[Pkg-samba-maint] [samba] 01/03: CVE-2017-11103: Orpheus' Lyre KDC-REP service name validation

Mathieu Parent sathieu at moszumanska.debian.org
Thu Jul 13 13:02:21 UTC 2017

This is an automated email from the git hooks/post-receive script.

sathieu pushed a commit to branch jessie
in repository samba.

commit 0504a8b49e0953593c9e4192bd2e76dbc62bc422
Author: Jeffrey Altman <jaltman at secure-endpoints.com>
Date:   Wed Apr 12 15:40:42 2017 -0400

    CVE-2017-11103: Orpheus' Lyre KDC-REP service name validation
    In _krb5_extract_ticket() the KDC-REP service name must be obtained from
    encrypted version stored in 'enc_part' instead of the unencrypted version
    stored in 'ticket'.  Use of the unecrypted version provides an
    opportunity for successful server impersonation and other attacks.
    Identified by Jeffrey Altman, Viktor Duchovni and Nico Williams.
    Change-Id: I45ef61e8a46e0f6588d64b5bd572a24c7432547c
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=12894
    (based on heimdal commit 6dd3eb836bbb80a00ffced4ad57077a1cdf227ea)
    Signed-off-by: Andrew Bartlett <abartlet at samba.org>
    Reviewed-by: Garming Sam <garming at catalyst.net.nz>
    Reviewed-by: Stefan Metzmacher <metze at samba.org>
    (cherry picked from commit fd4c30bf5266b0d3a8c9cb3a6ac44d4f7ee3ac75)
 source4/heimdal/lib/krb5/ticket.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/source4/heimdal/lib/krb5/ticket.c b/source4/heimdal/lib/krb5/ticket.c
index 09bff30..60815b7 100644
--- a/source4/heimdal/lib/krb5/ticket.c
+++ b/source4/heimdal/lib/krb5/ticket.c
@@ -722,8 +722,8 @@ _krb5_extract_ticket(krb5_context context,
     /* check server referral and save principal */
     ret = _krb5_principalname2krb5_principal (context,
-					      rep->kdc_rep.ticket.sname,
-					      rep->kdc_rep.ticket.realm);
+					      rep->enc_part.sname,
+					      rep->enc_part.srealm);
     if (ret)
 	goto out;

Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-samba/samba.git

More information about the Pkg-samba-maint mailing list