Tech Support
Documentation
Login
Contact Us
TuxCare BlogTwo krb5 Vulnerabilities Fixed in Debian: Patch Your Systems Now
by Rohan Timalsina
August 6, 2024 - TuxCare expert team
krb5, the MIT implementation of Kerberos, is a widely used protocol for network authentication. Recently, two critical vulnerabilities have been discovered in the GSS message token handling in krb5, which could allow attackers to bypass integrity protections or cause a denial of service (DoS). These vulnerabilities, identified as CVE-2024-37370 and CVE-2024-37371, have prompted swift action from the Debian security team to protect users.
Understanding the krb5 Vulnerabilities
This vulnerability affects MIT Kerberos 5 versions before 1.21.3. This flaw allows an attacker to modify the plaintext Extra Count field of a confidential GSS krb5 wrap token. By altering this field, the unwrapped token appears truncated to the application. This truncation can lead to a loss of integrity, potentially allowing malicious actors to manipulate the token content undetected. Applications relying on these tokens for secure communication may unknowingly process tampered data, leading to potential data breaches or further exploitation.
Another vulnerability also affects MIT Kerberos 5 versions before 1.21.3. This issue arises from improper handling of message tokens with invalid length fields during GSS message token processing. An attacker can exploit this flaw to cause invalid memory reads, which can crash the application or lead to a denial of service. By causing invalid memory reads, an attacker can disrupt normal operations, potentially leading to significant downtime and loss of productivity.
Debian’s Response: Updates and Fixes
In response to these vulnerabilities, the Debian security team has released updates for Debian 11 (Bullseye) and Debian 12 (Bookworm) to address these issues.
Debian 11: The issues have been resolved in version 1.18.3-6+deb11u5.
Debian 12: The issues have been resolved in version 1.20.1-2+deb12u2.
These updates ensure that the krb5 package is secure against the identified vulnerabilities. Users are strongly encouraged to upgrade their krb5 packages to these fixed versions to protect their systems.
Protect End-of-Life Systems from k5b5 Vulnerabilities
For users running end-of-life (EOL) Linux distributions, TuxCare’s Extended Lifecycle Support (ELS) offers automated vulnerability patches for various distributions that no longer receive official updates. This includes CentOS (6, 7, and 8), CentOS Stream 8, Ubuntu (16.04 and 18.04), and Oracle Linux 6. Without security support, these systems remain vulnerable to new threats, including the recently discovered krb5 vulnerabilities.
With TuxCare’s ELS, you can receive vendor-grade security patches for up to four years after the official end-of-life date. This extended support covers essential components such as the Linux kernel, glibc, OpenSSL, OpenSSH, Python, PHP, Ansible, and various other packages. This allows organizations to maintain the security and stability of their legacy systems, ensuring protection against emerging vulnerabilities.
Conclusion
By understanding these krb5 vulnerabilities and promptly applying the necessary updates, administrators can safeguard their systems against potential attacks. The Debian security team’s quick response in releasing fixes underscores the community’s commitment to maintaining a secure environment for users.
For more detailed information on the security status of krb5, please refer to its security tracker page at Debian Security Tracker.
Source: DSA 5726-1
