5 Commits

Author	SHA1	Message	Date
Joseph Sutton	d5af460403	CVE-2022-2031 s4:kpasswd: Do not accept TGTs as kpasswd tickets ... If TGTs can be used as kpasswd tickets, the two-minute lifetime of a authentic kpasswd ticket may be bypassed. Furthermore, kpasswd tickets are not supposed to be cached, but using this flaw, a stolen credentials cache containing a TGT may be used to change that account's password, and thus is made more valuable to an attacker. Since all TGTs should be issued with a REQUESTER_SID PAC buffer, and service tickets without it, we assert the absence of this buffer to ensure we're not accepting a TGT. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047 BUG: https://bugzilla.samba.org/show_bug.cgi?id=15049 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org> [jsutton@samba.org Fixed knownfail conflicts] [jsutton@samba.org Fixed knownfail conflicts]	2022-07-24 11:42:02 +02:00
Joseph Sutton	69e742e620	s4:kpasswd: Restructure code for clarity ... View with 'git show -b'. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>	2022-07-24 11:42:02 +02:00
Joseph Sutton	6c4fd575d7	CVE-2022-2031 s4:kpasswd: Require an initial ticket ... Ensure that for password changes the client uses an AS-REQ to get the ticket to kpasswd, and not a TGS-REQ. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047 BUG: https://bugzilla.samba.org/show_bug.cgi?id=15049 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org> [jsutton@samba.org Removed MIT KDC 1.20-specific knownfails]	2022-07-24 11:42:02 +02:00
Ralph Boehme	4142bde7e5	s4: rename source4/smbd/ to source4/samba/ ... Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Ralph Böhme <slow@samba.org> Autobuild-Date(master): Fri Nov 27 10:07:18 UTC 2020 on sn-devel-184	2020-11-27 10:07:18 +00:00
Andreas Schneider	7e4c996bb1	s4-kdc: Add new kpasswd service Heimdal backend ... Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>	2016-09-13 00:19:25 +02:00