pam_krb5 authenticates a user by essentially running kinit with the password, getting a ticket-granting ticket (tgt) from the Kerberos KDC (Key Distribution Center) over the network, as a way to verify the password. However, if a keytab is not provisioned on the system, pam_krb5 has no way to validate the response from the KDC, and essentially trusts the tgt provided over the network as being valid. In a non-default FreeBSD installation that leverages pam_krb5 for authentication and does not have a keytab provisioned, an attacker that is able to control both the password and the KDC responses can return a valid tgt, allowing authentication to occur for any user on the system.
{
"binaries": [
{
"binary_name": "libipa-hbac0",
"binary_version": "2.6.3-1ubuntu3.9"
},
{
"binary_name": "libnss-sss",
"binary_version": "2.6.3-1ubuntu3.9"
},
{
"binary_name": "libpam-sss",
"binary_version": "2.6.3-1ubuntu3.9"
},
{
"binary_name": "libsss-certmap0",
"binary_version": "2.6.3-1ubuntu3.9"
},
{
"binary_name": "libsss-idmap0",
"binary_version": "2.6.3-1ubuntu3.9"
},
{
"binary_name": "libsss-nss-idmap0",
"binary_version": "2.6.3-1ubuntu3.9"
},
{
"binary_name": "libsss-simpleifp0",
"binary_version": "2.6.3-1ubuntu3.9"
},
{
"binary_name": "libsss-sudo",
"binary_version": "2.6.3-1ubuntu3.9"
},
{
"binary_name": "python3-libipa-hbac",
"binary_version": "2.6.3-1ubuntu3.9"
},
{
"binary_name": "python3-libsss-nss-idmap",
"binary_version": "2.6.3-1ubuntu3.9"
},
{
"binary_name": "python3-sss",
"binary_version": "2.6.3-1ubuntu3.9"
},
{
"binary_name": "sssd",
"binary_version": "2.6.3-1ubuntu3.9"
},
{
"binary_name": "sssd-ad",
"binary_version": "2.6.3-1ubuntu3.9"
},
{
"binary_name": "sssd-ad-common",
"binary_version": "2.6.3-1ubuntu3.9"
},
{
"binary_name": "sssd-common",
"binary_version": "2.6.3-1ubuntu3.9"
},
{
"binary_name": "sssd-dbus",
"binary_version": "2.6.3-1ubuntu3.9"
},
{
"binary_name": "sssd-ipa",
"binary_version": "2.6.3-1ubuntu3.9"
},
{
"binary_name": "sssd-kcm",
"binary_version": "2.6.3-1ubuntu3.9"
},
{
"binary_name": "sssd-krb5",
"binary_version": "2.6.3-1ubuntu3.9"
},
{
"binary_name": "sssd-krb5-common",
"binary_version": "2.6.3-1ubuntu3.9"
},
{
"binary_name": "sssd-ldap",
"binary_version": "2.6.3-1ubuntu3.9"
},
{
"binary_name": "sssd-proxy",
"binary_version": "2.6.3-1ubuntu3.9"
},
{
"binary_name": "sssd-tools",
"binary_version": "2.6.3-1ubuntu3.9"
}
]
}{
"binaries": [
{
"binary_name": "libipa-hbac0t64",
"binary_version": "2.9.4-1.1ubuntu6.8"
},
{
"binary_name": "libnss-sss",
"binary_version": "2.9.4-1.1ubuntu6.8"
},
{
"binary_name": "libpam-sss",
"binary_version": "2.9.4-1.1ubuntu6.8"
},
{
"binary_name": "libsss-certmap0",
"binary_version": "2.9.4-1.1ubuntu6.8"
},
{
"binary_name": "libsss-idmap0",
"binary_version": "2.9.4-1.1ubuntu6.8"
},
{
