Freely subscribe to our NEWSLETTER

This bulletin was written by Vigil@nce : http://vigilance.fr/offer

SYNTHESIS OF THE VULNERABILITY

An attacker can use a brute force on MIT krb5, in order to guess
the user’s password.

Impacted products: Fedora, MIT krb5

Severity: 2/4

Creation date: 12/05/2015

DESCRIPTION OF THE VULNERABILITY

The MIT krb5 product uses the requires_preauth option to force a
pre-authentication before accessing to kinit.

Two kdcpreauth modules can be enabled: OTP and PKINIT.

However the OTP module sets too soon the TKT_FLG_PRE_AUTH bit, and
the PKINIT module answers OK when inputs are empty (or if the
realm is not configured). The KDC then thinks that the query is
pre-authenticated, which bypasses the requires_preauth option. The
attacker can thus obtain a ciphertext encrypted by the principal
key.

An attacker can therefore use a brute force on MIT krb5, in order
to guess the user’s password.

ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN

http://vigilance.fr/vulnerability/MIT-krb5-bypassing-of-requires-preauth-16872