openkylin
/
heimdal
4
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

CVE-2019-14870: Validate client attributes in protocol-transition 

Signed-off-by: Isaac Boukris <iboukris@gmail.com>

Gbp-Pq: Name 0020-CVE-2019-14870-Validate-client-attributes-in-protoco.patch
This commit is contained in:
Isaac Boukris 2019-11-07 00:05:05 +01:00 committed by openKylinBot
parent caf842ced3
commit 2fef32e7ac
2 changed files with 19 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
kdc/krb5tgs.c
View File

@ -2125,6 +2125,17 @@ server_lookup:
goto out;
}
/* Ignore require_pwchange and pw_end attributes (as Windows does),
* since S4U2Self is not password authentication. */
s4u2self_impersonated_client->entry.flags.require_pwchange = FALSE;
free(s4u2self_impersonated_client->entry.pw_end);
s4u2self_impersonated_client->entry.pw_end = NULL;
ret = kdc_check_flags(context, config, s4u2self_impersonated_client, tpn,
NULL, NULL, FALSE);
if (ret)
goto out;
/* If we were about to put a PAC into the ticket, we better fix it to be the right PAC */
if(rspac.data) {
krb5_pac p = NULL;

8
tests/kdc/check-kdc.in
View File

@ -811,6 +811,14 @@ echo "test impersonate unknown client"; > messages.log
${kgetcred_imp} --forward --impersonate=unknown@${R} ${ps} && \
{ ec=1 ; eval "${testfailed}"; }
echo "test impersonate account-expired client"; > messages.log
${kgetcred_imp} --forward --impersonate=account-expired@${R} ${ps} && \
{ ec=1 ; eval "${testfailed}"; }
echo "test impersonate pw-expired client"; > messages.log
${kgetcred_imp} --forward --impersonate=pw-expired@${R} ${ps} || \
{ ec=1 ; eval "${testfailed}"; }
echo "test delegate sensitive client"; > messages.log
${kgetcred_imp} --forward --impersonate=sensitive@${R} ${ps} || \
{ ec=1 ; eval "${testfailed}"; }