Impact

Two vulnerabilities were identified in Himmelblau versions 0.7.0 through 0.8.2:

1. Logon Compliance Script Issue: When debug logging is enabled, user access tokens are inadvertently logged, potentially exposing sensitive authentication data.
2. Kerberos CCache Issue: Similarly, Kerberos Ticket-Granting Tickets (TGTs) are logged when debug logging is enabled.

Both issues pose a risk of exposing sensitive credentials, particularly in environments where debug logging is enabled. Both issues are caused by the same underlying issue, and are resolved with a single patch.

Patches

The vulnerabilities have been addressed in Himmelblau version 0.8.3. All users are strongly encouraged to update to this version.

Workarounds

Users unable to update immediately can apply the following mitigations:

1. For the logon compliance script issue, disable the logon_script option in /etc/himmelblau/himmelblau.conf:

   logon_script = 

   Ensure the debug option in the same configuration file is set to false:

   debug = false

   Additionally, avoid using the -d flag when starting the himmelblaud daemon.

2. For the Kerberos CCache issue, disable debug logging globally by:

   • Setting the debug option in /etc/himmelblau/himmelblau.conf to false.
   • Avoiding the -d parameter when starting himmelblaud.

References

• Himmelblau Configuration Documentation
• himmelblau.conf man page
• Himmelblau Daemon man page
• Official Himmelblau Release Notes and Updates