Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 525
Alerts This Week
Warning Icon 1 525

Ubuntu: 2810-1 Critical Issues Found with Kerberos DoS Threats

ubuntu
Calendar Grey November 12, 2015
Scroller Ubuntu
Recent enhancements addressing weaknesses in Kerberos have been implemented across Ubuntu distributions to bolster security and ensure greater stability.
Several security issues were fixed in Kerberos.

Summary

Several security issues were fixed in Kerberos.

Software Description:

- krb5: MIT Kerberos Network Authentication Protocol

Details:

It was discovered that the Kerberos kpasswd service incorrectly handled

certain UDP packets. A remote attacker could possibly use this issue to

cause resource consumption, resulting in a denial of service. This issue

only affected Ubuntu 12.04 LTS. (CVE-2002-2443)

It was discovered that Kerberos incorrectly handled null bytes in certain

data fields. A remote attacker could possibly use this issue to cause a

denial of service. This issue only affected Ubuntu 12.04 LTS and Ubuntu

14.04 LTS. (CVE-2014-5355)

It was discovered that the Kerberos kdcpreauth modules incorrectly tracked

certain client requests. A remote attacker could possibly use this issue

to bypass intended preauthentication requirements. This issue only affected

Ubuntu 14.04 LTS and Ubuntu 15.04. (CVE-2015-2694)

It was discovered that Kerberos incorrectly handle...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory doS ubuntu krb5 network authentication

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 15.10:
  krb5-admin-server               1.13.2+dfsg-2ubuntu0.1
  krb5-k5tls                      1.13.2+dfsg-2ubuntu0.1
  krb5-kdc                        1.13.2+dfsg-2ubuntu0.1
  krb5-kdc-ldap                   1.13.2+dfsg-2ubuntu0.1
  krb5-otp                        1.13.2+dfsg-2ubuntu0.1
  krb5-pkinit                     1.13.2+dfsg-2ubuntu0.1
  krb5-user                       1.13.2+dfsg-2ubuntu0.1
  libgssapi-krb5-2                1.13.2+dfsg-2ubuntu0.1
  libgssrpc4                      1.13.2+dfsg-2ubuntu0.1
  libk5crypto3                    1.13.2+dfsg-2ubuntu0.1
  libkadm5clnt-mit9               1.13.2+dfsg-2ubuntu0.1
  libkdb5-8                       1.13.2+dfsg-2ubuntu0.1
  libkrad0                        1.13.2+dfsg-2ubuntu0.1
  libkrb5-3                       1.13.2+dfsg-2ubuntu0.1
  libkrb5support0                 1.13.2+dfsg-2ubuntu0.1

Ubuntu 15.04:
  krb5-admin-server               1.12.1+dfsg-18ubuntu0.1
  krb5-kdc                        1.12.1+dfsg-18ubuntu0.1
  krb5-kdc-ldap                   1.12.1+dfsg-18ubuntu0.1
  krb5-otp                        1.12.1+dfsg-18ubuntu0.1
  krb5-pkinit                     1.12.1+dfsg-18ubuntu0.1
  krb5-user                       1.12.1+dfsg-18ubuntu0.1
  libgssapi-krb5-2                1.12.1+dfsg-18ubuntu0.1
  libgssrpc4                      1.12.1+dfsg-18ubuntu0.1
  libk5crypto3                    1.12.1+dfsg-18ubuntu0.1
  libkadm5clnt-mit9               1.12.1+dfsg-18ubuntu0.1
  libkdb5-7                       1.12.1+dfsg-18ubuntu0.1
  libkrad0                        1.12.1+dfsg-18ubuntu0.1
  libkrb5-3                       1.12.1+dfsg-18ubuntu0.1
  libkrb5support0                 1.12.1+dfsg-18ubuntu0.1

Ubuntu 14.04 LTS:
  krb5-admin-server               1.12+dfsg-2ubuntu5.2
  krb5-kdc                        1.12+dfsg-2ubuntu5.2
  krb5-kdc-ldap                   1.12+dfsg-2ubuntu5.2
  krb5-otp                        1.12+dfsg-2ubuntu5.2
  krb5-pkinit                     1.12+dfsg-2ubuntu5.2
  krb5-user                       1.12+dfsg-2ubuntu5.2
  libgssapi-krb5-2                1.12+dfsg-2ubuntu5.2
  libgssrpc4                      1.12+dfsg-2ubuntu5.2
  libk5crypto3                    1.12+dfsg-2ubuntu5.2
  libkadm5clnt-mit9               1.12+dfsg-2ubuntu5.2
  libkdb5-7                       1.12+dfsg-2ubuntu5.2
  libkrad0                        1.12+dfsg-2ubuntu5.2
  libkrb5-3                       1.12+dfsg-2ubuntu5.2
  libkrb5support0                 1.12+dfsg-2ubuntu5.2

Ubuntu 12.04 LTS:
  krb5-admin-server               1.10+dfsg~beta1-2ubuntu0.7
  krb5-kdc                        1.10+dfsg~beta1-2ubuntu0.7
  krb5-kdc-ldap                   1.10+dfsg~beta1-2ubuntu0.7
  krb5-pkinit                     1.10+dfsg~beta1-2ubuntu0.7
  krb5-user                       1.10+dfsg~beta1-2ubuntu0.7
  libgssapi-krb5-2                1.10+dfsg~beta1-2ubuntu0.7
  libgssrpc4                      1.10+dfsg~beta1-2ubuntu0.7
  libk5crypto3                    1.10+dfsg~beta1-2ubuntu0.7
  libkadm5clnt-mit8               1.10+dfsg~beta1-2ubuntu0.7
  libkdb5-6                       1.10+dfsg~beta1-2ubuntu0.7
  libkrb5-3                       1.10+dfsg~beta1-2ubuntu0.7
  libkrb53                        1.10+dfsg~beta1-2ubuntu0.7
  libkrb5support0                 1.10+dfsg~beta1-2ubuntu0.7

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-2810-1

CVE-2002-2443, CVE-2014-5355, CVE-2015-2694, CVE-2015-2695,

CVE-2015-2696, CVE-2015-2697, CVE-2015-2698

Severity
critical
Lowest
Low
Medium
High
Critical

November 12, 2015

Topics%20covered

Topics Covered

security advisory doS ubuntu krb5 network authentication

Package Information

https://launchpad.net/ubuntu/+source/krb5/1.13.2+dfsg-2ubuntu0.1
https://launchpad.net/ubuntu/+source/krb5/1.12.1+dfsg-18ubuntu0.1
https://launchpad.net/ubuntu/+source/krb5/1.12+dfsg-2ubuntu5.2
https://launchpad.net/ubuntu/+source/krb5/1.10+dfsg~beta1-2ubuntu0.7

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.