CVE-2023-3326
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk55th percentile - higher than 55% of all known CVEs
Summary
CVE-2023-3326 affects the pam_krb5 module, which authenticates users by running kinit with the password. If a keytab is not provisioned on the system, the module trusts responses from the KDC, potentially allowing unauthorized access.
Risk Assessment
The organization is at risk of unauthorized access to the system if an attacker controls both the password and KDC responses. This could lead to serious security breaches.
Recommendation
It is recommended to configure a keytab on the system and monitor KDC responses to minimize the risk of unauthorized access.
Original NVD description (English source)
pam_krb5 authenticates a user by essentially running kinit with the password, getting a ticket-granting ticket (tgt) from the Kerberos KDC (Key Distribution Center) over the network, as a way to verify the password. However, if a keytab is not provisioned on the system, pam_krb5 has no way to validate the response from the KDC, and essentially trusts the tgt provided over the network as being valid. In a non-default FreeBSD installation that leverages pam_krb5 for authentication and does not have a keytab provisioned, an attacker that is able to control both the password and the KDC responses can return a valid tgt, allowing authentication to occur for any user on the system.