CVE-2024-37370
📋 TL;DR
This vulnerability in MIT Kerberos 5 allows attackers to modify the plaintext Extra Count field in GSS krb5 wrap tokens, causing applications to receive truncated unwrapped tokens. This affects all systems using vulnerable versions of MIT Kerberos 5 (krb5) for authentication. The manipulation can lead to authentication bypass or denial of service.
💻 Affected Systems
- MIT Kerberos 5 (krb5)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Authentication bypass allowing unauthorized access to protected resources or services that rely on Kerberos authentication.
Likely Case
Denial of service where applications fail to properly process truncated tokens, disrupting authentication flows.
If Mitigated
Limited impact if token integrity validation is enforced elsewhere in the application stack.
🎯 Exploit Status
Exploitation requires ability to intercept and modify Kerberos tokens in transit, typically requiring some level of network access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.21.3 and later
Vendor Advisory: https://web.mit.edu/kerberos/www/advisories/
Restart Required: Yes
Instructions:
1. Download krb5 1.21.3 or later from MIT Kerberos website. 2. Compile and install according to platform instructions. 3. Restart all services using Kerberos libraries.
🔧 Temporary Workarounds
Disable GSS krb5 wrap token confidentiality
allConfigure applications to not use confidentiality mode for GSS krb5 wrap tokens
Application-specific configuration changes required
🧯 If You Can't Patch
- Implement network segmentation to restrict access to Kerberos services
- Monitor for unusual authentication patterns or token manipulation attempts
🔍 How to Verify
Check if Vulnerable:
Check krb5 version with: krb5-config --version or strings /path/to/libkrb5.so | grep krb5-1.Check Version:
krb5-config --version 2>/dev/null || strings /usr/lib*/libkrb5.so* 2>/dev/null | grep 'krb5-1\.[0-9]' | head -1Verify Fix Applied:
Verify installed version is 1.21.3 or higher using same version check commands📡 Detection & Monitoring
Log Indicators:
- Failed GSS authentication attempts
- Unexpected token length errors in application logs
- Kerberos KDC error logs showing malformed tokens
Network Indicators:
- Unusual Kerberos traffic patterns
- Modified GSS tokens in network captures
SIEM Query:
source="kerberos_logs" AND (error OR failed OR malformed) AND token🔗 References
- https://github.com/krb5/krb5/commit/55fbf435edbe2e92dd8101669b1ce7144bc96fef
- https://web.mit.edu/kerberos/www/advisories/
- https://github.com/krb5/krb5/commit/55fbf435edbe2e92dd8101669b1ce7144bc96fef
- https://security.netapp.com/advisory/ntap-20241108-0007/
- https://web.mit.edu/kerberos/www/advisories/
