CVE-2017-15088 : Security Advisory and Response

MIT Kerberos 5 (krb5) versions up to 1.15.2 are affected by a vulnerability in the pkinit_crypto_openssl.c file, allowing remote attackers to execute arbitrary code or cause denial of service.

Understanding CVE-2017-15088

In this CVE, a specific file in MIT Kerberos 5 mishandles certain fields, leading to potential security risks.

What is CVE-2017-15088?

The vulnerability in krb5 versions up to 1.15.2 allows attackers to exploit buffer overflow and application crashes by manipulating untrusted X.509 data.

The Impact of CVE-2017-15088

The issue affects the get_matching_data and X509_NAME_oneline_ex functions, enabling remote code execution or denial of service attacks.

Technical Details of CVE-2017-15088

MIT Kerberos 5 vulnerability details and affected systems.

Vulnerability Description

The flaw in pkinit_crypto_openssl.c can be exploited by attackers to execute arbitrary code or cause application crashes.

Affected Systems and Versions

Product: krb5 1.5
Versions: krb5 1.5

Exploitation Mechanism

Attackers can trigger buffer overflow and application crashes by manipulating Distinguished Name (DN) fields in untrusted X.509 data.

Mitigation and Prevention

Steps to mitigate and prevent the CVE-2017-15088 vulnerability.

Immediate Steps to Take

Apply patches provided by the vendor promptly.
Monitor security advisories for updates and follow best practices for secure coding.

Long-Term Security Practices

Regularly update and patch all software components.
Implement network segmentation and access controls to limit exposure to potential attacks.
Conduct regular security assessments and penetration testing.

Patching and Updates

Ensure all systems running krb5 1.5 are updated with the latest patches to address the vulnerability.