"binary_name": "libsss-nss-idmap0",
"binary_version": "2.9.4-1.1ubuntu6.8"
},
{
"binary_name": "libsss-sudo",
"binary_version": "2.9.4-1.1ubuntu6.8"
},
{
"binary_name": "python3-libipa-hbac",
"binary_version": "2.9.4-1.1ubuntu6.8"
},
{
"binary_name": "python3-libsss-nss-idmap",
"binary_version": "2.9.4-1.1ubuntu6.8"
},
{
"binary_name": "python3-sss",
"binary_version": "2.9.4-1.1ubuntu6.8"
},
{
"binary_name": "sssd",
"binary_version": "2.9.4-1.1ubuntu6.8"
},
{
"binary_name": "sssd-ad",
"binary_version": "2.9.4-1.1ubuntu6.8"
},
{
"binary_name": "sssd-ad-common",
"binary_version": "2.9.4-1.1ubuntu6.8"
},
{
"binary_name": "sssd-common",
"binary_version": "2.9.4-1.1ubuntu6.8"
},
{
"binary_name": "sssd-dbus",
"binary_version": "2.9.4-1.1ubuntu6.8"
},
{
"binary_name": "sssd-idp",
"binary_version": "2.9.4-1.1ubuntu6.8"
},
{
"binary_name": "sssd-ipa",
"binary_version": "2.9.4-1.1ubuntu6.8"
},
{
"binary_name": "sssd-kcm",
"binary_version": "2.9.4-1.1ubuntu6.8"
},
{
"binary_name": "sssd-krb5",
"binary_version": "2.9.4-1.1ubuntu6.8"
},
{
"binary_name": "sssd-krb5-common",
"binary_version": "2.9.4-1.1ubuntu6.8"
},
{
"binary_name": "sssd-ldap",
"binary_version": "2.9.4-1.1ubuntu6.8"
},
{
"binary_name": "sssd-passkey",
"binary_version": "2.9.4-1.1ubuntu6.8"
},
{
"binary_name": "sssd-proxy",
"binary_version": "2.9.4-1.1ubuntu6.8"
},
{
"binary_name": "sssd-tools",
"binary_version": "2.9.4-1.1ubuntu6.8"
}
]
}{
"binaries": [
{
"binary_name": "libipa-hbac0t64",
"binary_version": "2.10.1-2ubuntu5.3"
},
{
"binary_name": "libnss-sss",
"binary_version": "2.10.1-2ubuntu5.3"
},
{
"binary_name": "libpam-sss",
"binary_version": "2.10.1-2ubuntu5.3"
},
{
"binary_name": "libsss-certmap0",
"binary_version": "2.10.1-2ubuntu5.3"
},
{
"binary_name": "libsss-idmap0",
"binary_version": "2.10.1-2ubuntu5.3"
},
{
"binary_name": "libsss-nss-idmap0",
"binary_version": "2.10.1-2ubuntu5.3"
},
{
"binary_name": "libsss-sudo",
"binary_version": "2.10.1-2ubuntu5.3"
},
{
"binary_name": "python3-libipa-hbac",
"binary_version": "2.10.1-2ubuntu5.3"
},
{
"binary_name": "python3-libsss-nss-idmap",
"binary_version": "2.10.1-2ubuntu5.3"
},
{
"binary_name": "python3-sss",
"binary_version": "2.10.1-2ubuntu5.3"
},
{
"binary_name": "sssd",
"binary_version": "2.10.1-2ubuntu5.3"
},
{
"binary_name": "sssd-ad",
"binary_version": "2.10.1-2ubuntu5.3"
},
{
"binary_name": "sssd-ad-common",
"binary_version": "2.10.1-2ubuntu5.3"
},
{
"binary_name": "sssd-common",
"binary_version": "2.10.1-2ubuntu5.3"
},
{
"binary_name": "sssd-dbus",
"binary_version": "2.10.1-2ubuntu5.3"
},
{
"binary_name": "sssd-idp",
"binary_version": "2.10.1-2ubuntu5.3"
},
{
"binary_name": "sssd-ipa",
"binary_version": "2.10.1-2ubuntu5.3"
},
{
"binary_name": "sssd-kcm",
"binary_version": "2.10.1-2ubuntu5.3"
},
{
"binary_name": "sssd-krb5",
