Cy Schubert 813847e49e pam_krb5: Fix spoofing vulnerability ... An adversary on the network can log in via ssh as any user by spoofing the KDC. When the machine has a keytab installed the keytab is used to verify the service ticket. However, without a keytab there is no way for pam_krb5 to verify the KDC's response and get a TGT with the password. If both the password _and_ the KDC are controlled by an adversary, the adversary can provide a password that the adversary's spoofed KDC will return a valid tgt for. Currently, without a keytab, pam_krb5 is vulnerable to this attack. Reported by: Taylor R Campbell <riastradh@netbsd.org> via emaste@ Reviewed by: so Approved by: so Security: FreeBSD-SA-23:04.pam_krb5 Security: CVE-2023-3326		2023-06-20 22:19:47 -07:00
..
libpam	spdx: The BSD-2-Clause-FreeBSD identifier is obsolete, drop -FreeBSD	2023-05-12 10:44:03 -06:00
modules	pam_krb5: Fix spoofing vulnerability	2023-06-20 22:19:47 -07:00
pam.d	pam.d: install hard link with same mode as target	2022-11-24 08:14:44 -05:00
static_libpam	Put OPIE to rest.	2022-10-02 03:37:29 +02:00
Makefile	Move all pam related config to lib/libpam/	2018-09-13 04:08:48 +00:00
Makefile.inc	Replace _pam_verbose_error() with a macro. This was the last difference	2016-06-08 11:47:19 +00:00