From 3f55dbf520b77338bea1ef7ba8e4af70768a1f7d Mon Sep 17 00:00:00 2001 From: Andrew Bartlett Date: Tue, 1 Nov 2022 14:47:12 +1300 Subject: [PATCH 12/54] CVE-2022-37966 HEIMDAL: Look up the server keys to combine with clients etype list to select a session key We need to select server, not client, to compare client etypes against. (It is not useful to compare the client-supplied encryption types with the client's own long-term keys.) BUG: https://bugzilla.samba.org/show_bug.cgi?id=15237 Signed-off-by: Andrew Bartlett Reviewed-by: Stefan Metzmacher (similar to commit 538315a2aa6d03b7639b49eb1576efa8755fefec) [jsutton@samba.org Fixed knownfail conflicts] Conflict: NA Reference: https://attachments.samba.org/attachment.cgi?id=17695 --- selftest/knownfail_heimdal_kdc | 5 ----- third_party/heimdal/kdc/kerberos5.c | 2 +- 2 files changed, 1 insertion(+), 6 deletions(-) diff --git a/selftest/knownfail_heimdal_kdc b/selftest/knownfail_heimdal_kdc index 4abacafe03a0..4ae27eacb091 100644 --- a/selftest/knownfail_heimdal_kdc +++ b/selftest/knownfail_heimdal_kdc @@ -54,8 +54,3 @@ ^samba.tests.krb5.protected_users_tests.samba.tests.krb5.protected_users_tests.ProtectedUsersTests.test_proxiable_as_protected.ad_dc # ^samba.tests.krb5.protected_users_tests.samba.tests.krb5.protected_users_tests.ProtectedUsersTests.test_samr_change_password_protected.ad_dc -# -# Encryption type tests -# -^samba.tests.krb5.etype_tests.samba.tests.krb5.etype_tests.EtypeTests.test_as_aes_requested.ad_dc -^samba.tests.krb5.etype_tests.samba.tests.krb5.etype_tests.EtypeTests.test_as_rc4_supported_aes_requested.ad_dc diff --git a/third_party/heimdal/kdc/kerberos5.c b/third_party/heimdal/kdc/kerberos5.c index 0a7934310cca..3e0f2dbd6b63 100644 --- a/third_party/heimdal/kdc/kerberos5.c +++ b/third_party/heimdal/kdc/kerberos5.c @@ -2212,7 +2212,7 @@ _kdc_as_rep(astgs_request_t r) * intersection of the client's requested enctypes and the server's (like a * root krbtgt, but not necessarily) etypes from its HDB entry. */ - ret = _kdc_find_etype(r, (is_tgs ? KFE_IS_TGS:0) | KFE_USE_CLIENT, + ret = _kdc_find_etype(r, (is_tgs ? KFE_IS_TGS:0), b->etype.val, b->etype.len, &r->sessionetype, NULL, NULL); if (ret) { -- 2.34.1