Ubuntu Xenial: Update Debian-LAN to address Kerberos password-change risk

CVE-2019-3467

Ubuntu Xenial is affected by CVE-2019-3467 in Debian-LAN configuration: an authenticated user could change another user’s Kerberos credentials and escalate privileges. Check the debian-lan-config package and update to the fixed version in the esm-apps-legacy pocket.

Ubuntu Xenial: Update Debian-LAN to address Kerberos password-change risk

At a glance
CVE-2019-3467 affects Debian-LAN configuration on Ubuntu Xenial.
An authenticated user could change another user’s Kerberos credentials, leading to privilege escalation.
Check the debian-lan-config package and install the fix from the esm-apps-legacy pocket.

In this article

Ubuntu has published USN-9068-1 for CVE-2019-3467 in Debian-LAN on Ubuntu Xenial. Administrators should check the debian-lan-config package version and update according to the official Ubuntu notice.

Overview and technical details

Field	Details
Product	Debian-LAN, the Debian-LAN configuration component on Ubuntu Xenial
CVE	CVE-2019-3467
Source	Ubuntu USN-9068-1

Affected systems

Product	Package and fixed version	Pocket
Ubuntu Xenial	`debian-lan-config` 0.21ubuntu0.16.04.1~esm1	`esm-apps-legacy`

Systems need access to the esm-apps-legacy pocket to receive the fixed version. Version 0.21ubuntu0.16.04.1~esm1 or later meets the fixed version specified in the notice; earlier versions need updating.

Mechanism and impact

Debian-LAN configures overly permissive ACLs for the Kerberos administration server. An authenticated user could change another user’s credentials, resulting in privilege escalation.

System checks

Check the installed debian-lan-config package version on Ubuntu Xenial:
```
dpkg-query -W -f='${Version}\n' debian-lan-config
apt-cache policy debian-lan-config
pro status
```
Version 0.21ubuntu0.16.04.1~esm1 or later meets the fixed version specified in the notice; earlier versions need updating.

Remediation and mitigation

Prioritize updating Ubuntu Xenial to address the privilege-escalation risk.
Canonical recommends performing a standard system update to apply the necessary changes. The fixed version of debian-lan-config is 0.21ubuntu0.16.04.1~esm1 in the esm-apps-legacy pocket; systems need access to this pocket to receive the update.