sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-21 18:04:06 +03:00
Code

CVE-2022-2031 s4:kpasswd: Require an initial ticket

Browse Source 
Ensure that for password changes the client uses an AS-REQ to get the
ticket to kpasswd, and not a TGS-REQ.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15049

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>

[jsutton@samba.org Removed MIT KDC 1.20-specific knownfails]
This commit is contained in:
Joseph Sutton 2022-05-18 16:52:41 +12:00 committed by Jule Anger
parent 198256e218
commit 6c4fd575d7
5 changed files with 35 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
selftest/knownfail_heimdal_kdc
View File

@ -277,7 +277,6 @@
^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_canonicalize.ad_dc ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_canonicalize.ad_dc
^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_canonicalize_realm_case.ad_dc ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_canonicalize_realm_case.ad_dc
^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_from_rodc.ad_dc ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_from_rodc.ad_dc
^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_non_initial.ad_dc
^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_ticket_lifetime.ad_dc ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_ticket_lifetime.ad_dc
^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_ticket_requester_sid_tgs.ad_dc ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_ticket_requester_sid_tgs.ad_dc
^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_wrong_key.ad_dc ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_wrong_key.ad_dc

1
selftest/knownfail_mit_kdc
View File

@ -580,7 +580,6 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_
# #
^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_canonicalize_realm_case.ad_dc ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_canonicalize_realm_case.ad_dc
^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_no_canonicalize_realm_case.ad_dc ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_no_canonicalize_realm_case.ad_dc
^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_non_initial.ad_dc
^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_ticket_lifetime.ad_dc ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_ticket_lifetime.ad_dc
^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_ticket_requester_sid_tgs.ad_dc ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_ticket_requester_sid_tgs.ad_dc
^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_wrong_key_server.ad_dc ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_wrong_key_server.ad_dc

17
source4/kdc/kpasswd-service-heimdal.c
View File

@ -24,6 +24,7 @@
#include "param/param.h" #include "param/param.h"
#include "auth/auth.h" #include "auth/auth.h"
#include "auth/gensec/gensec.h" #include "auth/gensec/gensec.h"
#include "gensec_krb5_helpers.h"
#include "kdc/kdc-server.h" #include "kdc/kdc-server.h"
#include "kdc/kpasswd_glue.h" #include "kdc/kpasswd_glue.h"
#include "kdc/kpasswd-service.h" #include "kdc/kpasswd-service.h"
@ -31,6 +32,7 @@
static krb5_error_code kpasswd_change_password(struct kdc_server *kdc, static krb5_error_code kpasswd_change_password(struct kdc_server *kdc,
TALLOC_CTX *mem_ctx, TALLOC_CTX *mem_ctx,
const struct gensec_security *gensec_security,
struct auth_session_info *session_info, struct auth_session_info *session_info,
DATA_BLOB *password, DATA_BLOB *password,
DATA_BLOB *kpasswd_reply, DATA_BLOB *kpasswd_reply,
@ -42,6 +44,17 @@ static krb5_error_code kpasswd_change_password(struct kdc_server *kdc,
const char *reject_string = NULL; const char *reject_string = NULL;
struct samr_DomInfo1 *dominfo; struct samr_DomInfo1 *dominfo;
bool ok; bool ok;
int ret;
/*
* We're doing a password change (rather than a password set), so check
* that we were given an initial ticket.
*/
ret = gensec_krb5_initial_ticket(gensec_security);
if (ret != 1) {
*error_string = "Expected an initial ticket";
return KRB5_KPASSWD_INITIAL_FLAG_NEEDED;
}
status = samdb_kpasswd_change_password(mem_ctx, status = samdb_kpasswd_change_password(mem_ctx,
kdc->task->lp_ctx, kdc->task->lp_ctx,
@ -81,6 +94,7 @@ static krb5_error_code kpasswd_change_password(struct kdc_server *kdc,
static krb5_error_code kpasswd_set_password(struct kdc_server *kdc, static krb5_error_code kpasswd_set_password(struct kdc_server *kdc,
TALLOC_CTX *mem_ctx, TALLOC_CTX *mem_ctx,
const struct gensec_security *gensec_security,
struct auth_session_info *session_info, struct auth_session_info *session_info,
DATA_BLOB *decoded_data, DATA_BLOB *decoded_data,
DATA_BLOB *kpasswd_reply, DATA_BLOB *kpasswd_reply,
@ -173,6 +187,7 @@ static krb5_error_code kpasswd_set_password(struct kdc_server *kdc,
free_ChangePasswdDataMS(&chpw); free_ChangePasswdDataMS(&chpw);
return kpasswd_change_password(kdc, return kpasswd_change_password(kdc,
mem_ctx, mem_ctx,
gensec_security,
session_info, session_info,
&password, &password,
kpasswd_reply, kpasswd_reply,
@ -272,6 +287,7 @@ krb5_error_code kpasswd_handle_request(struct kdc_server *kdc,
return kpasswd_change_password(kdc, return kpasswd_change_password(kdc,
mem_ctx, mem_ctx,
gensec_security,
session_info, session_info,
&password, &password,
kpasswd_reply, kpasswd_reply,
@ -280,6 +296,7 @@ krb5_error_code kpasswd_handle_request(struct kdc_server *kdc,
case KRB5_KPASSWD_VERS_SETPW: { case KRB5_KPASSWD_VERS_SETPW: {
return kpasswd_set_password(kdc, return kpasswd_set_password(kdc,
mem_ctx, mem_ctx,
gensec_security,
session_info, session_info,
decoded_data, decoded_data,
kpasswd_reply, kpasswd_reply,

