Critical Man-in-the-Middle Vulnerability in Heimdal Package
Summary
ALPINE-CVE-2019-12098: In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. Affects heimdal versions < 7.5.0-r5. Fixed in 7.5.0-r5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Heimdal is an open-source implementation of Kerberos 5, providing secure authentication for users and services in a network. It is widely used in various systems for its ability to facilitate secure communication and manage credentials. However, prior to version 7.6.0, Heimdal was susceptible to a critical vulnerability that compromised its security features, particularly in the anonymous PKINIT PA-PKINIT-KX key exchange process.
Vulnerability Detail
In Heimdal versions before 7.6.0, a failure to verify the anonymous PKINIT PA-PKINIT-KX key exchange allows an attacker to perform a man-in-the-middle attack. This vulnerability arises from the function krb5_init_creds_step in lib/krb5/init_creds_pw.c, which does not adequately validate the key exchange, potentially leading to unauthorized access and data interception. The ramifications of this vulnerability are severe, as it could allow attackers to impersonate legitimate users and compromise sensitive information.
How To Fix
Minimum fixed version
7.5.0-r5
This is the first release that contains the fix.
sudo apk add --upgrade heimdalTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the exposure of the Heimdal service to trusted networks only, thereby reducing the risk of man-in-the-middle attacks until the package can be updated.
Conclusion
The Heimdal package has a critical vulnerability that allows for man-in-the-middle attacks due to improper verification of key exchanges. It is crucial for users to update to the latest patched versions to ensure the security of their systems. Temporary workarounds can mitigate risks until updates are applied.
See every vulnerability recorded for heimdal →
FAQ
The CVSS score of this vulnerability is 7.4, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Heimdal versions prior to 7.6.0 are affected, specifically versions up to 7.5.0-r5 for Alpine v3.10, 7.4.0-r4 for Alpine v3.7, 7.5.0-r3 for Alpine v3.8, and 7.5.0-r4 for Alpine v3.9.
If an immediate update is not possible, consider restricting access to the Heimdal service to trusted networks as a temporary measure.
You can find more information about Heimdal and its vulnerabilities on its official website and security advisories related to the package.
References
Related vulnerabilities
Recent vulnerabilities recorded for heimdal.
