mirror of
https://github.com/samba-team/samba.git
synced 2025-01-24 02:04:21 +03:00
2736d267aa
Heimdal's ASN.1 compiler generates code that allows specially crafted DER encodings of CHOICEs to invoke the wrong free function on the decoded structure upon decode error. This is known to impact the Heimdal KDC, leading to an invalid free() of an address partly or wholly under the control of the attacker, in turn leading to a potential remote code execution (RCE) vulnerability. This error affects the DER codec for all CHOICE types used in Heimdal, though not all cases will be exploitable. We have not completed a thorough analysis of all the Heimdal components affected, thus the Kerberos client, the X.509 library, and other parts, may be affected as well. This bug has been in Heimdal since 2005. It was first reported by Douglas Bagnall, though it had been found independently by the Heimdal maintainers via fuzzing a few weeks earlier. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14929 (cherry-picked from Heimdal commit 9c9dac2b169255bad9071eea99fa90b980dde767) Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Tue Dec 6 13:41:05 UTC 2022 on sn-devel-184 (cherry picked from commit 68fc909a7f4d69c254d34bec85cf8431bcb6e72f) Autobuild-User(v4-16-test): Stefan Metzmacher <metze@samba.org> Autobuild-Date(v4-16-test): Tue Dec 6 15:28:49 UTC 2022 on sn-devel-184
Heimdal
Heimdal is an implementation of:
- ASN.1/DER,
- PKIX, and
- Kerberos.
For information how to install see here.
There are man pages for most of the commands.
Bug reports and bugs are appreciated. Use GitHub issues.
For more information see the project homepage https://heimdal.software/heimdal/ or the mailing lists:
heimdal-announce@heimdal.software low-volume announcement heimdal-discuss@heimdal.software high-volume discussion
send mail to heimdal-announce-subscribe@heimdal.software and heimdal-discuss-subscribe@heimdal.software respectively to subscribe.
Build Status