CVE-2019-3467

What it actually does

Permissive ACLs on the Kerberos admin server allow any local user to modify passwords for arbitrary Kerberos principals.

Why it matters to the business

Attackers can take over any user account including administrators, leading to full domain compromise, data theft, or ransomware deployment; the issue has been public for years with exploit code available.

How an attack unfolds

An attacker with local access on a misconfigured system uses the kadmin tool or equivalent to issue password change requests for other principals; the overly broad ACLs permit the operation without further authentication checks.

How to fix it

Upgrade debian-edu-config to version 2.11.10 or later and debian-lan-config to 0.26 or later; verify and tighten Kerberos admin ACLs after upgrade.

How to confirm the fix worked

Confirm package versions meet or exceed the fixed releases and audit kadmin.acl or equivalent files for overly permissive entries such as wildcard principals.

Typical attack path

1. Obtain local shell access on an affected Debian Edu or LAN system
2. Identify the permissive kadmin ACL configuration
3. Issue password change commands targeting other Kerberos principals
4. Escalate to domain admin accounts and move laterally

How to detect it

Search Kerberos admin server logs for password change requests originating from non-admin principals or unexpected source users; review historical kadmin command history on systems that may have been vulnerable.

• kadmin: change_password
• unauthorized principal password modification
• /etc/krb5kdc/kadm5.acl containing wildcard entries

What your security team should do

• Immediately upgrade affected packages to the fixed versions
• Review and restrict Kerberos admin ACLs to least privilege
• Monitor for anomalous password change attempts in Kerberos logs
• Harden local access controls to reduce initial foothold risk