sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-03-12 20:58:37 +03:00
Code

CVE-2022-32744 s4:kpasswd: Ensure we pass the kpasswd server principal into krb5_rd_req_ctx()

Browse Source 
To ensure that, when decrypting the kpasswd ticket, we look up the
correct principal and don't trust the sname from the ticket, we should
pass the principal name of the kpasswd service into krb5_rd_req_ctx().
However, gensec_krb5_update_internal() will pass in NULL unless the
principal in our credentials is CRED_SPECIFIED.

At present, our principal will be considered obtained as CRED_SMB_CONF
(from the cli_credentials_set_conf() a few lines up), so we explicitly
set the realm again, but this time as CRED_SPECIFIED. Now the value of
server_in_keytab that we provide to smb_krb5_rd_req_decoded() will not
be NULL.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15074

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>

[jsutton@samba.org Removed knownfail as KDC no longer panics]
This commit is contained in:
Joseph Sutton 2022-05-30 19:16:02 +12:00 committed by Jule Anger
parent e21efbabcc
commit b64e1b4a51
3 changed files with 30 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
selftest/knownfail_heimdal_kdc
View File

@ -109,7 +109,3 @@
^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_service_ticket
^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_sid_mismatch_existing
^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_sid_mismatch_nonexisting
#
# Kpasswd tests
#
^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_from_rodc.ad_dc

2
selftest/knownfail_mit_kdc
View File

@ -547,5 +547,3 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_
^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_canonicalize_realm_case.ad_dc
^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_no_canonicalize_realm_case.ad_dc
^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_ticket_requester_sid_tgs.ad_dc
^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_wrong_key_server.ad_dc
^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_wrong_key_service.ad_dc

30
source4/kdc/kpasswd-service.c
View File

@ -29,6 +29,7 @@
#include "kdc/kdc-server.h"
#include "kdc/kpasswd-service.h"
#include "kdc/kpasswd-helper.h"
#include "param/param.h"
#define HEADER_LEN 6
#ifndef RFC3244_VERSION
@ -161,6 +162,20 @@ kdc_code kpasswd_process(struct kdc_server *kdc,
goto done;
}
/*
* After calling cli_credentials_set_conf(), explicitly set the realm
* with CRED_SPECIFIED. We need to do this so the result of
* principal_from_credentials() called from the gensec layer is
* CRED_SPECIFIED rather than CRED_SMB_CONF, avoiding a fallback to
* match-by-key (very undesirable in this case).
*/
ok = cli_credentials_set_realm(server_credentials,
lpcfg_realm(kdc->task->lp_ctx),
CRED_SPECIFIED);
if (!ok) {
goto done;
}
ok = cli_credentials_set_username(server_credentials,
"kadmin/changepw",
CRED_SPECIFIED);
@ -168,6 +183,21 @@ kdc_code kpasswd_process(struct kdc_server *kdc,
goto done;
}
/* Check that the server principal is indeed CRED_SPECIFIED. */
{
char *principal = NULL;
enum credentials_obtained obtained;
principal = cli_credentials_get_principal_and_obtained(server_credentials,
tmp_ctx,
&obtained);
if (obtained < CRED_SPECIFIED) {
goto done;
}
TALLOC_FREE(principal);
}
rv = cli_credentials_set_keytab_name(server_credentials,
kdc->task->lp_ctx,
kdc->kpasswd_keytab_name,