1. Ubuntu Security Notices
  2. USN-7257-1

USN-7257-1: Kerberos vulnerability

Publication date

5 February 2025

Overview

A system authentication measure could be bypassed.

Releases

Packages

  • krb5 - MIT Kerberos Network Authentication Protocol

Details

Goldberg, Miro Haller, Nadia Heninger, Mike Milano, Dan Shumow, Marc
Stevens, and Adam Suhl discovered that Kerberos incorrectly authenticated
certain responses. An attacker able to intercept communications between a
RADIUS client and server could possibly use this issue to forge responses,
bypass authentication, and access network devices and services.

This update introduces support for the Message-Authenticator attribute in
non-EAP authentication methods for communications between Kerberos and a
RADIUS server.

Goldberg, Miro Haller, Nadia Heninger, Mike Milano, Dan Shumow, Marc
Stevens, and Adam Suhl discovered that Kerberos incorrectly authenticated
certain responses. An attacker able to intercept communications between a
RADIUS client and server could possibly use this issue to forge responses,
bypass authentication, and access network devices and services.

This update introduces support for the Message-Authenticator attribute in
non-EAP authentication methods for communications between Kerberos and a
RADIUS server.

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
24.10 oracular libk5crypto3 –  1.21.3-3ubuntu0.1
libkrad0 –  1.21.3-3ubuntu0.1
24.04 noble libk5crypto3 –  1.20.1-6ubuntu2.3
libkrad0 –  1.20.1-6ubuntu2.3
22.04 jammy libk5crypto3 –  1.19.2-2ubuntu0.5
libkrad0 –  1.19.2-2ubuntu0.5
20.04 focal libk5crypto3 –  1.17-6ubuntu4.8
libkrad0 –  1.17-6ubuntu4.8
18.04 bionic libk5crypto3 –  1.16-2ubuntu0.4+esm3  
libkrad0 –  1.16-2ubuntu0.4+esm3  
16.04 xenial libk5crypto3 –  1.13.2+dfsg-5ubuntu2.2+esm6  
libkrad0 –  1.13.2+dfsg-5ubuntu2.2+esm6  
14.04 trusty libk5crypto3 –  1.12+dfsg-2ubuntu5.4+esm6  
libkrad0 –  1.12+dfsg-2ubuntu5.4+esm6  

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Have additional questions?

Talk to a member of the team ›