Ubuntu alert USN-7588-1 (gss-ntlmssp)

From:
             
 
noreply+usn-bot@canonical.com
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-7588-1] GSS NTLMSSP vulnerabilities
Date:
             
 
Mon, 23 Jun 2025 14:27:04 +0000
Message-ID:
             
 
<E1uTi8W-0007nu-AN@lists.ubuntu.com>
==========================================================================
Ubuntu Security Notice USN-7588-1
June 23, 2025

gss-ntlmssp vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in GSS NTLMSSP.

Software Description:
- gss-ntlmssp: A mechglue plugin for the GSSAPI library that implements NTLM authentication

Details:

Phil Turnbull discovered that GSS NTLMSSP may perform out-of-bounds reads 
when decoding NTLM fields and target information. An attacker could 
possibly use this issue to cause GSS NTLMSSP to crash, resulting in 
a denial of service. (CVE-2023-25563, CVE-2023-25567)

Phil Turnbull discovered that GSS NTLMSSP did not properly initialize
memory when decoding UTF16 strings. An attacker could possibly use 
this issue to trigger an out-of-bounds write, resulting in a crash.
(CVE-2023-25564)

Phil Turnbull discovered that GSS NTLMSSP did not properly handle memory
cleanup. An attacker could possibly use this issue to cause an assertion
failure, resulting in a denial of service. (CVE-2023-25565)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS
  gss-ntlmssp                     0.7.0-4ubuntu0.22.04.1~esm1
                                  Available with Ubuntu Pro

Ubuntu 20.04 LTS
  gss-ntlmssp                     0.7.0-4ubuntu0.20.04.1~esm1
                                  Available with Ubuntu Pro

Ubuntu 18.04 LTS
  gss-ntlmssp                     0.7.0-4ubuntu0.18.04.1~esm1
                                  Available with Ubuntu Pro

Ubuntu 16.04 LTS
  gss-ntlmssp                     0.7.0-3~ubuntu0.16.04.1+esm1
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-7588-1
  CVE-2023-25563, CVE-2023-25564, CVE-2023-25565, CVE-2023-25567


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmhZZB8ACgkQcpJm3tlz
hgHkCRAAlQ947ANd1ELo2qkVAXQS/gppWULiQOK0TIZhF1Y+gyUgfouunU4KM9U9
rsPFMiLjQqOSGlskJo4RZsjNUHVngaG/jU3E/s8FIjhrsBQ1tohhAqqtf08ltdd5
TjIIfg6ECPF8xxVaqhxtdcfjAoM3mV1p4xNgpNmFs5X6I8pIuj20yIXxeZYyqYPR
7gj5xEne91Mv66XFOo/mJy0VLsWoI4DtdpIFr1Wa2cJ+L8S8EVZIGsYggY9R8MbE
MeZwE5aNhiSf1gvZZqGZWPcrzrsglkM5miyPKM7EO3n3Hw6J0LMsrSVuylycrnM2
8EaKI3aCJOzV/cJYoA4djNEL9pdoJ5PObxp1+i4enMJTMGN0OsA3trFgYbj//zbJ
Yofxf7QutlWxwJZJTZCSKrmIdNiQtpnrTRaRJhWpBvyCBC1yx6rYDpQet7KIJoxw
q6XDvNSjxTxAWtO7m1N4R7lI+8eWLeH96zFufQ3qL/oRnrQpZlz6y+rzXpz3tGZd
FAfQ0XR7Ebb9SAOzyty6EHEf0cNDAEpbcVZwtjTnXIhX8Tk8AFRcdB2v6PvFZcAC
CKRBzHQLtlBEakT/lYOuAm6VapJSMCJTdW9ClNmahtyJYwAI0htTIwUkqO2Yusb0
m/fFFjPXTcOUFxVrBYYDsdmfWqLYOaymIQwloRn0ZfQ6klx+FjA=
=nRXF
-----END PGP SIGNATURE-----