the password, getting a ticket-granting ticket (tgt) from the Kerberos KDC (Key Distribution Center) over the network, as a way to verify the password. However, if a keytab is not provisioned on the system, pam_krb5 has no way to validate the response from the KDC, and essentially trusts the tgt provided over the network as being valid. In a non-default FreeBSD installation that leverages pam_krb5 for authentication and does not have a keytab provisioned, an attacker that is able to control both the password and the KDC responses can return a valid tgt, allowing authentication to occur for any user on the system.\n"
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-114",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-114 Authentication Abuse"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-303",
                  "description": "CWE-303  Incorrect Implementation of Authentication Algorithm",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2023-08-01T22:40:58.267Z",
            "orgId": "63664ac6-956c-4cba-a5d0-f46076e16109",
            "shortName": "freebsd"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-23:04.pam_krb5.asc"
            },
            {
              "tags": [
                "third-party-advisory"
              ],
              "url": "https://security.netapp.com/advisory/ntap-20230714-0005/"
            },
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-23:09.pam_krb5.asc"
            }
          ],
          "source": {
            "advisory": "FreeBSD-SA-23:04.pam_krb5",
            "discovery": "UNKNOWN"
          },
          "title": "Network authentication attack via pam_krb5",
          "workarounds": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "If you are not using Kerberos at all, ensure /etc/krb5.conf is missing from your system. Additionally, ensure pam_krb5 is commented out of your PAM configuration located as documented in pam.conf(5), generally /etc/pam.d. Note, the default FreeBSD PAM configuration has pam_krb5 commented out.\u003cbr\u003e\u003cbr\u003eIf you are using Kerberos, but not using pam_krb5, ensure pam_krb5 is commented out of your PAM configuration located as documented in pam.conf(5), generally /etc/pam.d. Note, the default FreeBSD PAM configuration has pam_krb5 commented out.\u003cbr\u003e\u003cbr\u003eIf you are using pam_krb5, ensure you have a keytab on your system as provided by your Kerberos administrator.\u003cbr\u003e"
                }
              ],
              "value": "If you are not using Kerberos at all, ensure /etc/krb5.conf is missing from your system. Additionally, ensure pam_krb5 is commented out of your PAM configuration located as documented in pam.conf(5), generally /etc/pam.d. Note, the default FreeBSD PAM configuration has pam_krb5 commented out.\n\nIf you are using Kerberos, but not using pam_krb5, ensure pam_krb5 is commented out of your PAM configuration located as documented in pam.conf(5), generally /etc/pam.d. Note, the default FreeBSD PAM configuration has pam_krb5 commented out.\n\nIf you are using pam_krb5, ensure you have a keytab on your system as provided by your Kerberos administrator.\n"
            }
          ],
          "x_generator": {
            "engine": "Vulnogram 0.1.0-dev"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "63664ac6-956c-4cba-a5d0-f46076e16109",
        "assignerShortName": "freebsd",
        "cveId": "CVE-2023-3326",
        "datePublished": "2023-06-22T16:37:51.360Z",
        "dateReserved": "2023-06-19T16:14:36.133Z",
        "dateUpdated": "2024-12-05T17:45:19.729Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.