CVE-2023-25567
📋 TL;DR
CVE-2023-25567 is an out-of-bounds read vulnerability in GSS-NTLMSSP, a plugin for GSSAPI that handles NTLM authentication. Attackers can trigger this vulnerability through the gss_accept_sec_context function, potentially causing denial-of-service by reading unmapped memory. Systems using GSS-NTLMSSP versions before 1.2.0 for NTLM authentication are affected.
💻 Affected Systems
- GSS-NTLMSSP
📦 What is this software?
Gss Ntlmssp by Gss Ntlmssp Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution if combined with other vulnerabilities, or complete service disruption via denial-of-service.
Likely Case
Denial-of-service causing authentication failures and service disruption.
If Mitigated
Minimal impact with proper memory protections and monitoring.
🎯 Exploit Status
Exploitation requires triggering NTLM authentication via gss_accept_sec_context.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.0
Vendor Advisory: https://github.com/gssapi/gss-ntlmssp/security/advisories/GHSA-24pf-6prf-24ch
Restart Required: Yes
Instructions:
1. Download gss-ntlmssp 1.2.0 from GitHub releases. 2. Stop services using GSS-NTLMSSP. 3. Install the new version using your package manager or from source. 4. Restart affected services.
🔧 Temporary Workarounds
Disable NTLM authentication
allDisable NTLM authentication in applications using GSSAPI if not required.
Configure applications to use alternative authentication methods like Kerberos
Network segmentation
allRestrict access to services using GSS-NTLMSSP to trusted networks only.
Use firewall rules to limit access to affected services
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure
- Monitor for authentication failures and unusual memory access patterns
🔍 How to Verify
Check if Vulnerable:
Check if gss-ntlmssp is installed and version is below 1.2.0Check Version:
gss-ntlmssp --version or check package manager (rpm -q gss-ntlmssp, dpkg -l gss-ntlmssp)Verify Fix Applied:
Verify gss-ntlmssp version is 1.2.0 or higher📡 Detection & Monitoring
Log Indicators:
- Authentication failures
- Unexpected service crashes
- Memory access violation logs
Network Indicators:
- Multiple NTLM authentication attempts
- Unusual traffic to authentication services
SIEM Query:
source="*auth.log*" AND ("gss_accept_sec_context" OR "NTLM" AND "failure")🔗 References
- https://github.com/gssapi/gss-ntlmssp/commit/025fbb756d44ffee8f847db4222ed6aa4bd1fbe4
- https://github.com/gssapi/gss-ntlmssp/releases/tag/v1.2.0
- https://github.com/gssapi/gss-ntlmssp/security/advisories/GHSA-24pf-6prf-24ch
- https://github.com/gssapi/gss-ntlmssp/commit/025fbb756d44ffee8f847db4222ed6aa4bd1fbe4
- https://github.com/gssapi/gss-ntlmssp/releases/tag/v1.2.0
- https://github.com/gssapi/gss-ntlmssp/security/advisories/GHSA-24pf-6prf-24ch
