Goldberg, Miro Haller, Nadia Heninger, Mike Milano, Dan Shumow, Marc Stevens, and Adam Suhl discovered that Kerberos incorrectly authenticated certain responses. An attacker able to intercept communications between a RADIUS client and server could possibly use this issue to forge responses, bypass authentication, and access network devices and services.
This update introduces support for the Message-Authenticator attribute in non-EAP authentication methods for communications between Kerberos and a RADIUS server.
{ "binaries": [ { "binary_version": "1.17-6ubuntu4.8", "binary_name": "krb5-admin-server" }, { "binary_version": "1.17-6ubuntu4.8", "binary_name": "krb5-gss-samples" }, { "binary_version": "1.17-6ubuntu4.8", "binary_name": "krb5-k5tls" }, { "binary_version": "1.17-6ubuntu4.8", "binary_name": "krb5-kdc" }, { "binary_version": "1.17-6ubuntu4.8", "binary_name": "krb5-kdc-ldap" }, { "binary_version": "1.17-6ubuntu4.8", "binary_name": "krb5-kpropd" }, { "binary_version": "1.17-6ubuntu4.8", "binary_name": "krb5-locales" }, { "binary_version": "1.17-6ubuntu4.8", "binary_name": "krb5-multidev" }, { "binary_version": "1.17-6ubuntu4.8", "binary_name": "krb5-otp" }, { "binary_version": "1.17-6ubuntu4.8", "binary_name": "krb5-pkinit" }, { "binary_version": "1.17-6ubuntu4.8", "binary_name": "krb5-user" }, { "binary_version": "1.17-6ubuntu4.8", "binary_name": "libgssapi-krb5-2" }, { "binary_version": "1.17-6ubuntu4.8", "binary_name": "libgssrpc4" }, { "binary_version": "1.17-6ubuntu4.8", "binary_name": "libk5crypto3" }, { "binary_version": "1.17-6ubuntu4.8", "binary_name": "libkadm5clnt-mit11" }, { "binary_version": "1.17-6ubuntu4.8", "binary_name": "libkadm5srv-mit11" }, { "binary_version": "1.17-6ubuntu4.8", "binary_name": "libkdb5-9" }, { "binary_version": "1.17-6ubuntu4.8", "binary_name": "libkrad-dev" }, { "binary_version": "1.17-6ubuntu4.8", "binary_name": "libkrad0" }, { "binary_version": "1.17-6ubuntu4.8", "binary_name": "libkrb5-3" }, { "binary_version": "1.17-6ubuntu4.8", "binary_name": "libkrb5-dev" }, { "binary_version": "1.17-6ubuntu4.8", "binary_name": "libkrb5support0" } ], "availability": "No subscription required" }
{ "cves_map": { "cves": [ { "severity": [ { "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "type": "CVSS_V3" }, { "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "type": "CVSS_V3" }, { "score": "medium", "type": "Ubuntu" } ], "id": "CVE-2024-3596" } ], "ecosystem": "Ubuntu:20.04:LTS" } }
{ "binaries": [ { "binary_version": "1.19.2-2ubuntu0.5", "binary_name": "krb5-admin-server" }, { "binary_version": "1.19.2-2ubuntu0.5", "binary_name": "krb5-gss-samples" }, { "binary_version": "1.19.2-2ubuntu0.5", "binary_name": "krb5-k5tls" }, { "binary_version": "1.19.2-2ubuntu0.5", "binary_name": "krb5-kdc" }, { "binary_version": "1.19.2-2ubuntu0.5", "binary_name": "krb5-kdc-ldap" }, { "binary_version": "1.19.2-2ubuntu0.5", "binary_name": "krb5-kpropd" }, { "binary_version": "1.19.2-2ubuntu0.5", "binary_name": "krb5-locales" }, { "binary_version": "1.19.2-2ubuntu0.5", "binary_name": "krb5-multidev" }, { "binary_version": "1.19.2-2ubuntu0.5", "binary_name": "krb5-otp" }, { "binary_version": "1.19.2-2ubuntu0.5", "binary_name