{
    "data_version": "4.0",
    "data_type": "CVE",
    "data_format": "MITRE",
    "CVE_data_meta": {
        "ID": "CVE-2023-3326",
        "ASSIGNER": "secteam@freebsd.org",
        "STATE": "PUBLIC"
    },
    "description": {
        "description_data": [
            {
                "lang": "eng",
                "value": "pam_krb5 authenticates a user by essentially running kinit with the password, getting a ticket-granting ticket (tgt) from the Kerberos KDC (Key Distribution Center) over the network, as a way to verify the password. However, if a keytab is not provisioned on the system, pam_krb5 has no way to validate the response from the KDC, and essentially trusts the tgt provided over the network as being valid. In a non-default FreeBSD installation that leverages pam_krb5 for authentication and does not have a keytab provisioned, an attacker that is able to control both the password and the KDC responses can return a valid tgt, allowing authentication to occur for any user on the system.\n"
            }
        ]
    },
    "problemtype": {
        "problemtype_data": [
            {
                "description": [
                    {
                        "lang": "eng",
                        "value": "CWE-303  Incorrect Implementation of Authentication Algorithm",
                        "cweId": "CWE-303"
                    }
                ]
            }
        ]
    },
    "affects": {
        "vendor": {
            "vendor_data": [
                {
                    "vendor_name": "FreeBSD",
                    "product": {
                        "product_data": [
                            {
                                "product_name": "FreeBSD",
                                "version": {
                                    "version_data": [
                                        {
                                            "version_affected": "<",
                                            "version_name": "13.2-RELEASE",
                                            "version_value": "13.2-RELEASE-p1"
                                        },
                                        {
                                            "version_affected": "<",
                                            "version_name": "13.1-RELEASE",
                                            "version_value": "13.1-RELEASE-p8"
                                        },
                                        {
                                            "version_affected": "<",
                                            "version_name": "12.4-RELEASE",
                                            "version_value": "12.4-RELEASE-p3"
                                        }
                                    ]
                                }
                            }
                        ]
                    }
                }
            ]
        }
    },
    "references": {
        "reference_data": [
            {
                "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-23:04.pam_krb5.asc",
                "refsource": "MISC",
                "name": "https://security.FreeBSD.org/advisories/FreeBSD-SA-23:04.pam_krb5.asc"
            },
            {
                "url": "https://security.netapp.com/advisory/ntap-20230714-0005/",
                "refsource": "MISC",
                "name": "https://security.netapp.com/advisory/ntap-20230714-0005/"
            },
            {
                "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-23:09.pam_krb5.asc",
                "refsource": "MISC",
                "name": "https://security.FreeBSD.org/advisories/FreeBSD-SA-23:09.pam_krb5.asc"
            }
        ]
    },
    "generator": {
        "engine": "Vulnogram 0.1.0-dev"
    },
    "source": {
        "advisory": "FreeBSD-SA-23:04.pam_krb5",
        "discovery": "UNKNOWN"
    },
    "configuration": [
        {
            "lang": "en",
            "supportingMedia": [
                {
                    "base64": false,
                    "type": "text/html",
                    "value": "<div>Exposure only occurs if pam_krb5 is enabled in the PAM configuration, an /etc/krb5.conf is installed, and the system does not have a system keytab.</div><div><br></div><div>For FreeBSD, the default installation has pam_krb5 commented out and does not have an /etc/krb5.conf.</div>"
                }
            ],
            "value": "Exposure only occurs if pam_krb5 is enabled in the PAM configuration, an /etc/krb5.conf is installed, and the system does not have a system keytab.\n\n\n\n\nFor FreeBSD, the default installation has pam_krb5 commented out and does not have an /etc/krb5.conf.\n\n"
        }
    ],
    "work_around": [
        {
            "lang": "en",
            "supportingMedia": [
                {
                    "base64": false,
                    "type": "text/html",
                    "value": "If you are not using Kerberos at all, ensure /etc/krb5.conf is missing from your system. Additionally, ensure pam_krb5 is commented out of your PAM configuration located as documented in pam.conf(5), generally /etc/pam.d. Note, the default FreeBSD PAM configuration has pam_krb5 commented out.<br><br>If you are using Kerberos, but not using pam_krb5, ensure pam_krb5 is commented out of your PAM configuration located as documented in pam.conf(5), generally /etc/pam.d. Note, the default FreeBSD PAM configuration has pam_krb5 commented out.<br><br>If you are using pam_krb5, ensure you have a keytab on your system as provided by your Kerberos administrator.<br>"
                }
            ],
            "value": "If you are not using Kerberos at all, ensure /etc/krb5.conf is missing from your system. Additionally, ensure pam_krb5 is commented out of your PAM configuration located as documented in pam.conf(5), generally /etc/pam.d. Note, the default FreeBSD PAM configuration has pam_krb5 commented out.\n\nIf you are using Kerberos, but not using pam_krb5, ensure pam_krb5 is commented out of your PAM configuration located as documented in pam.conf(5), generally /etc/pam.d. Note, the default FreeBSD PAM configuration has pam_krb5 commented out.\n\nIf you are using pam_krb5, ensure you have a keytab on your system as provided by your Kerberos administrator.\n"
        }
    ],
    "credits": [
        {
            "lang": "en",
            "value": "Taylor R Campbell <riastradh@NetBSD.org>"
        }
    ]
}