mirror of
https://abf.rosa.ru/djam/samba.git
synced 2025-02-23 17:12:48 +00:00
45 lines
1.7 KiB
Diff
45 lines
1.7 KiB
Diff
From 3799a32e41134a2dff797ebeacf5abdb8d332e6e Mon Sep 17 00:00:00 2001
|
|
From: Jeffrey Altman <jaltman@secure-endpoints.com>
|
|
Date: Wed, 12 Apr 2017 15:40:42 -0400
|
|
Subject: [PATCH] CVE-2017-11103: Orpheus' Lyre KDC-REP service name validation
|
|
|
|
In _krb5_extract_ticket() the KDC-REP service name must be obtained from
|
|
encrypted version stored in 'enc_part' instead of the unencrypted version
|
|
stored in 'ticket'. Use of the unecrypted version provides an
|
|
opportunity for successful server impersonation and other attacks.
|
|
|
|
Identified by Jeffrey Altman, Viktor Duchovni and Nico Williams.
|
|
|
|
Change-Id: I45ef61e8a46e0f6588d64b5bd572a24c7432547c
|
|
|
|
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12894
|
|
(based on heimdal commit 6dd3eb836bbb80a00ffced4ad57077a1cdf227ea)
|
|
|
|
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
|
|
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
|
|
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
|
|
|
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
|
|
Autobuild-Date(master): Wed Jul 12 17:44:50 CEST 2017 on sn-devel-144
|
|
---
|
|
source4/heimdal/lib/krb5/ticket.c | 4 ++--
|
|
1 file changed, 2 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/source4/heimdal/lib/krb5/ticket.c b/source4/heimdal/lib/krb5/ticket.c
|
|
index 064bbfb..5a317c7 100644
|
|
--- a/source4/heimdal/lib/krb5/ticket.c
|
|
+++ b/source4/heimdal/lib/krb5/ticket.c
|
|
@@ -641,8 +641,8 @@ _krb5_extract_ticket(krb5_context context,
|
|
/* check server referral and save principal */
|
|
ret = _krb5_principalname2krb5_principal (context,
|
|
&tmp_principal,
|
|
- rep->kdc_rep.ticket.sname,
|
|
- rep->kdc_rep.ticket.realm);
|
|
+ rep->enc_part.sname,
|
|
+ rep->enc_part.srealm);
|
|
if (ret)
|
|
goto out;
|
|
if((flags & EXTRACT_TICKET_ALLOW_SERVER_MISMATCH) == 0){
|
|
--
|
|
2.7.4
|
|
|