CVE-2015-2694: Permissions, Privileges, and Access Controls (CWE-264)
value: The kdcpreauth modules in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.2 do not properly track whether a client's request has been validated, which allows remote attackers to bypass an intended preauthentication requirement by providing (1) zero bytes of data or (2) an arbitrary realm name, related to plugins/preauth/otp/main.c and plugins/preauth/pkinit/pkinit_srv.c.
CWE description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Published: 2015-05-25T19:59Z
Repository: https://github.com/krb5/krb5
Language: C
Files changed: src/plugins/preauth/otp/main.c, src/plugins/preauth/pkinit/pkinit_srv.c
Commit date: 2015-04-27 16:22:04 -0400
Commit message: Prevent requires_preauth bypass [CVE-2015-2694]

In the OTP kdcpreauth module, don't set the TKT_FLG_PRE_AUTH bit until
the request is successfully verified.  In the PKINIT kdcpreauth
module, don't respond with code 0 on empty input or an unconfigured
realm.  Together these bugs could cause the KDC preauth framework to
erroneously treat a request as pre-authenticated.

CVE-2015-2694:

In MIT krb5 1.12 and later, when the KDC is configured with PKINIT
support, an unauthenticated remote attacker can bypass the
requires_preauth flag on a client principal and obtain a ciphertext
encrypted in the principal's long-term key.  This ciphertext could be
used to conduct an off-line dictionary attack against the user's
password.

    CVSSv2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N/E:POC/RL:OF/RC:C

ticket: 8160 (new)
target_version: 1.13.2
tags: pullup
subject: requires_preauth bypass in PKINIT-enabled KDC [CVE-2015-2694]

Diff: diff --git a/src/plugins/preauth/otp/main.c b/src/plugins/preauth/otp/main.c
index bf9c6a89f6f..7941b4aeeef 100644
--- a/src/plugins/preauth/otp/main.c
+++ b/src/plugins/preauth/otp/main.c
@@ -40,10 +40,11 @@ static krb5_preauthtype otp_pa_type_list[] =
   { KRB5_PADATA_OTP_REQUEST, 0 };
 
 struct request_state {
     krb5_kdcpreauth_verify_respond_fn respond;
     void *arg;
+    krb5_enc_tkt_part *enc_tkt_reply;
 };
 
 static krb5_error_code
 decrypt_encdata(krb5_context context, krb5_keyblock *armor_key,
                 krb5_pa_otp_req *req, krb5_data *out)
@@ -157,10 +158,13 @@ on_response(void *data, krb5_error_code retval, otp_response response)
     free(data);
 
     if (retval == 0 && response != otp_response_success)
         retval = KRB5_PREAUTH_FAILED;
 
+    if (retval == 0)
+        rs.enc_tkt_reply->flags |= TKT_FLG_PRE_AUTH;
+
     rs.respond(rs.arg, retval, NULL, NULL, NULL);
 }
 
 static krb5_error_code
 otp_init(krb5_context context, krb5_kdcpreauth_moddata *moddata_out,
@@ -261,12 +265,10 @@ otp_verify(krb5_context context, krb5_data *req_pkt, krb5_kdc_req *request,
     struct request_state *rs;
     krb5_error_code retval;
     krb5_data d, plaintext;
     char *config;
 
-    enc_tkt_reply->flags |= TKT_FLG_PRE_AUTH;
-
     /* Get the FAST armor key. */
     armor_key = cb->fast_armor(context, rock);
     if (armor_key == NULL) {
         retval = KRB5KDC_ERR_PREAUTH_FAILED;
         com_err("otp", retval, "No armor key found when verifying padata");
@@ -296,16 +298,18 @@ otp_verify(krb5_context context, krb5_data *req_pkt, krb5_kdc_req *request,
     if (retval != 0) {
         com_err("otp", retval, "Unable to verify nonce or timestamp");
         goto error;
     }
 
-    /* Create the request state. */
+    /* Create the request state.  Save the response callback, and the
+     * enc_tkt_reply pointer so we can set the TKT_FLG_PRE_AUTH flag later. */
     rs = k5alloc(sizeof(struct request_state), &retval);
     if (rs == NULL)
         goto error;
     rs->arg = arg;
     rs->respond = respond;
+    rs->enc_tkt_reply = enc_tkt_reply;
 
     /* Get the principal's OTP configuration string. */
     retval = cb->get_string(context, rock, "otp", &config);
     if (retval == 0 && config == NULL)
         retval = KRB5_PREAUTH_FAILED;
diff --git a/src/plugins/preauth/pkinit/pkinit_srv.c b/src/plugins/preauth/pkinit/pkinit_srv.c
index b4727412936..5b1d73e4a6c 100644
--- a/src/plugins/preauth/pkinit/pkinit_srv.c
+++ b/src/plugins/preauth/pkinit/pkinit_srv.c
@@ -299,11 +299,11 @@ pkinit_server_verify_padata(krb5_context context,
     krb5_pa_data **e_data = NULL;
     krb5_kdcpreauth_modreq modreq = NULL;
 
     pkiDebug("pkinit_verify_padata: entered!\n");
     if (data == NULL || data->length <= 0 || data->contents == NULL) {
-        (*respond)(arg, 0, NULL, NULL, NULL);
+        (*respond)(arg, EINVAL, NULL, NULL, NULL);
         return;
     }
 
 
     if (moddata == NULL) {
@@ -311,11 +311,11 @@ pkinit_server_verify_padata(krb5_context context,
         return;
     }
 
     plgctx = pkinit_find_realm_context(context, moddata, request->server);
     if (plgctx == NULL) {
-        (*respond)(arg, 0, NULL, NULL, NULL);
+        (*respond)(arg, EINVAL, NULL, NULL, NULL);
         return;
     }
 
 #ifdef DEBUG_ASN1
     print_buffer_bin(data->contents, data->length, "/tmp/kdc_as_req");

Vulnerable code:     enc_tkt_reply->flags |= TKT_FLG_PRE_AUTH;

    /* Create the request state. */
        (*respond)(arg, 0, NULL, NULL, NULL);
        (*respond)(arg, 0, NULL, NULL, NULL);
Fixed code:     krb5_enc_tkt_part *enc_tkt_reply;
    if (retval == 0)
        rs.enc_tkt_reply->flags |= TKT_FLG_PRE_AUTH;

    /* Create the request state.  Save the response callback, and the
     * enc_tkt_reply pointer so we can set the TKT_FLG_PRE_AUTH flag later. */
    rs->enc_tkt_reply = enc_tkt_reply;
        (*respond)(arg, EINVAL, NULL, NULL, NULL);
        (*respond)(arg, EINVAL, NULL, NULL, NULL);