Security Update to disable keytab in JAAS login configuration for Basic authentication (MINDBREEZE29751)

ID: MINDBREEZE29751 
Affected Components: Mindbreeze InSpire G7 with active Kerberos client authentication 
Severity: Critical 
Status: Final 
First published: December 18, 2023 
CVEs: MINDBREEZE29751 

Summary

A configuration issue in the default JAAS login configuration uses the Client Service keytab in the Basic authentication fallback LoginContext. The keytab is configured per Client Service in the Mindbreeze configuration, and shall be a unprivileged service account to validate the integrated authentication via a service principal name of the form "HTTP/<FQHN>". The effect is that the password validation for this particular service user is disabled, if the keytab in addition to the service principal name SPN (HTTP/<FQHN>) also contains the effective user principal name (UPN). 

 

Security Impact 

In Basic authentication the password of the user matching the service username of the Client Service keytab is not validated, if the keytab contains the proper username in addition to the service principal name (SPN). 

 

Hotfix Information

Fixed with following versions of Mindbreeze InSpire On-Premises: 

  • Mindbreeze InSpire 23.6 HF3 Release