Module Name: src
Committed By: christos
Date: Tue Jul 11 17:45:32 UTC 2017
Modified Files:
src/crypto/external/bsd/heimdal/dist/lib/krb5: ticket.c
Log Message:
https://orpheus-lyre.info/design/index.html
https://github.com/heimdal/heimdal/commit/6dd3eb836bbb80a00ffced4ad57077a1cdf227ea
In _krb5_extract_ticket() the KDC-REP service name must be obtained from
encrypted version stored in 'enc_part' instead of the unencrypted version
stored in 'ticket'. Use of the unecrypted version provides an
opportunity for successful server impersonation and other attacks.
Identified by Jeffrey Altman, Viktor Duchovni and Nico Williams.
XXX: pullup 6, 7, 8.
To generate a diff of this commit:
cvs rdiff -u -r1.2 -r1.3 \
src/crypto/external/bsd/heimdal/dist/lib/krb5/ticket.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/crypto/external/bsd/heimdal/dist/lib/krb5/ticket.c
diff -u src/crypto/external/bsd/heimdal/dist/lib/krb5/ticket.c:1.2 src/crypto/external/bsd/heimdal/dist/lib/krb5/ticket.c:1.3
--- src/crypto/external/bsd/heimdal/dist/lib/krb5/ticket.c:1.2 Sat Jan 28 16:31:49 2017
+++ src/crypto/external/bsd/heimdal/dist/lib/krb5/ticket.c Tue Jul 11 13:45:31 2017
@@ -1,4 +1,4 @@
-/* $NetBSD: ticket.c,v 1.2 2017/01/28 21:31:49 christos Exp $ */
+/* $NetBSD: ticket.c,v 1.3 2017/07/11 17:45:31 christos Exp $ */
/*
* Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan
@@ -707,8 +707,8 @@ _krb5_extract_ticket(krb5_context contex
/* check server referral and save principal */
ret = _krb5_principalname2krb5_principal (context,
&tmp_principal,
- rep->kdc_rep.ticket.sname,
- rep->kdc_rep.ticket.realm);
+ rep->enc_part.sname,
+ rep->enc_part.realm);
if (ret)
goto out;
if((flags & EXTRACT_TICKET_ALLOW_SERVER_MISMATCH) == 0){
