mirror of
https://github.com/samba-team/samba.git
synced 2024-12-23 17:34:34 +03:00
CVE-2022-32744 s4:kdc: Don't allow HDB keytab iteration
A fallback in krb5_rd_req_ctx() means that Samba's kpasswd service will try many inappropriate keys to decrypt the ticket supplied to it. For example, it will accept a ticket encrypted with the Administrator's key, when it should rather accept only tickets encrypted with the krbtgt's key (and not an RODC krbtgt). To fix this, declare the HDB keytab using the HDBGET ops, which do not support iteration. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15074 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
This commit is contained in:
parent
ffb599050a
commit
bbad8f1de4
@ -57,7 +57,6 @@
|
||||
#
|
||||
# Kpasswd tests
|
||||
#
|
||||
^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_from_rodc.ad_dc
|
||||
^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_wrong_key.ad_dc
|
||||
^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_wrong_key_server.ad_dc
|
||||
^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_wrong_key_service.ad_dc
|
||||
|
@ -463,7 +463,7 @@ static void kdc_post_fork(struct task_server *task, struct process_details *pd)
|
||||
return;
|
||||
}
|
||||
|
||||
kdc->keytab_name = talloc_asprintf(kdc, "HDB:samba4:&%p", kdc->base_ctx);
|
||||
kdc->keytab_name = talloc_asprintf(kdc, "HDBGET:samba4:&%p", kdc->base_ctx);
|
||||
if (kdc->keytab_name == NULL) {
|
||||
task_server_terminate(task,
|
||||
"kdc: Failed to set keytab name",
|
||||
@ -471,7 +471,7 @@ static void kdc_post_fork(struct task_server *task, struct process_details *pd)
|
||||
return;
|
||||
}
|
||||
|
||||
ret = krb5_kt_register(kdc->smb_krb5_context->krb5_context, &hdb_kt_ops);
|
||||
ret = krb5_kt_register(kdc->smb_krb5_context->krb5_context, &hdb_get_kt_ops);
|
||||
if(ret) {
|
||||
task_server_terminate(task, "kdc: failed to register keytab plugin", true);
|
||||
return;
|
||||
|
Loading…
Reference in New Issue
Block a user