CVE-2023-25567

GSS-NTLMSSP, a mechglue plugin for the GSSAPI library that implements NTLM authentication, has an out-of-bounds read when decoding target information prior to version 1.2.0. The length of the av_pair is not checked properly for two of the elements which can trigger an out-of-bound read. The out-of-bounds read can be triggered via the main gss_accept_sec_context entry point and could cause a denial-of-service if the memory is unmapped. The issue is fixed in version 1.2.0.

Implementing the GSSAPI mechanism of NTLMSSP.

Security Fix(es):

GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, memory corruption can be triggered when decoding UTF16 strings. The variable outlen was not initialized and could cause writing a zero to an arbitrary place in memory if ntlm_str_convert() were to fail, which would leave outlen uninitialized. This can lead to a denial of service if the write hits unmapped memory or randomly corrupts a byte in the application memory space. This vulnerability can trigger an out-of-bounds write, leading to memory corruption. This vulnerability can be triggered via the main gss_accept_sec_context entry point. This issue is fixed in version 1.2.0.(CVE-2023-25564)

GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, an incorrect free when decoding target information can trigger a denial of service. The error condition incorrectly assumes the cb and sh buffers contain a copy of the data that needs to be freed. However, that is not the case. This vulnerability can be triggered via the main gss_accept_sec_context entry point. This will likely trigger an assertion failure in free, causing a denial-of-service. This issue is fixed in version 1.2.0.(CVE-2023-25565)

GSS-NTLMSSP, a mechglue plugin for the GSSAPI library that implements NTLM authentication, has an out-of-bounds read when decoding target information prior to version 1.2.0. The length of the av_pair is not checked properly for two of the elements which can trigger an out-of-bound read. The out-of-bounds read can be triggered via the main gss_accept_sec_context entry point and could cause a denial-of-service if the memory is unmapped. The issue is fixed in version 1.2.0.(CVE-2023-25567)

GSS-NTLMSSP, a mechglue plugin for the GSSAPI library that implements NTLM authentication, has an out-of-bounds read when decoding target information prior to version 1.2.0. The length of the av_pair is not checked properly for two of the elements which can trigger an out-of-bound read. The out-of-bounds read can be triggered via the main gss_accept_sec_context entry point and could cause a denial-of-service if the memory is unmapped. The issue is fixed in version 1.2.0.

The gssntlmssp is a GSSAPI NTLM mechanism that allows to perform NTLM authentication in GSSAPI programs.

Security Fix(es):

• gssntlmssp: multiple out-of-bounds read when decoding NTLM fields (CVE-2023-25563)
• gssntlmssp: memory corruption when decoding UTF16 strings (CVE-2023-25564)
• gssntlmssp: incorrect free when decoding target information (CVE-2023-25565)
• gssntlmssp: memory leak when parsing usernames (CVE-2023-25566)
• gssntlmssp: out-of-bounds read when decoding target information (CVE-2023-25567)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Multiple out-of-bounds read when decoding NTLM fields. (CVE-2023-25563) Memory corruption when decoding UTF16 strings. (CVE-2023-25564) Incorrect free when decoding target information. (CVE-2023-25565) Memory leak when parsing usernames. (CVE-2023-25566) Out-of-bounds read when decoding target information. (CVE-2023-25567)

This update for gssntlmssp fixes the following issues:

Update to version 1.2.0

• Implement gss_set_cred_option.
• Allow to gss_wrap even if NEGOTIATE_SEAL is not negotiated.
• Move HMAC code to OpenSSL EVP API.
• Fix crash bug when acceptor credentials are NULL.
• Translations update from Fedora Weblate.

Fix security issues:

• CVE-2023-25563 (boo#1208278): multiple out-of-bounds read when decoding NTLM fields.
• CVE-2023-25564 (boo#1208279): memory corruption when decoding UTF16 strings.
• CVE-2023-25565 (boo#1208280): incorrect free when decoding target information.
• CVE-2023-25566 (boo#1208281): memory leak when parsing usernames.
• CVE-2023-25567 (boo#1208282): out-of-bounds read when decoding target information.

Update to version 1.1

• various build fixes and better compatibility when a MIC is requested.

Update to version 1.0

• Fix test_gssapi_rfc5587.
• Actually run tests with make check.
• Add two tests around NTLMSSP_NEGOTIATE_LMKEY.
• Refine LM compatibility level logic.
• Refactor the gssntlm_required_security function.
• Implement reading LM/NT hashes.
• Add test for smpasswd-like user files.
• Return confidentiality status.
• Fix segfault in sign/seal functions.
• Fix dummy signature generation.
• Use UCS16LE instead of UCS-2LE.
• Provide a zero lm key if the password is too long.
• Completely omit CBs AV pairs when no CB provided.
• Change license to the more permissive ISC.
• Do not require cached users with winbind.
• Add ability to pass keyfile via cred store.
• Remove unused parts of Makefile.am.
• Move attribute names to allocated strings.
• Adjust serialization for name attributes.
• Fix crash in acquiring credentials.
• Fix fallback to external_creds interface.
• Introduce parse_user_name() function.
• Add test for parse_user_name.
• Change how we assemble user names in ASC.
• Use thread local storage for winbind context.
• Make per thread winbind context optional.
• Fixed memleak of usr_cred.
• Support get_sids request via name attributes.
• Fixed memory leaks found by valgrind.

• Update to version 0.9

• add support for getting session key.
• Add gss_inquire_attrs_for_mech().
• Return actual data for RFC5587 API.
• Add new Windows version flags.
• Add Key exchange also when wanting integrity only.
• Drop support for GSS_C_MA_NOT_DFLT_MECH.

These are all security issues fixed in the gssntlmssp-1.2.0-1.1 package on the GA media of openSUSE Tumbleweed.

Phil Turnbull discovered that GSS NTLMSSP may perform out-of-bounds reads when decoding NTLM fields and target information. An attacker could possibly use this issue to cause GSS NTLMSSP to crash, resulting in a denial of service. (CVE-2023-25563, CVE-2023-25567)

Phil Turnbull discovered that GSS NTLMSSP did not properly initialize memory when decoding UTF16 strings. An attacker could possibly use this issue to trigger an out-of-bounds write, resulting in a crash. (CVE-2023-25564)

Phil Turnbull discovered that GSS NTLMSSP did not properly handle memory cleanup. An attacker could possibly use this issue to cause an assertion failure, resulting in a denial of service. (CVE-2023-25565)