Fix CVE-2017-6594: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6594 https://security-tracker.debian.org/tracker/CVE-2017-6594 Patch lifted from upstream source repository: https://github.com/heimdal/heimdal/commit/b1e699103f08d6a0ca46a122193c9da65f6cf837 To apply the patch to Heimdal 1.5.3 release tarball, the changes to 'NEWS' and files in 'tests/' are removed, and hunk #4 of 'kdc/krb5tgs.c' is modified. From b1e699103f08d6a0ca46a122193c9da65f6cf837 Mon Sep 17 00:00:00 2001 From: Viktor Dukhovni Date: Wed, 10 Aug 2016 23:31:14 +0000 Subject: [PATCH] Fix transit path validation CVE-2017-6594 Commit f469fc6 (2010-10-02) inadvertently caused the previous hop realm to not be added to the transit path of issued tickets. This may, in some cases, enable bypass of capath policy in Heimdal versions 1.5 through 7.2. Note, this may break sites that rely on the bug. With the bug some incomplete [capaths] worked, that should not have. These may now break authentication in some cross-realm configurations. --- NEWS | 14 ++++++++++++++ kdc/krb5tgs.c | 12 ++++++++++-- tests/kdc/check-kdc.in | 17 +++++++++++++++++ tests/kdc/krb5.conf.in | 4 ++++ 4 files changed, 45 insertions(+), 2 deletions(-) diff --git a/kdc/krb5tgs.c b/kdc/krb5tgs.c index 6048b9c55..98503812f 100644 --- a/kdc/krb5tgs.c +++ b/kdc/krb5tgs.c @@ -655,8 +655,12 @@ fix_transited_encoding(krb5_context context, "Decoding transited encoding"); return ret; } + + /* + * If the realm of the presented tgt is neither the client nor the server + * realm, it is a transit realm and must be added to transited set. + */ if(strcmp(client_realm, tgt_realm) && strcmp(server_realm, tgt_realm)) { - /* not us, so add the previous realm to transited set */ if (num_realms + 1 > UINT_MAX/sizeof(*realms)) { ret = ERANGE; goto free_realms; @@ -737,6 +741,7 @@ tgs_make_reply(krb5_context context, const char *server_name, hdb_entry_ex *client, krb5_principal client_principal, + const char *tgt_realm, hdb_entry_ex *krbtgt, krb5_enctype krbtgt_etype, krb5_principals spp, @@ -798,7 +803,7 @@ tgs_make_reply(krb5_context context, &tgt->transited, &et, krb5_principal_get_realm(context, client_principal), krb5_principal_get_realm(context, server->entry.principal), - krb5_principal_get_realm(context, krbtgt->entry.principal)); + tgt_realm); if(ret) goto out; @@ -1519,4 +1524,6 @@ tgs_build_reply(krb5_context context, krb5_keyblock sessionkey; krb5_kvno kvno; krb5_data rspac; + const char *tgt_realm = /* Realm of TGT issuer */ + krb5_principal_get_realm(context, krbtgt->entry.principal); @@ -2324,6 +2331,7 @@ server_lookup: spn, client, cp, + tgt_realm, krbtgt_out, tkey_sign->key.keytype, spp, -- 2.13.3