CVE-2023-3326

Network authentication attack via pam_krb5

Description

pam_krb5 authenticates a user by essentially running kinit with the password, getting a ticket-granting ticket (tgt) from the Kerberos KDC (Key Distribution Center) over the network, as a way to verify the password. However, if a keytab is not provisioned on the system, pam_krb5 has no way to validate the response from the KDC, and essentially trusts the tgt provided over the network as being valid. In a non-default FreeBSD installation that leverages pam_krb5 for authentication and does not have a keytab provisioned, an attacker that is able to control both the password and the KDC responses can return a valid tgt, allowing authentication to occur for any user on the system.

Remediation

Workaround:

  • If you are not using Kerberos at all, ensure /etc/krb5.conf is missing from your system. Additionally, ensure pam_krb5 is commented out of your PAM configuration located as documented in pam.conf(5), generally /etc/pam.d. Note, the default FreeBSD PAM configuration has pam_krb5 commented out. If you are using Kerberos, but not using pam_krb5, ensure pam_krb5 is commented out of your PAM configuration located as documented in pam.conf(5), generally /etc/pam.d. Note, the default FreeBSD PAM configuration has pam_krb5 commented out. If you are using pam_krb5, ensure you have a keytab on your system as provided by your Kerberos administrator.

Categories

9.8
CVSS
Severity: Critical
CVSS 3.1 •
EPSS 0.28%
Vendor Advisory FreeBSD.org Vendor Advisory FreeBSD.org
Affected: FreeBSD FreeBSD
Published at:
Updated at:

References

Link Tags
https://security.FreeBSD.org/advisories/FreeBSD-SA-23:04.pam_krb5.asc mitigation vendor advisory
https://security.netapp.com/advisory/ntap-20230714-0005/ third party advisory
https://security.FreeBSD.org/advisories/FreeBSD-SA-23:09.pam_krb5.asc vendor advisory

Frequently Asked Questions

What is the severity of CVE-2023-3326?
CVE-2023-3326 has been scored as a critical severity vulnerability.
How to fix CVE-2023-3326?
As a workaround for remediating CVE-2023-3326: If you are not using Kerberos at all, ensure /etc/krb5.conf is missing from your system. Additionally, ensure pam_krb5 is commented out of your PAM configuration located as documented in pam.conf(5), generally /etc/pam.d. Note, the default FreeBSD PAM configuration has pam_krb5 commented out. If you are using Kerberos, but not using pam_krb5, ensure pam_krb5 is commented out of your PAM configuration located as documented in pam.conf(5), generally /etc/pam.d. Note, the default FreeBSD PAM configuration has pam_krb5 commented out. If you are using pam_krb5, ensure you have a keytab on your system as provided by your Kerberos administrator.
Is CVE-2023-3326 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2023-3326 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2023-3326?
CVE-2023-3326 affects FreeBSD FreeBSD.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.