Module Name: src Committed By: martin Date: Wed Jul 12 15:34:37 UTC 2017
Modified Files: src/crypto/external/bsd/heimdal/dist/lib/krb5 [netbsd-7]: ticket.c Log Message: Pull up following revision(s) (requested by christos in ticket #1453): crypto/external/bsd/heimdal/dist/lib/krb5/ticket.c: revision 1.3 crypto/external/bsd/heimdal/dist/lib/krb5/ticket.c: revision 1.4 <a rel="nofollow" href="https://orpheus-lyre.info/design/index.html">https://orpheus-lyre.info/design/index.html</a> <a rel="nofollow" href="https://github.com/heimdal/heimdal/commit/6dd3eb836bbb80a00ffced4ad57077a1cdf227ea">https://github.com/heimdal/heimdal/commit/6dd3eb836bbb80a00ffced4ad57077a1cdf227ea</a> In _krb5_extract_ticket() the KDC-REP service name must be obtained from encrypted version stored in 'enc_part' instead of the unencrypted version stored in 'ticket'. Use of the unecrypted version provides an opportunity for successful server impersonation and other attacks. Identified by Jeffrey Altman, Viktor Duchovni and Nico Williams. XXX: pullup 6, 7, 8. fix typo. To generate a diff of this commit: cvs rdiff -u -r1.1.1.2 -r1.1.1.2.2.1 \ src/crypto/external/bsd/heimdal/dist/lib/krb5/ticket.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
Modified files: Index: src/crypto/external/bsd/heimdal/dist/lib/krb5/ticket.c diff -u src/crypto/external/bsd/heimdal/dist/lib/krb5/ticket.c:1.1.1.2 src/crypto/external/bsd/heimdal/dist/lib/krb5/ticket.c:1.1.1.2.2.1 --- src/crypto/external/bsd/heimdal/dist/lib/krb5/ticket.c:1.1.1.2 Thu Apr 24 12:45:51 2014 +++ src/crypto/external/bsd/heimdal/dist/lib/krb5/ticket.c Wed Jul 12 15:34:37 2017 @@ -1,4 +1,4 @@ -/* $NetBSD: ticket.c,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $ */ +/* $NetBSD: ticket.c,v 1.1.1.2.2.1 2017/07/12 15:34:37 martin Exp $ */ /* * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan @@ -715,8 +715,8 @@ _krb5_extract_ticket(krb5_context contex /* check server referral and save principal */ ret = _krb5_principalname2krb5_principal (context, &tmp_principal, - rep->kdc_rep.ticket.sname, - rep->kdc_rep.ticket.realm); + rep->enc_part.sname, + rep->enc_part.srealm); if (ret) goto out; if((flags & EXTRACT_TICKET_ALLOW_SERVER_MISMATCH) == 0){