USN-9068-1: Debian-LAN vulnerability

Q: What level of access does an attacker need to exploit this issue?

The attacker must already be authenticated. The issue could allow that user to change other users' credentials through the Kerberos administration server.

Q: What is the likely impact if exploitation succeeds?

An attacker may be able to modify another user's credentials, which can lead to privilege escalation.

Q: Which component should be investigated for exposure?

Investigate systems using the ubuntu/debian-lan-config package, particularly deployments where it configures a Kerberos administration server.

Published Nov 12, 2026

Updated

Wolfgang Schweer discovered that Debian-LAN configured overly permissive ACLs for the Kerberos admin server. An authenticated user could possibly use this issue to change the credentials of other users, leading to privilege escalation.

Affected Software

2 affected componentsFixes available

All of the following

ubuntu/debian-lan-config<0.21ubuntu0.16.04.1~esm1

0.21ubuntu0.16.04.1~esm1

Ubuntu Ubuntu=16.04

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/debian-lan-config to a version that resolves this vulnerability.
Fixed in 0.21ubuntu0.16.04.1~esm1

Event History

Nov 12, 2026

Advisory Published

via Ubuntu·12:00 AM

Data Sourced

via Ubuntu·12:00 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2019-3467

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The attacker must already be authenticated. The issue could allow that user to change other users' credentials through the Kerberos administration server.

What is the likely impact if exploitation succeeds?