Summary
Phil Turnbull discovered that GSS NTLMSSP may perform out-of-bounds reads
when decoding NTLM fields and target information. An attacker could
possibly use this issue to cause GSS NTLMSSP to crash, resulting in
a denial of service. (CVE-2023-25563, CVE-2023-25567)
Phil Turnbull discovered that GSS NTLMSSP did not properly initialize
memory when decoding UTF16 strings. An attacker could possibly use
this issue to trigger an out-of-bounds write, resulting in a crash.
(CVE-2023-25564)
Phil Turnbull discovered that GSS NTLMSSP did not properly handle memory
cleanup. An attacker could possibly use this issue to cause an assertion
failure, resulting in a denial of service. (CVE-2023-25565)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | gss-ntlmssp | 0.7.0-3~ubuntu0.16.04.1+esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | gss-ntlmssp | 0.7.0-4ubuntu0.18.04.1~esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | gss-ntlmssp | 0.7.0-4ubuntu0.20.04.1~esm1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | gss-ntlmssp | 0.7.0-4ubuntu0.22.04.1~esm1 |
Vulnerabilities 4
-
High 7.5
GSS-NTLMSSP vulnerable to incorrect free when decoding target information
GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, an incorrect free when decoding target information can trigger a denial of service. The error condition incorrectly assumes the `cb` and `sh` …
-
High 7.5
GSS-NTLMSSP vulnerable to out-of-bounds read when decoding target information
GSS-NTLMSSP, a mechglue plugin for the GSSAPI library that implements NTLM authentication, has an out-of-bounds read when decoding target information prior to version 1.2.0. The length of the `av_pair` is not checked properly for two of the elements which can…
-
Medium 6.5
GSS-NTLMSSP vulnerable to memory corruption when decoding UTF16 strings
GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, memory corruption can be triggered when decoding UTF16 strings. The variable `outlen` was not initialized and could cause writing a zero to an…
-
Medium 5.9
GSS-NTLMSSP vulnerable to multiple out-of-bounds reads when decoding NTLM fields
GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, multiple out-of-bounds reads when decoding NTLM fields can trigger a denial of service. A 32-bit integer overflow condition can lead to incorr…