[Pkg-samba-maint] [samba] 03/12: Remove CVE-2017-11103-Orpheus-Lyre-KDC-REP-service-name-val.patch and CVE-2017-7494.patch, merged

[Mathieu Parent]

This is an automated email from the git hooks/post-receive script.

sathieu pushed a commit to branch stretch
in repository samba.

commit 6fe24ea84807cb78396a98ee6a498b080a7379a8
Author: Mathieu Parent <math.parent at gmail.com>
Date:   Thu Jul 27 12:03:09 2017 +0200

    Remove CVE-2017-11103-Orpheus-Lyre-KDC-REP-service-name-val.patch and CVE-2017-7494.patch, merged
---
 ...103-Orpheus-Lyre-KDC-REP-service-name-val.patch | 42 ----------------------
 debian/patches/CVE-2017-7494.patch                 | 33 -----------------
 debian/patches/series                              |  2 --
 3 files changed, 77 deletions(-)

diff --git a/debian/patches/CVE-2017-11103-Orpheus-Lyre-KDC-REP-service-name-val.patch b/debian/patches/CVE-2017-11103-Orpheus-Lyre-KDC-REP-service-name-val.patch
deleted file mode 100644
index ff665e6..0000000
--- a/debian/patches/CVE-2017-11103-Orpheus-Lyre-KDC-REP-service-name-val.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From 229735bf7dc2ec1ce7e6074491f151784f46e7de Mon Sep 17 00:00:00 2001
-From: Jeffrey Altman <jaltman at secure-endpoints.com>
-Date: Wed, 12 Apr 2017 15:40:42 -0400
-Subject: [PATCH] CVE-2017-11103: Orpheus' Lyre KDC-REP service name validation
-
-In _krb5_extract_ticket() the KDC-REP service name must be obtained from
-encrypted version stored in 'enc_part' instead of the unencrypted version
-stored in 'ticket'.  Use of the unecrypted version provides an
-opportunity for successful server impersonation and other attacks.
-
-Identified by Jeffrey Altman, Viktor Duchovni and Nico Williams.
-
-Change-Id: I45ef61e8a46e0f6588d64b5bd572a24c7432547c
-
-BUG: https://bugzilla.samba.org/show_bug.cgi?id=12894
-(based on heimdal commit 6dd3eb836bbb80a00ffced4ad57077a1cdf227ea)
-
-Signed-off-by: Andrew Bartlett <abartlet at samba.org>
-Reviewed-by: Garming Sam <garming at catalyst.net.nz>
-Reviewed-by: Stefan Metzmacher <metze at samba.org>
----
- source4/heimdal/lib/krb5/ticket.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/source4/heimdal/lib/krb5/ticket.c b/source4/heimdal/lib/krb5/ticket.c
-index 064bbfbb33c..5a317c7b971 100644
---- a/source4/heimdal/lib/krb5/ticket.c
-+++ b/source4/heimdal/lib/krb5/ticket.c
-@@ -641,8 +641,8 @@ _krb5_extract_ticket(krb5_context context,
-     /* check server referral and save principal */
-     ret = _krb5_principalname2krb5_principal (context,
- 					      &tmp_principal,
--					      rep->kdc_rep.ticket.sname,
--					      rep->kdc_rep.ticket.realm);
-+					      rep->enc_part.sname,
-+					      rep->enc_part.srealm);
-     if (ret)
- 	goto out;
-     if((flags & EXTRACT_TICKET_ALLOW_SERVER_MISMATCH) == 0){
--- 
-2.13.2
-
diff --git a/debian/patches/CVE-2017-7494.patch b/debian/patches/CVE-2017-7494.patch
deleted file mode 100644
index 0e7dd8e..0000000
--- a/debian/patches/CVE-2017-7494.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From d2bc9f3afe23ee04d237ae9f4511fbe59a27ff54 Mon Sep 17 00:00:00 2001
-From: Volker Lendecke <vl at samba.org>
-Date: Mon, 8 May 2017 21:40:40 +0200
-Subject: [PATCH] CVE-2017-7494: rpc_server3: Refuse to open pipe names with /
- inside
-
-Bug: https://bugzilla.samba.org/show_bug.cgi?id=12780
-
-Signed-off-by: Volker Lendecke <vl at samba.org>
-Reviewed-by: Jeremy Allison <jra at samba.org>
-Reviewed-by: Stefan Metzmacher <metze at samba.org>
----
- source3/rpc_server/srv_pipe.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/source3/rpc_server/srv_pipe.c b/source3/rpc_server/srv_pipe.c
-index 0633b5f..c3f0cd8 100644
---- a/source3/rpc_server/srv_pipe.c
-+++ b/source3/rpc_server/srv_pipe.c
-@@ -475,6 +475,11 @@ bool is_known_pipename(const char *pipename, struct ndr_syntax_id *syntax)
- {
- 	NTSTATUS status;
- 
-+	if (strchr(pipename, '/')) {
-+		DEBUG(1, ("Refusing open on pipe %s\n", pipename));
-+		return false;
-+	}
-+
- 	if (lp_disable_spoolss() && strequal(pipename, "spoolss")) {
- 		DEBUG(10, ("refusing spoolss access\n"));
- 		return false;
--- 
-1.9.1
diff --git a/debian/patches/series b/debian/patches/series
index fac1ea8..3788884 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -15,5 +15,3 @@ systemd-syslog.target-is-obsolete.patch
 Add-documentation-to-systemd-Unit-files.patch
 fix_kill_path_in_units.patch
 nmbd-requires-a-working-network.patch
-CVE-2017-7494.patch
-CVE-2017-11103-Orpheus-Lyre-KDC-REP-service-name-val.patch

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-samba/samba.git