CVE-2015-3206 python-kerberos vulnerable to KDC spoofing attacks
Remote attackers can cause denial of service or bypass authentication via man-in-the-middle attacks due to lack of KDC authentication in python-kerberos.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-3206?
CVE-2015-3206 is a high-severity authentication bypass vulnerability in n/a, published on 25 Aug 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The checkPassword function in python-kerberos does not authenticate the KDC it attempts to communicate with, which allows remote attackers to cause a denial of service (bad response), or have other unspecified impact by performing a man-in-the-middle attack.
Weakness: CWE-287
Which versions are affected by CVE-2015-3206?
6 open source packages ship an affected version, including kerberos and pykerberos. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
kerberos PyPI | All versions to 1.2.5 | None |
kerberos PyPI | All versions to 1.2.5 | None |
kerberos PyPI | From 0.0 | None |
pykerberos PyPI | All versions | 1.1.6 |
pykerberos PyPI | All versions | 1.1.6 |
pykerberos PyPI | All versions | 1.1.6 |
Products include Apple Pykerberos.
How do I fix CVE-2015-3206?
Apply the vendor's patch.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2015-3206 being exploited?
There is no known exploitation of CVE-2015-3206 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2015-3206, DLA-265-1, DLA-265-2, GHSA-mffc-9gx5-99g3, PYSEC-2017-49, PYSEC-2017-66.