1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
| | Fix CVE-2017-11103:
https://orpheus-lyre.info/
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11103
https://security-tracker.debian.org/tracker/CVE-2017-11103
Patch lifted from upstream source repository:
https://github.com/heimdal/heimdal/commit/6dd3eb836bbb80a00ffced4ad57077a1cdf227ea
From 6dd3eb836bbb80a00ffced4ad57077a1cdf227ea Mon Sep 17 00:00:00 2001
From: Jeffrey Altman <jaltman@secure-endpoints.com>
Date: Wed, 12 Apr 2017 15:40:42 -0400
Subject: [PATCH] CVE-2017-11103: Orpheus' Lyre KDC-REP service name validation
In _krb5_extract_ticket() the KDC-REP service name must be obtained from
encrypted version stored in 'enc_part' instead of the unencrypted version
stored in 'ticket'. Use of the unecrypted version provides an
opportunity for successful server impersonation and other attacks.
Identified by Jeffrey Altman, Viktor Duchovni and Nico Williams.
Change-Id: I45ef61e8a46e0f6588d64b5bd572a24c7432547c
---
lib/krb5/ticket.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/lib/krb5/ticket.c b/lib/krb5/ticket.c
index d95d96d1b..b8d81c6ad 100644
--- a/lib/krb5/ticket.c
+++ b/lib/krb5/ticket.c
@@ -705,8 +705,8 @@ _krb5_extract_ticket(krb5_context context,
/* check server referral and save principal */
ret = _krb5_principalname2krb5_principal (context,
&tmp_principal,
- rep->kdc_rep.ticket.sname,
- rep->kdc_rep.ticket.realm);
+ rep->enc_part.sname,
+ rep->enc_part.srealm);
if (ret)
goto out;
if((flags & EXTRACT_TICKET_ALLOW_SERVER_MISMATCH) == 0){
--
2.13.3
|