CVE-2014-5351

What it actually does

The kadm5_randkey_principal_3 function in kadmind returns previously used keys when processing -randkey -keepold requests, allowing an authenticated administrator to obtain key material that can be used to forge valid Kerberos tickets.

Why it matters to the business

Compromised Kerberos keys enable attackers to impersonate any principal, resulting in unauthorized access to services, data, and systems that rely on Kerberos authentication across the environment.

How an attack unfolds

An attacker who already possesses administrative Kerberos privileges issues a specially crafted randkey request that includes the keepold flag; the server responds with both new and old keys; the attacker extracts the old keys and uses them to construct forged tickets that authenticate as other principals.

How to fix it

Upgrade MIT Kerberos 5 (krb5) to version 1.13 or later, which corrects the key-handling behavior in kadm5_randkey_principal_3.

How to confirm the fix worked

Confirm that kadmind is running a version 1.13 or newer; attempt a -randkey -keepold operation from an administrative account and verify that old keys are no longer returned in the response.

Typical attack path

1. Obtain administrative access to the Kerberos realm
2. Connect to kadmind and issue a randkey principal request with the keepold option
3. Capture the response containing previously used keys
4. Use extracted keys to generate valid ticket-granting tickets for arbitrary principals
5. Use forged tickets to access protected services and resources

How to detect it

Examine kadmind audit logs and network captures for randkey requests containing the keepold flag; look for administrative principals issuing repeated or unexpected key-change operations.

What your security team should do

• Immediately upgrade all krb5 installations to 1.13 or later
• Restrict administrative access to kadmind to the smallest possible set of trusted principals
• Review and rotate any long-lived Kerberos keys that may have been exposed
• Monitor administrative key-management operations for anomalies