# Ubuntu security advisory addresses Debian-LAN Kerberos privilege escalation

> **Key takeaway:** Overly permissive ACLs in Debian-LAN allow authenticated users to potentially change other users' Kerberos passwords.

**Published:** 2026-11-12T21:02:18+00:00 
**Source:** Ubuntu Security & Release Notices 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/ubuntu-security-advisory-addresses-debian-lan-kerberos-privi.html 

## Summary
Ubuntu has released a security update to address a vulnerability within the Debian-LAN configuration package. The flaw stems from improperly configured Access Control Lists (ACLs) on the Kerberos administration server used in Debian-LAN environments.

This vulnerability affects users on Ubuntu 16.04 LTS. An authenticated user could exploit these permissive settings to modify the credentials of other accounts, which facilitates unauthorized privilege escalation within the network.

## Vulnerability details and mitigation
- **Defect Class:** The issue involves overly permissive Access Control Lists (ACLs) within the Kerberos admin server configuration.
- **Attack Vector:** An authenticated user can leverage the misconfiguration to perform unauthorized credential changes.
- **Impact:** Successful exploitation allows for privilege escalation by changing the passwords of other users.
- **Affected Package:** The vulnerability is contained within the debian-lan-config package, which manages FAI configuration spaces and other Debian-LAN system settings.
- **CVE Identifier:** The vulnerability is tracked under CVE-2019-3467.

## Why it matters
System administrators managing Debian-LAN environments on legacy Ubuntu 16.04 LTS systems must apply the debian-lan-config update (version 0.21ubuntu0.16.04.1~esm1) to prevent local privilege escalation. This highlights the ongoing importance of maintaining security patches for long-term support (LTS) systems through services like Ubuntu Pro.