CVE-2023-3326: Network authentication attack via pam_krb5
pamkrb5 authenticates a user by essentially running kinit with the password, getting a ticket-granting ticket (tgt) from the Kerberos KDC (Key Distribution Center) over the network, as a way to verify the password. However, if a keytab is not provisioned on the system, pamkrb5 has no way to validate the response from the KDC, and essentially trusts the tgt provided over the network as being valid. In a non-default FreeBSD installation that leverages pamkrb5 for authentication and does not have a keytab provisioned, an attacker that is able to control both the password and the KDC responses can return a valid tgt, allowing authentication to occur for any user on the system.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Ensure pam_krb5 has a keytab provisioned on the system so it can validate responses from the Kerberos KDC, rather than trusting a TGT provided over the network.
- Compensating control
Use compensating network protections to prevent an attacker from controlling both the password and the KDC responses (e.g., restrict and isolate Kerberos/KDC communications so only trusted KDCs are reachable and tampering is not possible).
Event History
Frequently Asked Questions
What is CVE-2023-3326?
CVE-2023-3326 is a vulnerability in the pam_krb5 authentication module that allows unauthenticated users to gain unauthorized access to a system.
How does the pam_krb5 vulnerability work?
The pam_krb5 vulnerability allows an attacker to authenticate as any user without providing a valid password by exploiting a flaw in the Kerberos authentication process.
Which software versions are affected by CVE-2023-3326?
CVE-2023-3326 affects FreeBSD versions 12.4 up to but not including 13.2.
What is the severity of CVE-2023-3326?
CVE-2023-3326 has a severity rating of 9.8 out of 10, indicating a critical vulnerability.
How can I fix the pam_krb5 vulnerability?
To fix the pam_krb5 vulnerability, it is recommended to update to a patched version of FreeBSD.