17
source4/kdc/kpasswd-service-mit.c
View File

@ -24,6 +24,7 @@
#include "param/param.h" #include "param/param.h"
#include "auth/auth.h" #include "auth/auth.h"
#include "auth/gensec/gensec.h" #include "auth/gensec/gensec.h"
#include "gensec_krb5_helpers.h"
#include "kdc/kdc-server.h" #include "kdc/kdc-server.h"
#include "kdc/kpasswd_glue.h" #include "kdc/kpasswd_glue.h"
#include "kdc/kpasswd-service.h" #include "kdc/kpasswd-service.h"
@ -84,6 +85,7 @@ out:
static krb5_error_code kpasswd_change_password(struct kdc_server *kdc, static krb5_error_code kpasswd_change_password(struct kdc_server *kdc,
TALLOC_CTX *mem_ctx, TALLOC_CTX *mem_ctx,
const struct gensec_security *gensec_security,
struct auth_session_info *session_info, struct auth_session_info *session_info,
DATA_BLOB *password, DATA_BLOB *password,
DATA_BLOB *kpasswd_reply, DATA_BLOB *kpasswd_reply,
@ -95,6 +97,17 @@ static krb5_error_code kpasswd_change_password(struct kdc_server *kdc,
const char *reject_string = NULL; const char *reject_string = NULL;
struct samr_DomInfo1 *dominfo; struct samr_DomInfo1 *dominfo;
bool ok; bool ok;
int ret;
/*
* We're doing a password change (rather than a password set), so check
* that we were given an initial ticket.
*/
ret = gensec_krb5_initial_ticket(gensec_security);
if (ret != 1) {
*error_string = "Expected an initial ticket";
return KRB5_KPASSWD_INITIAL_FLAG_NEEDED;
}
status = samdb_kpasswd_change_password(mem_ctx, status = samdb_kpasswd_change_password(mem_ctx,
kdc->task->lp_ctx, kdc->task->lp_ctx,
@ -134,6 +147,7 @@ static krb5_error_code kpasswd_change_password(struct kdc_server *kdc,
static krb5_error_code kpasswd_set_password(struct kdc_server *kdc, static krb5_error_code kpasswd_set_password(struct kdc_server *kdc,
TALLOC_CTX *mem_ctx, TALLOC_CTX *mem_ctx,
const struct gensec_security *gensec_security,
struct auth_session_info *session_info, struct auth_session_info *session_info,
DATA_BLOB *decoded_data, DATA_BLOB *decoded_data,
DATA_BLOB *kpasswd_reply, DATA_BLOB *kpasswd_reply,
@ -250,6 +264,7 @@ static krb5_error_code kpasswd_set_password(struct kdc_server *kdc,
return kpasswd_change_password(kdc, return kpasswd_change_password(kdc,
mem_ctx, mem_ctx,
gensec_security,
session_info, session_info,
&password, &password,
kpasswd_reply, kpasswd_reply,
@ -350,6 +365,7 @@ krb5_error_code kpasswd_handle_request(struct kdc_server *kdc,
return kpasswd_change_password(kdc, return kpasswd_change_password(kdc,
mem_ctx, mem_ctx,
gensec_security,
session_info, session_info,
&password, &password,
kpasswd_reply, kpasswd_reply,
@ -358,6 +374,7 @@ krb5_error_code kpasswd_handle_request(struct kdc_server *kdc,
case RFC3244_VERSION: { case RFC3244_VERSION: {
return kpasswd_set_password(kdc, return kpasswd_set_password(kdc,
mem_ctx, mem_ctx,
gensec_security,
session_info, session_info,
decoded_data, decoded_data,
kpasswd_reply, kpasswd_reply,

1
source4/kdc/wscript_build
View File

@ -88,6 +88,7 @@ bld.SAMBA_SUBSYSTEM('KPASSWD-SERVICE',
krb5samba krb5samba
samba_server_gensec samba_server_gensec
KPASSWD_GLUE KPASSWD_GLUE
gensec_krb5_helpers
''') ''')
bld.SAMBA_SUBSYSTEM('KDC-GLUE', bld.SAMBA_SUBSYSTEM('KDC-GLUE',