USN-5800-1: Heimdal vulnerabilities
12 January 2023
Several security issues were fixed in Heimdal.
Releases
Packages
- heimdal - Heimdal Kerberos Network Authentication Protocol
Details
It was discovered that Heimdal incorrectly handled certain SPNEGO tokens. A
remote attacker could possibly use this issue to cause a denial of service.
(CVE-2021-44758)
Evgeny Legerov discovered that Heimdal incorrectly handled memory when
performing certain DES decryption operations. A remote attacker could use
this issue to cause a denial of service, or possibly execute arbitrary
code. (CVE-2022-3437)
Greg Hudson discovered that Kerberos PAC implementation used in Heimdal
incorrectly handled certain parsing operations. A remote attacker could use
this issue to cause a denial of service, or possibly execute arbitrary
code. (CVE-2022-42898)
It was discovered that Heimdal's KDC did not properly handle certain error
conditions. A remote attacker could use this issue to cause a denial of
service, or possibly execute arbitrary code. (CVE-2022-44640)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 20.04
-
libgssapi3-heimdal
-
7.7.0+dfsg-1ubuntu1.3
-
libhdb9-heimdal
-
7.7.0+dfsg-1ubuntu1.3
-
libasn1-8-heimdal
-
7.7.0+dfsg-1ubuntu1.3
-
libkrb5-26-heimdal
-
7.7.0+dfsg-1ubuntu1.3
-
libhx509-5-heimdal
-
7.7.0+dfsg-1ubuntu1.3
Ubuntu 18.04
-
libgssapi3-heimdal
-
7.5.0+dfsg-1ubuntu0.3
-
libhdb9-heimdal
-
7.5.0+dfsg-1ubuntu0.3
-
libasn1-8-heimdal
-
7.5.0+dfsg-1ubuntu0.3
-
libkrb5-26-heimdal
-
7.5.0+dfsg-1ubuntu0.3
-
libhx509-5-heimdal
-
7.5.0+dfsg-1ubuntu0.3
Ubuntu 16.04
-
libgssapi3-heimdal
-
1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm3
Available with Ubuntu Pro
-
libhdb9-heimdal
-
1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm3
Available with Ubuntu Pro
-
libasn1-8-heimdal
-
1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm3
Available with Ubuntu Pro
-
libkrb5-26-heimdal
-
1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm3
Available with Ubuntu Pro
-
libhx509-5-heimdal
-
1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm3
Available with Ubuntu Pro
Ubuntu 14.04
-
libgssapi3-heimdal
-
1.6~git20131207+dfsg-1ubuntu1.2+esm3
Available with Ubuntu Pro
-
libhdb9-heimdal
-
1.6~git20131207+dfsg-1ubuntu1.2+esm3
Available with Ubuntu Pro
-
libasn1-8-heimdal
-
1.6~git20131207+dfsg-1ubuntu1.2+esm3
Available with Ubuntu Pro
-
libkrb5-26-heimdal
-
1.6~git20131207+dfsg-1ubuntu1.2+esm3
Available with Ubuntu Pro
-
libhx509-5-heimdal
-
1.6~git20131207+dfsg-1ubuntu1.2+esm3
Available with Ubuntu Pro
After a standard system update you need to restart any application
using Heimdal libraries to make all the necessary changes.
References
Related notices
- USN-5822-1: ctdb, winbind, samba-testsuite, samba-common-bin, python3-ldb, samba-dev, samba-vfs-modules, smbclient, libldb-dev, libwbclient0, libldb2, registry-tools, libsmbclient-dev, python3-ldb-dev, samba-libs, python3-samba, samba, ldb-tools, libsmbclient, libnss-winbind, samba-common, libpam-winbind, libwbclient-dev, samba-dsdb-modules
- USN-5828-1: krb5-k5tls, krb5-multidev, libkrb5-dev, libkadm5clnt-mit11, libkdb5-10, libkadm5srv-mit9, libk5crypto3, krb5-user, libkadm5srv-mit8, krb5-doc, libgssapi-krb5-2, krb5, krb5-kpropd, krb5-pkinit, libkdb5-7, libkadm5srv-mit11, krb5-kdc, libkadm5clnt-mit12, libkrad-dev, libkdb5-9, libkrb5-3, krb5-kdc-ldap, krb5-gss-samples, libgssrpc4, libkrb5support0, krb5-locales, libkadm5srv-mit12, libkdb5-8, libkadm5clnt-mit9, libkrad0, krb5-otp, krb5-admin-server
- USN-5936-1: ctdb, winbind, samba-testsuite, samba-common-bin, samba-dev, samba-vfs-modules, smbclient, libwbclient0, registry-tools, libsmbclient-dev, samba-libs, python3-samba, samba, libsmbclient, libnss-winbind, samba-common, libpam-winbind, libwbclient-dev, samba-dsdb-modules