Home / Security / Advisories / NTAP-20230216-0008

NTAP-20230216-0008 — December 2022 Heimdal Vulnerabilities in NetApp Products

Published 2023-02-16 · Updated 2024-01-24 · Status: Final · Exploitation: Public · Severity: CRITICAL 9.8 · ONTAP affected: Yes

Official advisory: NTAP-20230216-0008 on security.netapp.com ↗. Affected versions, fixed releases, and workarounds live there — this page is a summary.

Product family: SolidFire / NetApp HCI · E-Series / SANtricity · ONTAP | ONTAP-relevant | highest CVSS: 9.8

CVEs in this advisory

CVE-2022-42898 — HIGH · CVSS 8.8 · site index
CVE-2022-3437 — MEDIUM · CVSS 6.5 · site index
CVE-2022-41916 — MEDIUM · CVSS 5.9 · site index
CVE-2021-44758 — HIGH · CVSS 7.5 · site index
CVE-2021-3671 — MEDIUM · CVSS 6.5 · site index
CVE-2022-44640 — CRITICAL · CVSS 9.8 · site index
CVE-2019-14870 — MEDIUM · CVSS 5.4 · site index

What the CVE records say

CVE-2022-42898 — PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has "a similar bug."

CVE-2022-3437 — A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap_des() and unwrap_des3() routines of Heimdal. The DES and Triple-DES decryption routines in the Heimdal GSSAPI library allow a length-limited write buffer overflow on malloc() allocated memory when presented with a maliciously small packet. This flaw allows a remote user to send specially crafted malicious data to the application, possibly resulting in a denial of service (DoS) attack.

CVE-2022-41916 — Heimdal is an implementation of ASN.1/DER, PKIX, and Kerberos. Versions prior to 7.7.1 are vulnerable to a denial of service vulnerability in Heimdal's PKI certificate validation library, affecting the KDC (via PKINIT) and kinit (via PKINIT), as well as any third-party applications using Heimdal's libhx509. Users should upgrade to Heimdal 7.7.1 or 7.8. There are no known workarounds for this issue.

CVE-2021-44758 — Heimdal before 7.7.1 allows attackers to cause a NULL pointer dereference in a SPNEGO acceptor via a preferred_mech_type of GSS_C_NO_OID and a nonzero initial_response value to send_accept.

CVE-2021-3671 — A null pointer de-reference was found in the way samba kerberos server handled missing sname in TGS-REQ (Ticket Granting Server - Request). An authenticated user could use this flaw to crash the samba server.

CVE-2022-44640 — Heimdal before 7.7.1 allows remote attackers to execute arbitrary code because of an invalid free in the ASN.1 codec used by the Key Distribution Center (KDC).

CVE-2019-14870 — All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the S4U (MS-SFU) Kerberos delegation model includes a feature allowing for a subset of clients to be opted out of constrained delegation in any way, either S4U2Self or regular Kerberos authentication, by forcing all tickets for these clients to be non-forwardable. In AD this is implemented by a user attribute delegation_not_allowed (aka not-delegated), which translates to disallow-forwardable. However the Samba AD DC does not do that for S4U2Self and does set the forwardable flag even if the impersonated client has the not-delegated flag set.

Impact

Successful exploitation of these vulnerabilities could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS). <br><br> ONTAP Select Deploy administration utility:<br> Affected by only CVE-2022-42898.

Affected products

Management Services for Element Software and NetApp HCI
NetApp E-Series Performance Analyzer
ONTAP Select Deploy administration utility

Official fixes

Management Services for Element Software and NetApp HCI — vendor fix ↗
ONTAP Select Deploy administration utility — vendor fix ↗

References

https://github.com/heimdal/heimdal/releases/tag/heimdal-7.7.1 ↗

What to do

Check the affected products listed above against the official advisory's affected-versions table — that is where the exact ONTAP 9 release, ONTAP tool, or management product versions are named.
If affected and a fixed release exists, plan the upgrade — see the ONTAP upgrade runbook.
If exploitation is listed as "active", treat remediation as urgent and review exposure (management LIFs, ONTAP S3, SnapMirror endpoints).
Harden in parallel: security hardening baseline and ransomware protection on ONTAP.