CVE-2019-25018
📋 TL;DR
This vulnerability in the rcp client of MIT krb5-appl allows malicious servers to bypass access restrictions by sending filenames like '.' or empty strings, enabling them to modify permissions of target directories on client systems. It affects users of unsupported MIT krb5-appl software shipped by some Linux distributions, but not the main MIT Kerberos 5 product.
💻 Affected Systems
- MIT krb5-appl
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Malicious server could modify directory permissions on client systems, potentially leading to privilege escalation or unauthorized access to sensitive files.
Likely Case
Malicious server modifies permissions of client directories, potentially exposing sensitive data or allowing further exploitation.
If Mitigated
With proper network segmentation and server trust controls, impact is limited to directory permission changes on isolated systems.
🎯 Exploit Status
Exploitation requires malicious server that client connects to; similar to CVE-2018-20685 and CVE-2019-7282.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified (code removed from krb5 at version 1.8)
Vendor Advisory: https://bugzilla.suse.com/show_bug.cgi?id=1131109
Restart Required: No
Instructions:
1. Check if using krb5-appl. 2. Update to patched version from distribution vendor. 3. Consider migrating to main MIT Kerberos 5 (krb5) which removed affected code years ago.
🔧 Temporary Workarounds
Disable rcp usage
allReplace rcp with secure alternatives like scp or rsync over SSH
# Replace rcp commands in scripts/configs with scp or rsync
Restrict rcp to trusted servers
linuxLimit rcp connections to known, trusted servers only
# Use firewall rules to restrict rcp (port 514) to trusted IPs
iptables -A INPUT -p tcp --dport 514 -s trusted_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 514 -j DROP
🧯 If You Can't Patch
- Migrate from rcp to scp/rsync for all file transfers
- Implement strict network segmentation to limit rcp traffic to trusted zones only
🔍 How to Verify
Check if Vulnerable:
Check if krb5-appl package is installed and version is 1.0.3 or earlier: rpm -qa | grep -i krb5-appl or dpkg -l | grep -i krb5-applCheck Version:
rpm -q krb5-appl || dpkg -l | grep krb5-appl || krb5-config --versionVerify Fix Applied:
Verify krb5-appl is either removed/updated or confirm using main MIT Kerberos 5 (krb5) version 1.8+📡 Detection & Monitoring
Log Indicators:
- Unusual rcp connections from unexpected servers
- Failed permission changes in system logs
Network Indicators:
- rcp traffic to/from untrusted servers
- Unusual port 514 traffic patterns
SIEM Query:
source_port=514 OR dest_port=514 | stats count by src_ip, dest_ip