GSS-NTLMSSP, a mechglue plugin for the GSSAPI library that implements NTLM authentication, has an out-of-bounds read when decoding target information prior to version 1.2.0. The length of the `av_pair` is not checked properly for two of the elements which can trigger an out-of-bound read. The out-of-bounds read can be triggered via the main `gss_accept_sec_context` entry point and could cause a denial-of-service if the memory is unmapped. The issue is fixed in version 1.2.0.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - GSS-NTLMSSP, a mechglue plugin for the GSSAPI library that implements NTLM authentication, has an out-of-     bounds read when decoding target information prior to version 1.2.0. The length of the `av_pair` is not     checked properly for two of the elements which can trigger an out-of-bound read. The out-of-bounds read     can be triggered via the main `gss_accept_sec_context` entry point and could cause a denial-of-service if     the memory is unmapped. The issue is fixed in version 1.2.0. (CVE-2023-25567)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2023-3097 advisory.

    - Fix CVE-2023-25563: multiple out-of-bounds read when decoding NTLM fields
    - Fix CVE-2023-25564: memory corruption when decoding UTF16 strings
    - Fix CVE-2023-25565: incorrect free when decoding target information
    - Fix CVE-2023-25566: memory leak when parsing usernames
    - Fix CVE-2023-25567: out-of-bounds read when decoding target information

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2023:3097 advisory.

  - GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to     version 1.2.0, multiple out-of-bounds reads when decoding NTLM fields can trigger a denial of service. A     32-bit integer overflow condition can lead to incorrect checks of consistency of length of internal     buffers. Although most applications will error out before accepting a singe input buffer of 4GB in length     this could theoretically happen. This vulnerability can be triggered via the main `gss_accept_sec_context`     entry point if the application allows tokens greater than 4GB in length. This can lead to a large, up to     65KB, out-of-bounds read which could cause a denial-of-service if it reads from unmapped memory. Version     1.2.0 contains a patch for the out-of-bounds reads. (CVE-2023-25563)

  - GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to     version 1.2.0, memory corruption can be triggered when decoding UTF16 strings. The variable `outlen` was     not initialized and could cause writing a zero to an arbitrary place in memory if `ntlm_str_convert()`     were to fail, which would leave `outlen` uninitialized. This can lead to a denial of service if the write     hits unmapped memory or randomly corrupts a byte in the application memory space. This vulnerability can     trigger an out-of-bounds write, leading to memory corruption. This vulnerability can be triggered via the     main `gss_accept_sec_context` entry point. This issue is fixed in version 1.2.0. (CVE-2023-25564)

  - GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to     version 1.2.0, an incorrect free when decoding target information can trigger a denial of service. The     error condition incorrectly assumes the `cb` and `sh` buffers contain a copy of the data that needs to be     freed. However, that is not the case. This vulnerability can be triggered via the main     `gss_accept_sec_context` entry point. This will likely trigger an assertion failure in `free`, causing a     denial-of-service. This issue is fixed in version 1.2.0. (CVE-2023-25565)

  - GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to     version 1.2.0, a memory leak can be triggered when parsing usernames which can trigger a denial-of-     service. The domain portion of a username may be overridden causing an allocated memory area the size of     the domain name to be leaked. An attacker can leak memory via the main `gss_accept_sec_context` entry     point, potentially causing a denial-of-service. This issue is fixed in version 1.2.0. (CVE-2023-25566)

  - GSS-NTLMSSP, a mechglue plugin for the GSSAPI library that implements NTLM authentication, has an out-of-     bounds read when decoding target information prior to version 1.2.0. The length of the `av_pair` is not     checked properly for two of the elements which can trigger an out-of-bound read. The out-of-bounds read     can be triggered via the main `gss_accept_sec_context` entry point and could cause a denial-of-service if     the memory is unmapped. The issue is fixed in version 1.2.0. (CVE-2023-25567)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:3097 advisory.

    The gssntlmssp is a GSSAPI NTLM mechanism that allows to perform NTLM authentication in GSSAPI programs.

