sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-03-22 02:50:28 +03:00
Code

CVE-2016-2126: auth/kerberos: only allow known checksum types in check_pac_checksum()

Browse Source 
aes based checksums can only be checked with the
corresponding aes based keytype.

Otherwise we may trigger an undefined code path
deep in the kerberos libraries, which can leed to
segmentation faults.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12446

Signed-off-by: Stefan Metzmacher <metze@samba.org>
This commit is contained in:
Stefan Metzmacher 2016-11-22 17:08:46 +01:00 committed by Karolin Seeger
parent 3106964a64
commit 8512eed8e2
1 changed files with 22 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
auth/kerberos/kerberos_pac.c
View File

@ -39,6 +39,28 @@ krb5_error_code check_pac_checksum(DATA_BLOB pac_data,
krb5_boolean checksum_valid = false;
krb5_data input;
switch (sig->type) {
case CKSUMTYPE_HMAC_MD5:
/* ignores the key type */
break;
case CKSUMTYPE_HMAC_SHA1_96_AES_256:
if (KRB5_KEY_TYPE(keyblock) != ENCTYPE_AES256_CTS_HMAC_SHA1_96) {
return EINVAL;
}
/* ok */
break;
case CKSUMTYPE_HMAC_SHA1_96_AES_128:
if (KRB5_KEY_TYPE(keyblock) != ENCTYPE_AES128_CTS_HMAC_SHA1_96) {
return EINVAL;
}
/* ok */
break;
default:
DEBUG(2,("check_pac_checksum: Checksum Type %d is not supported\n",
(int)sig->type));
return EINVAL;
}
#ifdef HAVE_CHECKSUM_IN_KRB5_CHECKSUM /* Heimdal */
cksum.cksumtype = (krb5_cksumtype)sig->type;
cksum.checksum.length = sig->signature.length;