"binary_version": "2.10.1-2ubuntu5.3"
},
{
"binary_name": "sssd-krb5-common",
"binary_version": "2.10.1-2ubuntu5.3"
},
{
"binary_name": "sssd-ldap",
"binary_version": "2.10.1-2ubuntu5.3"
},
{
"binary_name": "sssd-passkey",
"binary_version": "2.10.1-2ubuntu5.3"
},
{
"binary_name": "sssd-proxy",
"binary_version": "2.10.1-2ubuntu5.3"
},
{
"binary_name": "sssd-tools",
"binary_version": "2.10.1-2ubuntu5.3"
}
]
}{
"binaries": [
{
"binary_name": "libipa-hbac0t64",
"binary_version": "2.12.0-1ubuntu5.4"
},
{
"binary_name": "libnss-sss",
"binary_version": "2.12.0-1ubuntu5.4"
},
{
"binary_name": "libpam-sss",
"binary_version": "2.12.0-1ubuntu5.4"
},
{
"binary_name": "libsss-certmap0",
"binary_version": "2.12.0-1ubuntu5.4"
},
{
"binary_name": "libsss-idmap0",
"binary_version": "2.12.0-1ubuntu5.4"
},
{
"binary_name": "libsss-nss-idmap0",
"binary_version": "2.12.0-1ubuntu5.4"
},
{
"binary_name": "libsss-sudo",
"binary_version": "2.12.0-1ubuntu5.4"
},
{
"binary_name": "python3-libipa-hbac",
"binary_version": "2.12.0-1ubuntu5.4"
},
{
"binary_name": "python3-libsss-nss-idmap",
"binary_version": "2.12.0-1ubuntu5.4"
},
{
"binary_name": "python3-sss",
"binary_version": "2.12.0-1ubuntu5.4"
},
{
"binary_name": "sssd",
"binary_version": "2.12.0-1ubuntu5.4"
},
{
"binary_name": "sssd-ad",
"binary_version": "2.12.0-1ubuntu5.4"
},
{
"binary_name": "sssd-ad-common",
"binary_version": "2.12.0-1ubuntu5.4"
},
{
"binary_name": "sssd-common",
"binary_version": "2.12.0-1ubuntu5.4"
},
{
"binary_name": "sssd-dbus",
"binary_version": "2.12.0-1ubuntu5.4"
},
{
"binary_name": "sssd-idp",
"binary_version": "2.12.0-1ubuntu5.4"
},
{
"binary_name": "sssd-ipa",
"binary_version": "2.12.0-1ubuntu5.4"
},
{
"binary_name": "sssd-kcm",
"binary_version": "2.12.0-1ubuntu5.4"
},
{
"binary_name": "sssd-krb5",
"binary_version": "2.12.0-1ubuntu5.4"
},
{
"binary_name": "sssd-krb5-common",
"binary_version": "2.12.0-1ubuntu5.4"
},
{
"binary_name": "sssd-ldap",
"binary_version": "2.12.0-1ubuntu5.4"
},
{
"binary_name": "sssd-passkey",
"binary_version": "2.12.0-1ubuntu5.4"
},
{
"binary_name": "sssd-proxy",
"binary_version": "2.12.0-1ubuntu5.4"
},
{
"binary_name": "sssd-tools",
"binary_version": "2.12.0-1ubuntu5.4"
}
]
}{
"binaries": [
{
"binary_name": "libipa-hbac0",
"binary_version": "1.13.4-1ubuntu1.15+esm1"
},
{
"binary_name": "libnss-sss",
"binary_version": "1.13.4-1ubuntu1.15+esm1"
},
{
"binary_name": "libpam-sss",
"binary_version": "1.13.4-1ubuntu1.15+esm1"
},
{
"binary_name": "libsss-idmap0",
"binary_version": "1.13.4-1ubuntu1.15+esm1"
},
{
"binary_name": "libsss-nss-idmap0",
"binary_version": "1.13.4-1ubuntu1.15+esm1"
},
{
"binary_name": "libsss-simpleifp0",
"binary_version": "1.13.4-1ubuntu1.15+esm1"
},
{
"binary_name": "libsss-sudo",
"binary_version": "1.13.4-1ubuntu1.15+esm1"