    Security Fix(es):

    * gssntlmssp: multiple out-of-bounds read when decoding NTLM fields (CVE-2023-25563)

    * gssntlmssp: memory corruption when decoding UTF16 strings (CVE-2023-25564)

    * gssntlmssp: incorrect free when decoding target information (CVE-2023-25565)

    * gssntlmssp: memory leak when parsing usernames (CVE-2023-25566)

    * gssntlmssp: out-of-bounds read when decoding target information (CVE-2023-25567)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-cb63c0f615 advisory.

    Patched several CVEs reported by GitHub Security Lab

        CVE-2023-25563         CVE-2023-25564         CVE-2023-25565         CVE-2023-25566         CVE-2023-25567


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2023:0048-1 advisory.

  - GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to     version 1.2.0, multiple out-of-bounds reads when decoding NTLM fields can trigger a denial of service. A     32-bit integer overflow condition can lead to incorrect checks of consistency of length of internal     buffers. Although most applications will error out before accepting a singe input buffer of 4GB in length     this could theoretically happen. This vulnerability can be triggered via the main `gss_accept_sec_context`     entry point if the application allows tokens greater than 4GB in length. This can lead to a large, up to     65KB, out-of-bounds read which could cause a denial-of-service if it reads from unmapped memory. Version     1.2.0 contains a patch for the out-of-bounds reads. (CVE-2023-25563)

  - GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to     version 1.2.0, memory corruption can be triggered when decoding UTF16 strings. The variable `outlen` was     not initialized and could cause writing a zero to an arbitrary place in memory if `ntlm_str_convert()`     were to fail, which would leave `outlen` uninitialized. This can lead to a denial of service if the write     hits unmapped memory or randomly corrupts a byte in the application memory space. This vulnerability can     trigger an out-of-bounds write, leading to memory corruption. This vulnerability can be triggered via the     main `gss_accept_sec_context` entry point. This issue is fixed in version 1.2.0. (CVE-2023-25564)

  - GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to     version 1.2.0, an incorrect free when decoding target information can trigger a denial of service. The     error condition incorrectly assumes the `cb` and `sh` buffers contain a copy of the data that needs to be     freed. However, that is not the case. This vulnerability can be triggered via the main     `gss_accept_sec_context` entry point. This will likely trigger an assertion failure in `free`, causing a     denial-of-service. This issue is fixed in version 1.2.0. (CVE-2023-25565)

  - GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to     version 1.2.0, a memory leak can be triggered when parsing usernames which can trigger a denial-of-     service. The domain portion of a username may be overridden causing an allocated memory area the size of     the domain name to be leaked. An attacker can leak memory via the main `gss_accept_sec_context` entry     point, potentially causing a denial-of-service. This issue is fixed in version 1.2.0. (CVE-2023-25566)

  - GSS-NTLMSSP, a mechglue plugin for the GSSAPI library that implements NTLM authentication, has an out-of-     bounds read when decoding target information prior to version 1.2.0. The length of the `av_pair` is not     checked properly for two of the elements which can trigger an out-of-bound read. The out-of-bounds read     can be triggered via the main `gss_accept_sec_context` entry point and could cause a denial-of-service if     the memory is unmapped. The issue is fixed in version 1.2.0. (CVE-2023-25567)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
225933	Linux Distros Unpatched Vulnerability : CVE-2023-25567	Nessus	Misc.	high
176343	Oracle Linux 8 : gssntlmssp (ELSA-2023-3097)	Nessus	Oracle Linux Local Security Checks	high
176127	AlmaLinux 8 : gssntlmssp (ALSA-2023:3097)	Nessus	Alma Linux Local Security Checks	high
175842	RHEL 8 : gssntlmssp (RHSA-2023:3097)	Nessus	Red Hat Local Security Checks	high
171779	Fedora 37 : gssntlmssp (2023-cb63c0f615)	Nessus	Fedora Local Security Checks	high
171632	openSUSE 15 Security Update : gssntlmssp (openSUSE-SU-2023:0048-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2023-25567

high

Tenable Plugins

high

high

high

high

high

high