CVE-2017-15088: Buffer Overflow
A buffer overflow vulnerability was found in getmatchingdata() function when both the CA cert and the user cert have a long subject affecting krb5 that includes certauth plugin. Attack requires a validated certificate with a long subject and issuer, and a "pkinitcertmatch" string attribute on some principal in the database. A remote code execution exploit might also require that the attacker gets to choose the contents of the issuer in the validated cert.
Bug report:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=871698
Other sources
plugins/preauth/pkinit/pkinitcryptoopenssl.c in MIT Kerberos 5 (aka krb5) through 1.15.2 mishandles Distinguished Name (DN) fields, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) in situations involving untrusted X.509 data, related to the getmatchingdata and X509NAMEonelineex functions. NOTE: this has security relevance only in use cases outside of the MIT Kerberos distribution, e.g., the use of getmatchingdata in KDC certauth plugin code that is specific to Red Hat.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-15088?
CVE-2017-15088 is classified as a high severity vulnerability due to its potential for arbitrary code execution and denial of service.
How do I fix CVE-2017-15088?
To mitigate CVE-2017-15088, upgrade your MIT Kerberos 5 installation to version 1.16 or higher.
What type of attacks can exploit CVE-2017-15088?
CVE-2017-15088 can be exploited by remote attackers through mishandled Distinguished Name fields in untrusted X.509 certificates.
Which versions of MIT Kerberos 5 are affected by CVE-2017-15088?
CVE-2017-15088 affects all versions of MIT Kerberos 5 up to and including 1.15.2.
Can CVE-2017-15088 lead to application crashes?
Yes, CVE-2017-15088 can cause application crashes due to a buffer overflow condition.