},
{
"binary_name": "libwbclient-sssd",
"binary_version": "1.13.4-1ubuntu1.15+esm1"
},
{
"binary_name": "python-libipa-hbac",
"binary_version": "1.13.4-1ubuntu1.15+esm1"
},
{
"binary_name": "python-libsss-nss-idmap",
"binary_version": "1.13.4-1ubuntu1.15+esm1"
},
{
"binary_name": "python-sss",
"binary_version": "1.13.4-1ubuntu1.15+esm1"
},
{
"binary_name": "python3-libipa-hbac",
"binary_version": "1.13.4-1ubuntu1.15+esm1"
},
{
"binary_name": "python3-libsss-nss-idmap",
"binary_version": "1.13.4-1ubuntu1.15+esm1"
},
{
"binary_name": "python3-sss",
"binary_version": "1.13.4-1ubuntu1.15+esm1"
},
{
"binary_name": "sssd",
"binary_version": "1.13.4-1ubuntu1.15+esm1"
},
{
"binary_name": "sssd-ad",
"binary_version": "1.13.4-1ubuntu1.15+esm1"
},
{
"binary_name": "sssd-ad-common",
"binary_version": "1.13.4-1ubuntu1.15+esm1"
},
{
"binary_name": "sssd-common",
"binary_version": "1.13.4-1ubuntu1.15+esm1"
},
{
"binary_name": "sssd-dbus",
"binary_version": "1.13.4-1ubuntu1.15+esm1"
},
{
"binary_name": "sssd-ipa",
"binary_version": "1.13.4-1ubuntu1.15+esm1"
},
{
"binary_name": "sssd-krb5",
"binary_version": "1.13.4-1ubuntu1.15+esm1"
},
{
"binary_name": "sssd-krb5-common",
"binary_version": "1.13.4-1ubuntu1.15+esm1"
},
{
"binary_name": "sssd-ldap",
"binary_version": "1.13.4-1ubuntu1.15+esm1"
},
{
"binary_name": "sssd-proxy",
"binary_version": "1.13.4-1ubuntu1.15+esm1"
},
{
"binary_name": "sssd-tools",
"binary_version": "1.13.4-1ubuntu1.15+esm1"
}
]
}{
"binaries": [
{
"binary_name": "libipa-hbac0",
"binary_version": "1.16.1-1ubuntu1.8+esm1"
},
{
"binary_name": "libnss-sss",
"binary_version": "1.16.1-1ubuntu1.8+esm1"
},
{
"binary_name": "libpam-sss",
"binary_version": "1.16.1-1ubuntu1.8+esm1"
},
{
"binary_name": "libsss-certmap0",
"binary_version": "1.16.1-1ubuntu1.8+esm1"
},
{
"binary_name": "libsss-idmap0",
"binary_version": "1.16.1-1ubuntu1.8+esm1"
},
{
"binary_name": "libsss-nss-idmap0",
"binary_version": "1.16.1-1ubuntu1.8+esm1"
},
{
"binary_name": "libsss-simpleifp0",
"binary_version": "1.16.1-1ubuntu1.8+esm1"
},
{
"binary_name": "libsss-sudo",
"binary_version": "1.16.1-1ubuntu1.8+esm1"
},
{
"binary_name": "libwbclient-sssd",
"binary_version": "1.16.1-1ubuntu1.8+esm1"
},
{
"binary_name": "python-libipa-hbac",
"binary_version": "1.16.1-1ubuntu1.8+esm1"
},
{
"binary_name": "python-libsss-nss-idmap",
"binary_version": "1.16.1-1ubuntu1.8+esm1"
},
{
"binary_name": "python-sss",
"binary_version": "1.16.1-1ubuntu1.8+esm1"
},
{
"binary_name": "python3-libipa-hbac",
"binary_version": "1.16.1-1ubuntu1.8+esm1"
},
{
"binary_name": "python3-libsss-nss-idmap",
"binary_version": "1.16.1-1ubuntu1.8+esm1"
},
{
"binary_name": "python3-sss",
"binary_version": "1.16.1-1ubuntu1.8+esm1"
},
{
"binary_name": "sssd",
"binary_version": "1.16.1-1ubuntu1.8+esm1"
