CVE-2023-25565
📋 TL;DR
CVE-2023-25565 is a denial-of-service vulnerability in GSS-NTLMSSP, a GSSAPI plugin for NTLM authentication. An incorrect free operation when decoding target information can trigger an assertion failure in the free function, causing affected applications to crash. Systems using GSS-NTLMSSP for authentication prior to version 1.2.0 are vulnerable.
💻 Affected Systems
- GSS-NTLMSSP
📦 What is this software?
Gss Ntlmssp by Gss Ntlmssp Project
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service for any service using GSS-NTLMSSP authentication, potentially affecting critical authentication infrastructure and causing widespread service disruption.
Likely Case
Targeted denial-of-service attacks against specific services using NTLM authentication via GSSAPI, causing service crashes and authentication failures.
If Mitigated
Minimal impact with proper network segmentation and monitoring; crashes would be detected and services could be automatically restarted.
🎯 Exploit Status
Exploitation requires the ability to send NTLM authentication requests to a vulnerable service.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.0
Vendor Advisory: https://github.com/gssapi/gss-ntlmssp/security/advisories/GHSA-7q7f-wqcg-mvfg
Restart Required: Yes
Instructions:
1. Download GSS-NTLMSSP version 1.2.0 or later from GitHub releases. 2. Follow standard build and installation procedures for your distribution. 3. Restart any services using GSS-NTLMSSP.
🔧 Temporary Workarounds
Disable NTLM authentication
linuxDisable NTLM authentication in services using GSSAPI if Kerberos or other authentication methods are available.
# Configuration depends on specific service using GSSAPI
🧯 If You Can't Patch
- Implement network segmentation to limit access to services using GSS-NTLMSSP
- Deploy monitoring and automated restart mechanisms for affected services
🔍 How to Verify
Check if Vulnerable:
Check if GSS-NTLMSSP is installed and its version is below 1.2.0 using package manager or checking library files.Check Version:
pkg-config --modversion gss-ntlmssp || find /usr -name '*gss-ntlmssp*' -type f | xargs strings | grep -i versionVerify Fix Applied:
Verify GSS-NTLMSSP version is 1.2.0 or higher and test NTLM authentication functionality.📡 Detection & Monitoring
Log Indicators:
- Application crashes with assertion failures in free() function
- Authentication service restarts
- Segmentation fault errors in system logs
Network Indicators:
- Multiple failed NTLM authentication attempts followed by service unavailability
SIEM Query:
source="*auth.log*" OR source="*syslog*" ("segmentation fault" OR "assertion failure" OR "free()") AND "gss"🔗 References
- https://github.com/gssapi/gss-ntlmssp/commit/c16100f60907a2de92bcb676f303b81facee0f64
- https://github.com/gssapi/gss-ntlmssp/releases/tag/v1.2.0
- https://github.com/gssapi/gss-ntlmssp/security/advisories/GHSA-7q7f-wqcg-mvfg
- https://github.com/gssapi/gss-ntlmssp/commit/c16100f60907a2de92bcb676f303b81facee0f64
- https://github.com/gssapi/gss-ntlmssp/releases/tag/v1.2.0
- https://github.com/gssapi/gss-ntlmssp/security/advisories/GHSA-7q7f-wqcg-mvfg
