title: Network authentication attack via pam_krb5
description: pam_krb5 authenticates a user by essentially running kinit with the password, getting a ticket-granting ticket (tgt) from the Kerberos KDC (Key Distribution Center) over the network, as a way to verify the password. However, if a keytab is not provisioned on the system, pam_krb5 has no way to validate the response from the KDC, and essentially trusts the tgt provided over the network as being valid. In a non-default FreeBSD installation that leverages pam_krb5 for authentication and does not have a keytab provisioned, an attacker that is able to control both the password and the KDC responses can return a valid tgt, allowing authentication to occur for any user on the system.
problem types: CWE-303  Incorrect Implementation of Authentication Algorithm
affected:
{
defaultStatus: unaffected
modules: pam_krb5
product: FreeBSD
vendor: FreeBSD
versions:
lessThan: 13.2-RELEASE-p1, status: affected, version: 13.2-RELEASE, versionType: release
lessThan: 13.1-RELEASE-p8, status: affected, version: 13.1-RELEASE, versionType: release
lessThan: 12.4-RELEASE-p3, status: affected, version: 12.4-RELEASE, versionType: release
}
workarounds: If you are not using Kerberos at all, ensure /etc/krb5.conf is missing from your system. Additionally, ensure pam_krb5 is commented out of your PAM configuration located as documented in pam.conf(5), generally /etc/pam.d. Note, the default FreeBSD PAM configuration has pam_krb5 commented out.
If you are using Kerberos, but not using pam_krb5, ensure pam_krb5 is commented out of your PAM configuration located as documented in pam.conf(5), generally /etc/pam.d. Note, the default FreeBSD PAM configuration has pam_krb5 commented out.
If you are using pam_krb5, ensure you have a keytab on your system as provided by your Kerberos administrator.