oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

CVE-2019-14870: Apply forwardable policy in protocol-transition

Browse Source 
Signed-off-by: Isaac Boukris <iboukris@gmail.com>
This commit is contained in:
Isaac Boukris
2019-11-05 02:37:30 +01:00
committed by Jeffrey Altman
parent 51415eaaae
commit 013210d1eb
2 changed files with 15 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
kdc/krb5tgs.c
View File

@@ -2181,10 +2181,12 @@ server_lookup:
/*
* If the service isn't trusted for authentication to
* delegation, remove the forward flag.
* delegation or if the impersonate client is disallowed
* forwardable, remove the forwardable flag.
*/
if (client->entry.flags.trusted_for_delegation) {
if (client->entry.flags.trusted_for_delegation &&
s4u2self_impersonated_client->entry.flags.forwardable) {
str = "[forwardable]";
} else {
b->kdc_options.forwardable = 0;