USN-5800-1: Heimdal vulnerabilities

Releases

• Ubuntu 20.04 LTS
• Ubuntu 18.04 ESM
• Ubuntu 16.04 ESM
• Ubuntu 14.04 ESM

Packages

• heimdal - Heimdal Kerberos Network Authentication Protocol

Details

It was discovered that Heimdal incorrectly handled certain SPNEGO tokens. A
remote attacker could possibly use this issue to cause a denial of service.
(CVE-2021-44758)

Evgeny Legerov discovered that Heimdal incorrectly handled memory when
performing certain DES decryption operations. A remote attacker could use
this issue to cause a denial of service, or possibly execute arbitrary
code. (CVE-2022-3437)

Greg Hudson discovered that Kerberos PAC implementation used in Heimdal
incorrectly handled certain parsing operations. A remote attacker could use
this issue to cause a denial of service, or possibly execute arbitrary
code. (CVE-2022-42898)

It was discovered that Heimdal's KDC did not properly handle certain error
conditions. A remote attacker could use this issue to cause a denial of
service, or possibly execute arbitrary code. (CVE-2022-44640)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 20.04

• libgssapi3-heimdal - 7.7.0+dfsg-1ubuntu1.3
• libhdb9-heimdal - 7.7.0+dfsg-1ubuntu1.3
• libasn1-8-heimdal - 7.7.0+dfsg-1ubuntu1.3
• libkrb5-26-heimdal - 7.7.0+dfsg-1ubuntu1.3
• libhx509-5-heimdal - 7.7.0+dfsg-1ubuntu1.3

Ubuntu 18.04

• libgssapi3-heimdal - 7.5.0+dfsg-1ubuntu0.3
• libhdb9-heimdal - 7.5.0+dfsg-1ubuntu0.3
• libasn1-8-heimdal - 7.5.0+dfsg-1ubuntu0.3
• libkrb5-26-heimdal - 7.5.0+dfsg-1ubuntu0.3
• libhx509-5-heimdal - 7.5.0+dfsg-1ubuntu0.3

Ubuntu 16.04

• libgssapi3-heimdal - 1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm3
  Available with Ubuntu Pro
• libhdb9-heimdal - 1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm3
  Available with Ubuntu Pro
• libasn1-8-heimdal - 1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm3
  Available with Ubuntu Pro
• libkrb5-26-heimdal - 1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm3
  Available with Ubuntu Pro
• libhx509-5-heimdal - 1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm3
  Available with Ubuntu Pro

Ubuntu 14.04

• libgssapi3-heimdal - 1.6~git20131207+dfsg-1ubuntu1.2+esm3
  Available with Ubuntu Pro
• libhdb9-heimdal - 1.6~git20131207+dfsg-1ubuntu1.2+esm3
  Available with Ubuntu Pro
• libasn1-8-heimdal - 1.6~git20131207+dfsg-1ubuntu1.2+esm3
  Available with Ubuntu Pro
• libkrb5-26-heimdal - 1.6~git20131207+dfsg-1ubuntu1.2+esm3
  Available with Ubuntu Pro
• libhx509-5-heimdal - 1.6~git20131207+dfsg-1ubuntu1.2+esm3
  Available with Ubuntu Pro

After a standard system update you need to restart any application
using Heimdal libraries to make all the necessary changes.

References

• CVE-2022-42898
• CVE-2022-44640
• CVE-2021-44758
• CVE-2022-3437

Related notices

• USN-5822-1: libwbclient-dev, libpam-winbind, samba, winbind, samba-libs, libsmbclient, samba-dsdb-modules, samba-common-bin, ldb-tools, ctdb, libldb2, samba-dev, samba-common, libnss-winbind, samba-testsuite, python3-samba, libwbclient0, libsmbclient-dev, python3-ldb-dev, smbclient, libldb-dev, python3-ldb, registry-tools, samba-vfs-modules
• USN-5828-1: libkadm5clnt-mit9, libkdb5-7, libkadm5srv-mit11, libkrb5-3, krb5-kdc, libgssapi-krb5-2, krb5-user, krb5-multidev, krb5-locales, libkadm5srv-mit9, libkadm5clnt-mit12, libkadm5srv-mit12, libgssrpc4, libkdb5-8, libkdb5-9, krb5-otp, libkrb5-dev, krb5-kdc-ldap, libkdb5-10, libkadm5srv-mit8, krb5-doc, krb5-pkinit, krb5-k5tls, libkrad-dev, krb5, libkrad0, krb5-admin-server, krb5-kpropd, libkadm5clnt-mit11, krb5-gss-samples, libk5crypto3, libkrb5support0
• USN-5936-1: libwbclient-dev, libpam-winbind, samba, winbind, samba-libs, libsmbclient, samba-dsdb-modules, samba-common-bin, ctdb, samba-dev, samba-common, libnss-winbind, samba-testsuite, python3-samba, libwbclient0, libsmbclient-dev, smbclient, registry-tools, samba-vfs-modules