From f52d4664e3f68828c06f85bfc1afa271e3e04713 Mon Sep 17 00:00:00 2001 From: Xin LI Date: Wed, 12 Jul 2017 07:13:56 +0000 Subject: [PATCH] Import upstream fix for CVE-2017-11103: CVE-2017-11103: Orpheus' Lyre KDC-REP service name validation In _krb5_extract_ticket() the KDC-REP service name must be obtained from encrypted version stored in 'enc_part' instead of the unencrypted version stored in 'ticket'. Use of the unecrypted version provides an opportunity for successful server impersonation and other attacks. Identified by Jeffrey Altman, Viktor Duchovni and Nico Williams. Change-Id: I45ef61e8a46e0f6588d64b5bd572a24c7432547c Submitted by: hrs Obtained from: https://github.com/heimdal/heimdal/commit/6dd3eb836bbb80a00ffced4ad57077a1cdf227ea Security: CVE-2017-11103 Security: FreeBSD-SA-17:05.heimdal --- lib/krb5/ticket.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/krb5/ticket.c b/lib/krb5/ticket.c index 4845a93d9446..5b6eabe2b0e0 100644 --- a/lib/krb5/ticket.c +++ b/lib/krb5/ticket.c @@ -713,8 +713,8 @@ _krb5_extract_ticket(krb5_context context, /* check server referral and save principal */ ret = _krb5_principalname2krb5_principal (context, &tmp_principal, - rep->kdc_rep.ticket.sname, - rep->kdc_rep.ticket.realm); + rep->enc_part.sname, + rep->enc_part.srealm); if (ret) goto out; if((flags & EXTRACT_TICKET_ALLOW_SERVER_MISMATCH) == 0){