[USN-6467-2] Kerberos vulnerability

-----BEGIN PGP SIGNATURE-----

wsB5BAABCAAjFiEEGq96SdAIJY1vInRLbzAtCH6LqTYFAmVIv0IFAwAAAAAACgkQbzAtCH6LqTYX
TAf/T8iw3PsPt1B5lVRrER1RTlbyr6/IZSUUOqdl/v3ORpR5rJzS8j3bgGgZlGJfjh4eBMAgbpEi
9ZXHvx43yju7VtNlPkV5hmEdcozimn52xJfJLU0qUs9ovnXGVjG+9IIwmDW3z/ukherZnuep+4Kx
cezhHdTiLlABxtL4e/lOR0xuVEwOcS691b3V220hB3svWtwXkr2qQxSUQICqpX1lwPTr9hlkduNX
pl2UTZl7pK15PHeGJ3OZ5aM9CpdxWsT56MnE42QqhEY6M9BCypZe9Y4O18qugDUxbfN5YLpgfrwA
7zOO5bSe2hGzephoRkyzMwj6qgbH6GT+TYXSADiLgw==
=m3qN
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6467-2
November 06, 2023

krb5 vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 23.04
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS

Summary:

Kerberos could be made to crash if it received specially crafted
network traffic.

Software Description:
- krb5: MIT Kerberos Network Authentication Protocol

Details:

USN-6467-1 fixed a vulnerability in Kerberos. This update provides the
corresponding update for Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu
23.04.

Original advisory details:

Robert Morris discovered that Kerberos did not properly handle memory
access when processing RPC data through kadmind, which could lead to the
freeing of uninitialized memory. An authenticated remote attacker could
possibly use this issue to cause kadmind to crash, resulting in a denial
of service.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.04:
krb5-admin-server 1.20.1-1ubuntu0.1
krb5-kdc 1.20.1-1ubuntu0.1
krb5-kdc-ldap 1.20.1-1ubuntu0.1
krb5-otp 1.20.1-1ubuntu0.1
krb5-pkinit 1.20.1-1ubuntu0.1
krb5-user 1.20.1-1ubuntu0.1
libgssapi-krb5-2 1.20.1-1ubuntu0.1
libgssrpc4 1.20.1-1ubuntu0.1
libk5crypto3 1.20.1-1ubuntu0.1
libkadm5clnt-mit12 1.20.1-1ubuntu0.1
libkadm5srv-mit12 1.20.1-1ubuntu0.1
libkdb5-10 1.20.1-1ubuntu0.1
libkrad0 1.20.1-1ubuntu0.1
libkrb5-3 1.20.1-1ubuntu0.1
libkrb5support0 1.20.1-1ubuntu0.1

Ubuntu 22.04 LTS:
krb5-admin-server 1.19.2-2ubuntu0.3
krb5-kdc 1.19.2-2ubuntu0.3
krb5-kdc-ldap 1.19.2-2ubuntu0.3
krb5-otp 1.19.2-2ubuntu0.3
krb5-pkinit 1.19.2-2ubuntu0.3
krb5-user 1.19.2-2ubuntu0.3
libgssapi-krb5-2 1.19.2-2ubuntu0.3
libgssrpc4 1.19.2-2ubuntu0.3
libk5crypto3 1.19.2-2ubuntu0.3
libkadm5clnt-mit12 1.19.2-2ubuntu0.3
libkadm5srv-mit12 1.19.2-2ubuntu0.3
libkdb5-10 1.19.2-2ubuntu0.3
libkrad0 1.19.2-2ubuntu0.3
libkrb5-3 1.19.2-2ubuntu0.3
libkrb5support0 1.19.2-2ubuntu0.3

Ubuntu 20.04 LTS:
krb5-admin-server 1.17-6ubuntu4.4
krb5-kdc 1.17-6ubuntu4.4
krb5-kdc-ldap 1.17-6ubuntu4.4
krb5-otp 1.17-6ubuntu4.4
krb5-pkinit 1.17-6ubuntu4.4
krb5-user 1.17-6ubuntu4.4
libgssapi-krb5-2 1.17-6ubuntu4.4
libgssrpc4 1.17-6ubuntu4.4
libk5crypto3 1.17-6ubuntu4.4
libkadm5clnt-mit11 1.17-6ubuntu4.4
libkadm5srv-mit11 1.17-6ubuntu4.4
libkdb5-9 1.17-6ubuntu4.4
libkrad0 1.17-6ubuntu4.4
libkrb5-3 1.17-6ubuntu4.4
libkrb5support0 1.17-6ubuntu4.4

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-6467-2
https://ubuntu.com/security/notices/USN-6467-1
CVE-2023-36054

Package Information:
https://launchpad.net/ubuntu/+source/krb5/1.20.1-1ubuntu0.1
https://launchpad.net/ubuntu/+source/krb5/1.19.2-2ubuntu0.3
https://launchpad.net/ubuntu/+source/krb5/1.17-6ubuntu4.4