REDHAT-BUG-461960: Medium severity Sun Microsystems pam_krb5 vulnerability

This bug was reported to us by Stéphane BERTIN.

The pamkrb5 module does not verify that the user has permission to read from the credential cache via the existingticket option.

From the mail Stéphane sent:

I failed to open SSH session with existingticket option.

I used these options to configure pamkrb5 : auth sufficient pamkrb5.so tryfirstpass minimumuid=1 useshmem=sshd existingticket validate=sshd debug

...

Extract from manual page : "existingticket tells pamkrb5.so to accept the presence of pre-existing Kerberos credentials provided by the calling application in the default credential cache as sufficient to authenticate the user, and to skip any account management checks. DANGER! Unless validation is also in use, it is relatively easy to produce a credential cache which looks "good enough" to fool pamkrb5.so."

I use validate=sshd like it is recommended but it seems danger is around ...

I notice two things : 1) the module try twice to get credential see logs "trying existing credentials" but don't try with user password and the session failed to be opened. (that's why I have written the bug report)

2) User try to open SSH session so he doesn't already have credentials and his variable KRB5CCNAME is not defined. By default module try to get credentials on file /tmp/krb5cc0. The root credential file !!! I don't know why but root credential file doesn't have the same format krb5cc0XXXXX.

So if root ask a ticket for user TEST and get credential what happens ... If you know which credential is used by root you can open a session without to know password !!!!

Acknowledgements:

Red Hat would like to thank Stéphane Bertin for responsibly disclosing this issue.