F5 BIG-IP Found Vulnerable to Kerberos KDC Spoofing Vulnerability

Cybersecurity researchers on Wednesday disclosed a new bypass
vulnerability in the Kerberos Key Distribution Center (KDC)
security feature impacting F5 Big-IP application delivery
services.

“The KDC Spoofing vulnerability allows an attacker to bypass the
Kerberos authentication to Big-IP Access Policy Manager (APM),
bypass security policies and gain unfettered access to sensitive
workloads,” Silverfort researchers Yaron Kassner and Rotem Zach
said in a report. “In some cases this can be used to bypass
authentication to the Big-IP admin console as well.”

Coinciding with the public disclosure, F5 has released a patch
to address the weakness.

Kerberos^[1]
is an authentication protocol that relies on a client-server model
for mutual authentication and requires a trusted intermediary
called Key Distribution Center (KDC^[2]) — a Kerberos
Authentication Server (AS) or a Ticket Granting Server in this case
— that acts as a repository of shared secret keys of all users as
well as information about which users have access privileges to
which services on which network servers.

Thus when a user, say Alice, wants to access a particular
service on a server (Bob), Alice is prompted to provide her
username and password to verify her identity, after which the AS
checks if Alice has access privileges to Bob, and if so, issue a
“ticket” permitting the user to use the service until its
expiration time.

Also essential as part of the process is the authentication of
KDC to the server, in the absence of which the security of the
Kerberos gets compromised, thus allowing an attacker that has the
ability to hijack the network communication between Big-IP and the
domain controller (which is the KDC) to sidestep the authentication
entirely.

and the domain controller (which is the KDC) to sidestep the
authentication entirely.

In a nutshell, the idea is that when the Kerberos protocol is
implemented the right way, an adversary attempting to impersonate
the KDC cannot bypass the authentication protections. The spoofing
attack, therefore, hinges on the possibility that there exist
insecure Kerberos configurations so as to hijack the communication
between the client and the domain controller, leveraging it to
create a fraudulent KDC that diverts the traffic intended for the
controller to the fake KDC, and subsequently authenticate itself to
the client.

This is the fourth such spoofing flaw uncovered by Silverfort
after discovering similar issues in Cisco ASA (CVE-2020-3125^[3]), Palo Alto Networks
PAN-OS (CVE-2020-2002^[4]), and IBM QRadar
(CVE-2019-4545^[5]) last year.