========================================================================== Ubuntu Security Notice USN-7588-1 June 23, 2025
gss-ntlmssp vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in GSS NTLMSSP.
Software Description:
- gss-ntlmssp: A mechglue plugin for the GSSAPI library that implements NTLM
authentication
Details:
Phil Turnbull discovered that GSS NTLMSSP may perform out-of-bounds reads
when decoding NTLM fields and target information. An attacker could
possibly use this issue to cause GSS NTLMSSP to crash, resulting in
a denial of service. (CVE-2023-25563, CVE-2023-25567)
Phil Turnbull discovered that GSS NTLMSSP did not properly initialize
memory when decoding UTF16 strings. An attacker could possibly use
this issue to trigger an out-of-bounds write, resulting in a crash.
(CVE-2023-25564)
Phil Turnbull discovered that GSS NTLMSSP did not properly handle memory
cleanup. An attacker could possibly use this issue to cause an assertion
failure, resulting in a denial of service. (CVE-2023-25565)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS
gss-ntlmssp 0.7.0-4ubuntu0.22.04.1~esm1
Available with Ubuntu Pro
Ubuntu 20.04 LTS
gss-ntlmssp 0.7.0-4ubuntu0.20.04.1~esm1
Available with Ubuntu Pro
Ubuntu 18.04 LTS
gss-ntlmssp 0.7.0-4ubuntu0.18.04.1~esm1
Available with Ubuntu Pro
Ubuntu 16.04 LTS
gss-ntlmssp 0.7.0-3~ubuntu0.16.04.1+esm1
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7588-1
CVE-2023-25563, CVE-2023-25564, CVE-2023-25565, CVE-2023-25567
signature.asc
Description: OpenPGP digital signature
