Jeffrey Altman 3799a32e41 CVE-2017-11103: Orpheus' Lyre KDC-REP service name validation ...

In _krb5_extract_ticket() the KDC-REP service name must be obtained from
encrypted version stored in 'enc_part' instead of the unencrypted version
stored in 'ticket'.  Use of the unecrypted version provides an
opportunity for successful server impersonation and other attacks.

Identified by Jeffrey Altman, Viktor Duchovni and Nico Williams.

Change-Id: I45ef61e8a46e0f6588d64b5bd572a24c7432547c

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12894
(based on heimdal commit 6dd3eb836bbb80a00ffced4ad57077a1cdf227ea)

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Wed Jul 12 17:44:50 CEST 2017 on sn-devel-144

2017-07-12 17:44:50 +02:00

..

auth

debug: new debug class for kerberos

2017-06-30 02:12:22 +02:00

build/pasn1

…

cldap_server

s4: Add TALLOC_CTX * to register_server_service().

2017-05-11 20:30:13 +02:00

client

s4: cifsdd: Allocate the event context off NULL, not talloc_autofree_context().

2017-05-13 16:50:13 +02:00

cluster

Remove callers of lp_use_ntdb

2015-03-17 11:30:51 +01:00

dns_server

dns_server: Only install common library if AD DC is enabled.

2017-07-04 06:57:20 +02:00

dsdb

dsdb: Improve debugging on start transacton failure

2017-07-02 17:35:20 +02:00

echo_server

s4: Add TALLOC_CTX * to register_server_service().

2017-05-11 20:30:13 +02:00

heimdal

CVE-2017-11103: Orpheus' Lyre KDC-REP service name validation

2017-07-12 17:44:50 +02:00

heimdal_build

strerror_r: provide XSI-compliant strerror_r

2017-06-13 18:38:14 +02:00

include

lib: Remove global xfile.h includes

2016-11-20 06:23:19 +01:00

kdc

mit_samba: Fix the MIT KDC build with the latest changes

2017-06-01 07:12:47 +02:00

ldap_server

ldap: Run the LDAP server with the default (typically standard) process model

2017-07-02 17:35:20 +02:00

lib

s4:lib/com: remove unused pycom binding

2017-05-30 12:16:57 +02:00

libcli

s4:libcli/smb_composite: make the additional gensec_update steps async

2017-06-17 20:54:59 +02:00

libnet

libnet join: Fix error handling on provision_store_self_join failure

2017-05-25 06:28:02 +02:00

librpc

lsa.String: add String constructor, str and repr

2017-06-22 08:56:22 +02:00

nbt_server

s4: Add TALLOC_CTX * to register_server_service().

2017-05-11 20:30:13 +02:00

ntp_signd

s4: Add TALLOC_CTX * to register_server_service().

2017-05-11 20:30:13 +02:00

ntvfs

s4:auth/unix_token: remove unused tevent_context from security_token_to_unix_token()

2017-06-26 08:47:15 +02:00

param

source4/provision: fix talloc_steal on unallocated memory

2017-05-25 02:25:13 +02:00

rpc_server

samr: Disable NTLM-based password changes on the server if NTLM is disabled

2017-07-04 06:57:21 +02:00

script

find_unused_macros: Remove obsolete script that finds unused macros.

2014-08-31 21:21:13 +02:00

scripting

samba_dnsupdate: fix "samba-tool" fallback error handling

2017-06-10 21:48:21 +02:00

selftest

Add code to run the tests for 'samba-tool user edit'

2017-07-05 17:53:24 +02:00

setup

selftest: Add a test for @ATTRIBUTES and @INDEXLIST generation

2017-06-15 01:24:25 +02:00

smb_server

s4:smb_server: avoid using gensec_update_ev() for the negotiate blob

2017-05-21 21:05:08 +02:00

smbd

stream_terminate_connection: Prevent use-after-free

2017-06-15 01:24:25 +02:00

torture

vfs_fruit: add fruit:model = <modelname> parametric option

2017-07-12 03:17:57 +02:00

utils

man pages: change http://samba.org to https://www.samba.org

2016-12-09 13:10:26 +01:00

web_server

s4: Add TALLOC_CTX * to register_server_service().

2017-05-11 20:30:13 +02:00

winbind

s4: Add TALLOC_CTX * to register_server_service().

2017-05-11 20:30:13 +02:00

wrepl_server

s4: Add TALLOC_CTX * to register_server_service().

2017-05-11 20:30:13 +02:00

.clang_complete

s3-build: Add .clang_complete.

2011-10-27 17:09:50 +02:00

.valgrind_suppressions

…

wscript_build

Do not install smbclient4 and nmblookup4

2014-04-15 03:25:13 +02:00