Critical Buffer Overflow Vulnerability in krb5 Package
Summary
ALPINE-CVE-2017-15088: plugins/preauth/pkinit/pkinit_crypto_openssl.c in MIT Kerberos 5 (aka krb5) through 1.15.2 mishandles Distinguished Name (DN) fields, which allows remote attackers to execute arbitrary code or cause a denial of service (... Affects krb5 versions < 1.15.3-r0. Fixed in 1.15.3-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The krb5 package, also known as MIT Kerberos, is a widely used implementation of the Kerberos network authentication protocol. It provides secure authentication for users and services in a networked environment. The package is essential for ensuring secure communications and is commonly utilized in various operating systems and applications. However, it has been identified to have a critical vulnerability that can lead to severe security issues if not addressed promptly.
Vulnerability Detail
The vulnerability, identified as CVE-2017-15088, originates from the mishandling of Distinguished Name (DN) fields in the pkinit_crypto_openssl.c file of the krb5 package, specifically in versions up to 1.15.2. This flaw allows remote attackers to execute arbitrary code or cause a denial of service through buffer overflow and application crashes when untrusted X.509 data is processed. The vulnerability is particularly relevant in scenarios where the get_matching_data function is utilized, such as in KDC certauth plugin code specific to Red Hat distributions.
How To Fix
Minimum fixed version
1.15.3-r0
This is the first release that contains the fix.
sudo apk add --upgrade krb5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to avoid using untrusted X.509 data in applications that utilize the krb5 package until the package is updated to a secure version. Additionally, consider implementing strict validation of DN fields to mitigate the risk of exploitation.
Conclusion
The CVE-2017-15088 vulnerability in the krb5 package poses a significant risk to systems relying on this authentication protocol. It is crucial to update to the patched version 1.15.3-r0 or later to mitigate the risks associated with this vulnerability. Users should also consider using Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for krb5 →
FAQ
CVE-2017-15088 is a critical vulnerability in the krb5 package that allows remote attackers to execute arbitrary code or cause a denial of service due to improper handling of DN fields.
All versions of krb5 up to and including 1.15.2 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score for CVE-2017-15088 is 9.8, indicating a critical level of severity.
If immediate updates are not possible, ensure to avoid using untrusted X.509 data and implement strict validation of DN fields as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for krb5.