": "krb5-pkinit" }, { "binary_version": "1.19.2-2ubuntu0.5", "binary_name": "krb5-user" }, { "binary_version": "1.19.2-2ubuntu0.5", "binary_name": "libgssapi-krb5-2" }, { "binary_version": "1.19.2-2ubuntu0.5", "binary_name": "libgssrpc4" }, { "binary_version": "1.19.2-2ubuntu0.5", "binary_name": "libk5crypto3" }, { "binary_version": "1.19.2-2ubuntu0.5", "binary_name": "libkadm5clnt-mit12" }, { "binary_version": "1.19.2-2ubuntu0.5", "binary_name": "libkadm5srv-mit12" }, { "binary_version": "1.19.2-2ubuntu0.5", "binary_name": "libkdb5-10" }, { "binary_version": "1.19.2-2ubuntu0.5", "binary_name": "libkrad-dev" }, { "binary_version": "1.19.2-2ubuntu0.5", "binary_name": "libkrad0" }, { "binary_version": "1.19.2-2ubuntu0.5", "binary_name": "libkrb5-3" }, { "binary_version": "1.19.2-2ubuntu0.5", "binary_name": "libkrb5-dev" }, { "binary_version": "1.19.2-2ubuntu0.5", "binary_name": "libkrb5support0" } ], "availability": "No subscription required" }
{ "cves_map": { "cves": [ { "severity": [ { "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "type": "CVSS_V3" }, { "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "type": "CVSS_V3" }, { "score": "medium", "type": "Ubuntu" } ], "id": "CVE-2024-3596" } ], "ecosystem": "Ubuntu:22.04:LTS" } }
{ "binaries": [ { "binary_version": "1.20.1-6ubuntu2.3", "binary_name": "krb5-admin-server" }, { "binary_version": "1.20.1-6ubuntu2.3", "binary_name": "krb5-gss-samples" }, { "binary_version": "1.20.1-6ubuntu2.3", "binary_name": "krb5-k5tls" }, { "binary_version": "1.20.1-6ubuntu2.3", "binary_name": "krb5-kdc" }, { "binary_version": "1.20.1-6ubuntu2.3", "binary_name": "krb5-kdc-ldap" }, { "binary_version": "1.20.1-6ubuntu2.3", "binary_name": "krb5-kpropd" }, { "binary_version": "1.20.1-6ubuntu2.3", "binary_name": "krb5-locales" }, { "binary_version": "1.20.1-6ubuntu2.3", "binary_name": "krb5-multidev" }, { "binary_version": "1.20.1-6ubuntu2.3", "binary_name": "krb5-otp" }, { "binary_version": "1.20.1-6ubuntu2.3", "binary_name": "krb5-pkinit" }, { "binary_version": "1.20.1-6ubuntu2.3", "binary_name": "krb5-user" }, { "binary_version": "1.20.1-6ubuntu2.3", "binary_name": "libgssapi-krb5-2" }, { "binary_version": "1.20.1-6ubuntu2.3", "binary_name": "libgssrpc4t64" }, { "binary_version": "1.20.1-6ubuntu2.3", "binary_name": "libk5crypto3" }, { "binary_version": "1.20.1-6ubuntu2.3", "binary_name": "libkadm5clnt-mit12" }, { "binary_version": "1.20.1-6ubuntu2.3", "binary_name": "libkadm5srv-mit12" }, { "binary_version": "1.20.1-6ubuntu2.3", "binary_name": "libkdb5-10t64" }, { "binary_version": "1.20.1-6ubuntu2.3", "binary_name": "libkrad-dev" }, { "binary_version": "1.20.1-6ubuntu2.3", "binary_name": "libkrad0" }, { "binary_version": "1.20.1-6ubuntu2.3", "binary_name": "libkrb5-3" }, { "binary_version": "1.20.1-6ubuntu2.3", "binary_name": "libkrb5-dev" }, { "binary_version": "1.20.1-6ubuntu2.3", "binary_name": "libkrb5support0" } ], "availability": "No subscription required" }
{ "cves_map": { "cves": [ { "severity": [ { "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "type": "CVSS_V3" }, { "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "type": "CVSS_V3" }, { "score": "medium", "type": "Ubuntu" } ], "id": "CVE-2024-3596" } ], "ecosystem": "Ubuntu:24.04:LTS" } }
