In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. This issue is in krb5_init_creds_step in lib/krb5/init_creds_pw.c.

The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5675-1 advisory.

    Isaac Boukris and Andrew Bartlett discovered that Heimdal's KDC was not properly performing checksum     algorithm verifications in the S4U2Self extension module. An attacker could possibly use this issue to     perform a machine-in-the-middle attack and request S4U2Self tickets for any user known by the application.
    This issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04 ESM and Ubuntu 18.04 LTS. (CVE-2018-16860)

    It was discovered that Heimdal was not properly handling the verification of key exchanges when an     anonymous PKINIT was being used. An attacker could possibly use this issue to perform a machine-in-the-     middle attack and expose sensitive information. This issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04     ESM and Ubuntu 18.04 LTS. (CVE-2019-12098)

    Joseph Sutton discovered that Heimdal was not properly handling memory management operations when dealing     with TGS-REQ tickets that were missing information. An attacker could possibly use this issue to cause a     denial of service. (CVE-2021-3671)

    Micha Kpie discovered that Heimdal was not properly handling logical conditions that related to     memory management operations. An attacker could possibly use this issue to cause a denial of service.
    (CVE-2022-3116)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security fix for CVE-2019-12098

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libheimdal fixes the following issues :

libheimdal was updated to version 7.7.0 :

  + Bug fixes :

  - PKCS#11 hcrypto back-end :

  + initialize the p11_module_load function list

  + verify that not only is a mechanism present but that its     mechanism info states that it offers the required     encryption, decryption or digest services

  - krb5 :

  + Starting with 7.6, Heimdal permitted requesting     authenticated anonymous tickets. However, it did not     verify that a KDC in fact returned an anonymous ticket     when one was requested.

  + Cease setting the KDCOption reaquest_anonymous flag when     issuing S4UProxy (constrained delegation) TGS requests.

  + when the Win2K PKINIT compatibility option is set, do     not require krbtgt otherName to match when validating     KDC certificate.

  + set PKINIT_BTMM flag per Apple implementation

  + use memset_s() instead of memset()

  - kdc :

  + When generating KRB5SignedPath in the AS, use the reply     client name rather than the one from the request, so     validation will work correctly in the TGS.

  + allow checksum of PA-FOR-USER to be HMAC_MD5. Even if     TGT used an enctype with a different checksum. Per     [MS-SFU] 2.2.1 PA-FOR-USER the checksum is always     HMAC_MD5, and that's what Windows and MIT clients send.
    In Heimdal both the client and kdc use instead the     checksum of the TGT, and therefore work with each other     but Windows and MIT clients fail against Heimdal KDC.
    Both Windows and MIT KDC would allow any keyed checksum     to be used so Heimdal client work fine against it.
    Change Heimdal KDC to allow HMAC_MD5 even for non RC4     based TGT in order to support per-spec clients.

  + use memset_s() instead of memset()

  + Detect Heimdal 1.0 through 7.6 clients that issue     S4UProxy (constrained delegation) TGS Requests with the     request anonymous flag set. These requests will be     treated as S4UProxy requests and not anonymous requests.

  - HDB :

  + Set SQLite3 backend default page size to 8KB.

  + Add hdb_set_sync() method

  - kadmind :

  + disable HDB sync during database load avoiding     unnecessary disk i/o.

  - ipropd :

  + disable HDB sync during receive_everything. Doing an     fsync per-record when receiving the complete HDB is a     performance disaster. Among other things, if the HDB is     very large, then one slave receving a full HDB can cause     other slaves to timeout and, if HDB write activity is     high enough to cause iprop log truncation, then also     need full syncs, which leads to a cycle of full syncs     for all slaves until HDB write activity drops. Allowing     the iprop log to be larger helps, but improving     receive_everything() performance helps even more.

  - kinit :

  + Anonymous PKINIT tickets discard the realm information     used to locate the issuing AS. Store the issuing realm     in the credentials cache in order to locate a KDC which     can renew them.

  + Do not leak the result of krb5_cc_get_config() when     determining anonymous PKINIT start realm.

  - klist :

  + Show transited-policy-checked, ok-as-delegate and     anonymous flags when listing credentials.

  - tests :

  + Regenerate certs so that they expire before the 2038     armageddon so the test suite will pass on 32-bit     operating systems until the underlying issues can be     resolved.

  - documentation :

  + rename verify-password to verify-password-quality

  + hprop default mode is encrypt

  + kadmind 'all' permission does not include 'get-keys'

  + verify-password-quality might not be stateless

Version 7.6.0 :

  + Security (#555) :

  - CVE-2018-16860 Heimdal KDC: Reject PA-S4U2Self with     unkeyed checksum

    When the Heimdal KDC checks the checksum that is placed     on the S4U2Self packet by the server to protect the     requested principal against modification, it does not     confirm that the checksum algorithm that protects the     user name (principal) in the request is keyed. This     allows a man-in-the-middle attacker who can intercept     the request to the KDC to modify the packet by replacing     the user name (principal) in the request with any     desired user name (principal) that exists in the KDC and     replace the checksum protecting that name with a CRC32     checksum (which requires no prior knowledge to compute).
    This would allow a S4U2Self ticket requested on behalf     of user name (principal) user@EXAMPLE.COM to any service     to be changed to a S4U2Self ticket with a user name     (principal) of Administrator@EXAMPLE.COM. This ticket     would then contain the PAC of the modified user name     (principal).

  - CVE-2019-12098, client-only :

    RFC8062 Section 7 requires verification of the     PA-PKINIT-KX key exchange when anonymous PKINIT is used.
    Failure to do so can permit an active attacker to become     a man-in-the-middle.

  + Bug fixes :

  - Happy eyeballs: Don't wait for responses from     known-unreachable KDCs.

  - kdc :

  + check return copy_Realm, copy_PrincipalName,     copy_EncryptionKey

  - kinit :

  + cleanup temporary ccaches

  + see man page for 'kinit --anonymous' command line syntax     change

  - kdc :

  + Make anonymous AS-requests more RFC8062-compliant.
    Updated expired test certificates

  + Features :

  - kuser: support authenticated anonymous AS-REQs in kinit

  - kdc: support for anonymous TGS-REQs

  - kgetcred support for anonymous service tickets

  - Support builds with OpenSSL 1.1.1

Several vulnerabilities were discovered in Heimdal, an implementation of Kerberos 5 that aims to be compatible with MIT Kerberos.

  - CVE-2018-16860     Isaac Boukris and Andrew Bartlett discovered that     Heimdal was susceptible to man-in-the-middle attacks     caused by incomplete checksum validation. Details on the     issue can be found in the Samba advisory at     https://www.samba.org/samba/security/CVE-2018-16860.html     .

  - CVE-2019-12098     It was discovered that failure of verification of the     PA-PKINIT-KX key exchange client-side could permit to     perform man-in-the-middle attack.

ID	Name	Product	Family	Severity
166109	Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS : Heimdal vulnerabilities (USN-5675-1)	Nessus	Ubuntu Local Security Checks	high
132663	Fedora 31 : heimdal (2019-f3046b6bfb)	Nessus	Fedora Local Security Checks	high
132642	Fedora 30 : heimdal (2019-2fa7d6405b)	Nessus	Fedora Local Security Checks	high
126437	openSUSE Security Update : libheimdal (openSUSE-2019-1682)	Nessus	SuSE Local Security Checks	high
125709	Debian DSA-4455-1 : heimdal - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2019-12098

high

Tenable Plugins

high

high

high

high

high