CVE-2019-3467: High severity Debian debian-lan-config vulnerability
Debian-edu-config all versions < 2.11.10, a set of configuration files used for Debian Edu, and debian-lan-config < 0.26, configured too permissive ACLs for the Kerberos admin server, which allowed password changes for other Kerberos user principals.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/debian-edu-configto a version that resolves this vulnerability.Fixed in 2.11.56+deb11u4Fixed in 2.11.56+deb11u3Fixed in 2.12.46~deb12u1Fixed in 2.12.903~deb13u1Fixed in 2.12.904 - Upgrade
Upgrade
debian/debian-lan-configto a version that resolves this vulnerability.Fixed in 0.28 - Upgrade
Upgrade
ubuntu/debian-lan-configto a version that resolves this vulnerability.Fixed in 0.21ubuntu0.16.04.1~esm1 - Upgrade
Upgrade
ubuntu/debian-lan-configto a version that resolves this vulnerability.Fixed in 0.23+deb9u1build0.18.04.1 - Upgrade
Upgrade
ubuntu/debian-lan-configto a version that resolves this vulnerability.Fixed in 0.26 - Upgrade
Upgrade
Debian-edu-configto a version that resolves this vulnerability.Fixed in 2.11.10 - Upgrade
Upgrade
debian-lan-configto a version that resolves this vulnerability.Fixed in 0.26
Event History
Frequently Asked Questions
What is the severity of CVE-2019-3467?
CVE-2019-3467 has critical severity due to the potential for unauthorized password changes in Kerberos user principals.
How do I fix CVE-2019-3467?
To mitigate CVE-2019-3467, update debian-edu-config to version 2.11.56+deb11u4 or higher and debian-lan-config to version 0.28.
Which versions of debian-edu-config are affected by CVE-2019-3467?
All versions of debian-edu-config prior to 2.11.10 are affected by CVE-2019-3467.
Which versions of debian-lan-config are vulnerable to CVE-2019-3467?
Any version of debian-lan-config before 0.26 is vulnerable to CVE-2019-3467.
What changes were made to resolve CVE-2019-3467?
The resolution for CVE-2019-3467 involved tightening the Access Control Lists (ACLs) for the Kerberos admin server to prevent unauthorized password changes.