{ "binaries": [ { "binary_version": "1.12+dfsg-2ubuntu5.4+esm6", "binary_name": "krb5-admin-server" }, { "binary_version": "1.12+dfsg-2ubuntu5.4+esm6", "binary_name": "krb5-gss-samples" }, { "binary_version": "1.12+dfsg-2ubuntu5.4+esm6", "binary_name": "krb5-kdc" }, { "binary_version": "1.12+dfsg-2ubuntu5.4+esm6", "binary_name": "krb5-kdc-ldap" }, { "binary_version": "1.12+dfsg-2ubuntu5.4+esm6", "binary_name": "krb5-locales" }, { "binary_version": "1.12+dfsg-2ubuntu5.4+esm6", "binary_name": "krb5-multidev" }, { "binary_version": "1.12+dfsg-2ubuntu5.4+esm6", "binary_name": "krb5-otp" }, { "binary_version": "1.12+dfsg-2ubuntu5.4+esm6", "binary_name": "krb5-pkinit" }, { "binary_version": "1.12+dfsg-2ubuntu5.4+esm6", "binary_name": "krb5-user" }, { "binary_version": "1.12+dfsg-2ubuntu5.4+esm6", "binary_name": "libgssapi-krb5-2" }, { "binary_version": "1.12+dfsg-2ubuntu5.4+esm6", "binary_name": "libgssrpc4" }, { "binary_version": "1.12+dfsg-2ubuntu5.4+esm6", "binary_name": "libk5crypto3" }, { "binary_version": "1.12+dfsg-2ubuntu5.4+esm6", "binary_name": "libkadm5clnt-mit9" }, { "binary_version": "1.12+dfsg-2ubuntu5.4+esm6", "binary_name": "libkadm5srv-mit8" }, { "binary_version": "1.12+dfsg-2ubuntu5.4+esm6", "binary_name": "libkadm5srv-mit9" }, { "binary_version": "1.12+dfsg-2ubuntu5.4+esm6", "binary_name": "libkdb5-7" }, { "binary_version": "1.12+dfsg-2ubuntu5.4+esm6", "binary_name": "libkrad-dev" }, { "binary_version": "1.12+dfsg-2ubuntu5.4+esm6", "binary_name": "libkrad0" }, { "binary_version": "1.12+dfsg-2ubuntu5.4+esm6", "binary_name": "libkrb5-3" }, { "binary_version": "1.12+dfsg-2ubuntu5.4+esm6", "binary_name": "libkrb5-dev" }, { "binary_version": "1.12+dfsg-2ubuntu5.4+esm6", "binary_name": "libkrb5support0" } ], "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro" }
{ "cves_map": { "cves": [ { "severity": [ { "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "type": "CVSS_V3" }, { "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "type": "CVSS_V3" }, { "score": "medium", "type": "Ubuntu" } ], "id": "CVE-2024-3596" } ], "ecosystem": "Ubuntu:Pro:14.04:LTS" } }
{ "binaries": [ { "binary_version": "1.13.2+dfsg-5ubuntu2.2+esm6", "binary_name": "krb5-admin-server" }, { "binary_version": "1.13.2+dfsg-5ubuntu2.2+esm6", "binary_name": "krb5-gss-samples" }, { "binary_version": "1.13.2+dfsg-5ubuntu2.2+esm6", "binary_name": "krb5-k5tls" }, { "binary_version": "1.13.2+dfsg-5ubuntu2.2+esm6", "binary_name": "krb5-kdc" }, { "binary_version": "1.13.2+dfsg-5ubuntu2.2+esm6", "binary_name": "krb5-kdc-ldap" }, { "binary_version": "1.13.2+dfsg-5ubuntu2.2+esm6", "binary_name": "krb5-locales" }, { "binary_version": "1.13.2+dfsg-5ubuntu2.2+esm6", "binary_name": "krb5-multidev" }, { "binary_version": "1.13.2+dfsg-5ubuntu2.2+esm6", "binary_name": "krb5-otp" }, { "binary_version": "1.13.2+dfsg-5ubuntu2.2+esm6", "binary_name": "krb5-pkinit" }, { "binary_version": "1.13.2+dfsg-5ubuntu2.2+esm6", "binary_name": "krb5-user" }, { "binary_version": "1.13.2+dfsg-5ubuntu2.2+esm6", "binary_name": "libgssapi-krb5-2" }, { "binary_version": "1.13.2+dfsg-5ubuntu2.2+esm6", "binary_name": "libgssrpc4" }, { "binary_version": "1.13.2+dfsg-5ubuntu2.2+esm6", "binary_name": "libk5crypto3" }, { "binary_version": "1.13.2+dfsg-5ubuntu2.2+esm6", "binary_name": "libkadm5clnt-mit9" }, { "binary_version": "1.13.2+dfsg-5ubuntu2.2+esm6", "binary_name": "libkadm5srv-mit9" }, { "binary_version": "1.13.2+dfsg-5ubuntu2.2+esm6", "binary_name": "libkdb5-8" }, { "binary_version": "1.13.2+dfsg-5ubuntu2.2+esm6", "binary_name": "libkrad-dev" }, { "binary_version": "1.13.2+dfsg-5ubuntu2.2+esm6", "binary_name": "libkrad0" }, { "binary_version": "1.13.2+dfsg-5ubuntu2.2+esm6", "binary_name": "libkrb5-3" }, { "binary_version": "1.13.2+dfsg-5ubuntu2.2+esm6", "binary_name": "libkrb5-dev" }, { "binary_version": "1.13.2+dfsg-5ubuntu2.2+esm6", "binary_name": "libkrb5support0" } ], "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro" }
{ "cves_map": { "cves": [ { "severity": [ { "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "type": "CVSS_V3" }, { "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "type": "CVSS_V3" }, { "score": "medium", "type": "Ubuntu" } ], "id": "CVE-2024-3596" } ], "ecosystem": "Ubuntu:Pro:16.04:LTS" } }
{ "binaries": [ { "binary_version": "1.16-2ubuntu0.4+esm3", "binary_name": "krb5-admin-server" }, { "binary_version": "1.16-2ubuntu0.4+esm3", "binary_name": "krb5-gss-samples" }, { "binary_version": "1.16-2ubuntu0.4+esm3", "binary_name": "krb5-k5tls" }, { "binary_version": "1.16-2ubuntu0.4+esm3", "binary_name": "krb5-kdc" }, { "binary_version": "1.16-2ubuntu0.4+esm3", "binary_name": "krb5-kdc-ldap" }, { "binary_version": "1.16-2ubuntu0.4+esm3", "binary_name": "krb5-kpropd" }, { "binary_version": "1.16-2ubuntu0.4+esm3", "binary_name": "krb5-locales" }, { "binary_version": "1.16-2ubuntu0.4+esm3", "binary_name": "krb5-multidev" }, { "binary_version": "1.16-2ubuntu0.4+esm3", "binary_name": "krb5-otp" }, { "binary_version": "1.16-2ubuntu0.4+esm3", "binary_name": "krb5-pkinit" }, { "binary_version": "1.16-2ubuntu0.4+esm3", "binary_name": "krb5-user" }, { "binary_version": "1.16-2ubuntu0.4+esm3", "binary_name": "libgssapi-krb5-2" }, { "binary_version": "1.16-2ubuntu0.4+esm3", "binary_name": "libgssrpc4" }, { "binary_version": "1.16-2ubuntu0.4+esm3", "binary_name": "libk5crypto3" }, { "binary_version": "1.16-2ubuntu0.4+esm3", "binary_name": "libkadm5clnt-mit11" }, { "binary_version": "1.16-2ubuntu0.4+esm3", "binary_name": "libkadm5srv-mit11" }, { "binary_version": "1.16-2ubuntu0.4+esm3", "binary_name": "libkdb5-9" }, { "binary_version": "1.16-2ubuntu0.4+esm3", "binary_name": "libkrad-dev" }, { "binary_version": "1.16-2ubuntu0.4+esm3", "binary_name": "libkrad0" }, { "binary_version": "1.16-2ubuntu0.4+esm3", "binary_name": "libkrb5-3" }, { "binary_version": "1.16-2ubuntu0.4+esm3", "binary_name": "libkrb5-dev" }, { "binary_version": "1.16-2ubuntu0.4+esm3", "binary_name": "libkrb5support0" } ], "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro" }
{ "cves_map": { "cves": [ { "severity": [ { "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "type": "CVSS_V3" }, { "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "type": "CVSS_V3" }, { "score": "medium", "type": "Ubuntu" } ], "id": "CVE-2024-3596" } ], "ecosystem": "Ubuntu:Pro:18.04:LTS" } }