From 15caf6240e0336685494ae36405b60408e83ed72 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Wed, 30 Nov 2022 09:39:19 +0100 Subject: [PATCH 52/54] CVE-2022-37966 s4:kdc: apply restrictions of "kdc supported enctypes" BUG: https://bugzilla.samba.org/show_bug.cgi?id=15237 Signed-off-by: Stefan Metzmacher Reviewed-by: Joseph Sutton Reviewed-by: Andrew Bartlett (cherry picked from commit cca3c024fc514bee79bb60a686e470605cc98d6f) Conflict: NA Reference: https://attachments.samba.org/attachment.cgi?id=17695 --- source4/kdc/db-glue.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/source4/kdc/db-glue.c b/source4/kdc/db-glue.c index 4cdbdf9a325b..83d5c903235a 100644 --- a/source4/kdc/db-glue.c +++ b/source4/kdc/db-glue.c @@ -1079,7 +1079,11 @@ static krb5_error_code samba_kdc_message2entry(krb5_context context, * but effectively restricted by kdc_enctypes */ uint32_t domain_enctypes = ENC_RC4_HMAC_MD5 | ENC_RSA_MD5 | ENC_CRC32; - uint32_t kdc_enctypes = ENC_ALL_TYPES; + uint32_t config_kdc_enctypes = lpcfg_kdc_supported_enctypes(lp_ctx); + uint32_t kdc_enctypes = + config_kdc_enctypes != 0 ? + config_kdc_enctypes : + ENC_ALL_TYPES; const char *samAccountName = ldb_msg_find_attr_as_string(msg, "samAccountName", NULL); ZERO_STRUCTP(entry); @@ -1665,7 +1669,11 @@ static krb5_error_code samba_kdc_trust_message2entry(krb5_context context, uint32_t supported_enctypes = ENC_RC4_HMAC_MD5; uint32_t pa_supported_enctypes; uint32_t supported_session_etypes; - uint32_t kdc_enctypes = ENC_ALL_TYPES; + uint32_t config_kdc_enctypes = lpcfg_kdc_supported_enctypes(lp_ctx); + uint32_t kdc_enctypes = + config_kdc_enctypes != 0 ? + config_kdc_enctypes : + ENC_ALL_TYPES; struct lsa_TrustDomainInfoInfoEx *tdo = NULL; NTSTATUS status; -- 2.34.1