CVE-2023-25567

GSS-NTLMSSP, a mechglue plugin for the GSSAPI library that implements NTLM authentication, has an out-of-bounds read when decoding target information prior to version 1.2.0. The length of the av_pair is not checked properly for two of the elements which can trigger an out-of-bound read. The out-of-bounds read can be triggered via the main gss_accept_sec_context entry point and could cause a denial-of-service if the memory is unmapped. The issue is fixed in version 1.2.0.

References

Affected packages

Git / github.com/gssapi/gss-ntlmssp

Affected ranges

Type: GIT
Repo: https://github.com/gssapi/gss-ntlmssp
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

025fbb756d44ffee8f847db4222ed6aa4bd1fbe4

Fixed

3c3077e2a24b47db1b4c459fb3173ba7f75b9b44

Affected versions

0.*

0.8.0

v0.*

v0.1.0

v0.2.0

v0.3.0

v0.3.1

v0.4.0

v0.5.0

v0.6.0

v0.7.0

v0.8.0

v0.9.0

v1.*

v1.0.0

v1.1.0

Database specific

{
    "vanir_signatures": [
        {
            "digest": {
                "function_hash": "295931300105472389840611522012945909811",
                "length": 2614.0
            },
            "id": "CVE-2023-25567-20ca4e83",
            "source": "https://github.com/gssapi/gss-ntlmssp/commit/025fbb756d44ffee8f847db4222ed6aa4bd1fbe4",
            "signature_type": "Function",
            "signature_version": "v1",
            "target": {
                "file": "src/ntlm.c",
                "function": "ntlm_decode_target_info"
            },
            "deprecated": false
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "329743560795464476895232845368295987571",
                    "48100070528925819657576299319623394864",
                    "303437604845121147420625571195586538457",
                    "46502789084243232481075414645123473400",
                    "70834396620221594922657795775309503399",
                    "265237019340786180551472604632610818336",
                    "81799710271861100236197808039689992782",
                    "31764002907565967064075017503913859348",
                    "104704938735519366560627176038904399139"
                ]
            },
            "id": "CVE-2023-25567-9b1bb4a1",
            "source": "https://github.com/gssapi/gss-ntlmssp/commit/025fbb756d44ffee8f847db4222ed6aa4bd1fbe4",
            "signature_type": "Line",
            "signature_version": "v1",
            "target": {
                "file": "src/ntlm.c"
            },
            "deprecated": false
        }
    ]
}