},
{
"binary_name": "sssd-ad",
"binary_version": "1.16.1-1ubuntu1.8+esm1"
},
{
"binary_name": "sssd-ad-common",
"binary_version": "1.16.1-1ubuntu1.8+esm1"
},
{
"binary_name": "sssd-common",
"binary_version": "1.16.1-1ubuntu1.8+esm1"
},
{
"binary_name": "sssd-dbus",
"binary_version": "1.16.1-1ubuntu1.8+esm1"
},
{
"binary_name": "sssd-ipa",
"binary_version": "1.16.1-1ubuntu1.8+esm1"
},
{
"binary_name": "sssd-kcm",
"binary_version": "1.16.1-1ubuntu1.8+esm1"
},
{
"binary_name": "sssd-krb5",
"binary_version": "1.16.1-1ubuntu1.8+esm1"
},
{
"binary_name": "sssd-krb5-common",
"binary_version": "1.16.1-1ubuntu1.8+esm1"
},
{
"binary_name": "sssd-ldap",
"binary_version": "1.16.1-1ubuntu1.8+esm1"
},
{
"binary_name": "sssd-proxy",
"binary_version": "1.16.1-1ubuntu1.8+esm1"
},
{
"binary_name": "sssd-tools",
"binary_version": "1.16.1-1ubuntu1.8+esm1"
}
]
}{
"binaries": [
{
"binary_name": "libipa-hbac0",
"binary_version": "2.2.3-3ubuntu0.13+esm1"
},
{
"binary_name": "libnss-sss",
"binary_version": "2.2.3-3ubuntu0.13+esm1"
},
{
"binary_name": "libpam-sss",
"binary_version": "2.2.3-3ubuntu0.13+esm1"
},
{
"binary_name": "libsss-certmap0",
"binary_version": "2.2.3-3ubuntu0.13+esm1"
},
{
"binary_name": "libsss-idmap0",
"binary_version": "2.2.3-3ubuntu0.13+esm1"
},
{
"binary_name": "libsss-nss-idmap0",
"binary_version": "2.2.3-3ubuntu0.13+esm1"
},
{
"binary_name": "libsss-simpleifp0",
"binary_version": "2.2.3-3ubuntu0.13+esm1"
},
{
"binary_name": "libsss-sudo",
"binary_version": "2.2.3-3ubuntu0.13+esm1"
},
{
"binary_name": "libwbclient-sssd",
"binary_version": "2.2.3-3ubuntu0.13+esm1"
},
{
"binary_name": "python3-libipa-hbac",
"binary_version": "2.2.3-3ubuntu0.13+esm1"
},
{
"binary_name": "python3-libsss-nss-idmap",
"binary_version": "2.2.3-3ubuntu0.13+esm1"
},
{
"binary_name": "python3-sss",
"binary_version": "2.2.3-3ubuntu0.13+esm1"
},
{
"binary_name": "sssd",
"binary_version": "2.2.3-3ubuntu0.13+esm1"
},
{
"binary_name": "sssd-ad",
"binary_version": "2.2.3-3ubuntu0.13+esm1"
},
{
"binary_name": "sssd-ad-common",
"binary_version": "2.2.3-3ubuntu0.13+esm1"
},
{
"binary_name": "sssd-common",
"binary_version": "2.2.3-3ubuntu0.13+esm1"
},
{
"binary_name": "sssd-dbus",
"binary_version": "2.2.3-3ubuntu0.13+esm1"
},
{
"binary_name": "sssd-ipa",
"binary_version": "2.2.3-3ubuntu0.13+esm1"
},
{
"binary_name": "sssd-kcm",
"binary_version": "2.2.3-3ubuntu0.13+esm1"
},
{
"binary_name": "sssd-krb5",
"binary_version": "2.2.3-3ubuntu0.13+esm1"
},
{
"binary_name": "sssd-krb5-common",
"binary_version": "2.2.3-3ubuntu0.13+esm1"
},
{
"binary_name": "sssd-ldap",
"binary_version": "2.2.3-3ubuntu0.13+esm1"
},
{
"binary_name": "sssd-proxy",
"binary_version": "2.2.3-3ubuntu0.13+esm1"
},
{
"binary_name": "sssd-tools",
"binary_version": "2.2.3-3ubuntu0.13+esm1"
}
]
}