CVE-2015-3206: python-kerberos vulnerable to KDC spoofing attacks
Summary
CVE-2015-3206: python-kerberos vulnerable to KDC spoofing attacks. Affects kerberos versions < 1.2.5. No fix is published. How to fix ↓
Also tracked for
- pykerberos · PyPI
- pykerberos · Debian:11
The same CVE-2015-3206 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-kerberos is a Python package that provides a high-level interface to the Kerberos authentication system. It allows Python applications to authenticate users using Kerberos tickets. Kerberos is a network authentication protocol that uses a trusted third-party authentication server called the Key Distribution Center (KDC). The python-kerberos package enables Python applications to communicate with the KDC to authenticate users. However, the package does not authenticate the KDC it attempts to communicate with, making it vulnerable to KDC spoofing attacks.
Vulnerability Detail
The vulnerability in python-kerberos, identified as CVE-2015-3206, allows remote attackers to perform a man-in-the-middle attack. The checkPassword function in python-kerberos does not verify the authenticity of the KDC it communicates with. This allows an attacker to impersonate the KDC and send a malicious response to the client. The impact of this vulnerability can range from a denial of service (bad response) to other unspecified impacts, depending on the attacker's intentions.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the python-kerberos package to the fixed version.
Conclusion
The python-kerberos package is vulnerable to KDC spoofing attacks, allowing remote attackers to perform man-in-the-middle attacks. To mitigate this vulnerability, it is crucial to update the python-kerberos package to version 1.2.6 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for kerberos →
FAQ
python-kerberos is a Python package that provides a high-level interface to the Kerberos authentication system.
KDC stands for Key Distribution Center. It is a trusted third-party authentication server in the Kerberos authentication system.
A man-in-the-middle attack is a type of cyber attack where an attacker intercepts and alters communication between two parties without their knowledge.
The possible impacts of this vulnerability include a denial of service (bad response) or other unspecified impacts, depending on the attacker's intentions.
To fix this vulnerability, update the python-kerberos package to version 1.2.6 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for kerberos.
