oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

Fix transit path validation CVE-2017-6594

Browse Source 
Commit f469fc6 (2010-10-02) inadvertently caused the previous hop realm
to not be added to the transit path of issued tickets.  This may, in
some cases, enable bypass of capath policy in Heimdal versions 1.5
through 7.2.

Note, this may break sites that rely on the bug.  With the bug some
incomplete [capaths] worked, that should not have.  These may now break
authentication in some cross-realm configurations.
This commit is contained in:
Viktor Dukhovni
2016-08-10 23:31:14 +00:00
committed by Nicolas Williams
parent d5dd5aab19
commit b1e699103f
4 changed files with 45 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
tests/kdc/check-kdc.in
View File

@@ -53,6 +53,7 @@ R4=TEST4.H5L.SE
R5=SOME-REALM5.FR
R6=SOME-REALM6.US
R7=SOME-REALM7.UK
R8=SOME-REALM8.UK
H1=H1.$R
H2=H2.$R
@@ -148,6 +149,12 @@ ${kadmin} \
--realm-max-renewable-life=1month \
${R7} || exit 1
${kadmin} \
init \
--realm-max-ticket-life=1day \
--realm-max-renewable-life=1month \
${R8} || exit 1
${kadmin} \
init \
--realm-max-ticket-life=1day \
@@ -191,6 +198,7 @@ ${kadmin} add -p foo --use-defaults foo@${R4} || exit 1
${kadmin5} add -p foo --use-defaults foo@${R5} || exit 1
${kadmin} add -p foo --use-defaults foo@${R6} || exit 1
${kadmin} add -p foo --use-defaults foo@${R7} || exit 1
${kadmin} add -p foo --use-defaults foo@${R8} || exit 1
${kadmin} add -p foo --use-defaults foo@${H1} || exit 1
${kadmin} add -p foo --use-defaults foo/host.${h1}@${H1} || exit 1
${kadmin} add -p foo --use-defaults foo@${H2} || exit 1
@@ -249,6 +257,9 @@ ${kadmin} add -p cross2 --use-defaults krbtgt/${R5}@${R6} || exit 1
${kadmin} add -p cross1 --use-defaults krbtgt/${R7}@${R6} || exit 1
${kadmin} add -p cross2 --use-defaults krbtgt/${R6}@${R7} || exit 1
${kadmin} add -p cross1 --use-defaults krbtgt/${R8}@${R6} || exit 1
${kadmin} add -p cross2 --use-defaults krbtgt/${R6}@${R8} || exit 1
${kadmin} add -p cross1 --use-defaults krbtgt/${H1}@${R} || exit 1
${kadmin} add -p cross2 --use-defaults krbtgt/${R}@${H1} || exit 1
@@ -284,6 +295,7 @@ ${kadmin} check ${R4} || exit 1
${kadmin5} check ${R5} || exit 1
${kadmin} check ${R6} || exit 1
${kadmin} check ${R7} || exit 1
${kadmin} check ${R8} || exit 1
${kadmin} check ${H1} || exit 1
${kadmin} check ${H2} || exit 1
${kadmin} check ${H3} || exit 1
@@ -388,6 +400,8 @@ echo "Getting x-realm tickets with capaths for $R -> $R6"
${kgetcred} foo@${R6} || { ec=1 ; eval "${testfailed}"; }
echo "Getting x-realm tickets with capaths for $R -> $R7"
${kgetcred} foo@${R7} || { ec=1 ; eval "${testfailed}"; }
echo "Should not get x-realm tickets with capaths for $R -> $R8"
${kgetcred} foo@${R8} && { ec=1 ; eval "${testfailed}"; }
${kdestroy}
echo "Testing capaths logic (reverse order)"
@@ -418,10 +432,13 @@ ${kinit} --password-file=${objdir}/foopassword \
echo "Getting x-realm tickets with hierarchical referrals for $H3 -> $H1"
${kgetcred} --hostbased --canonicalize foo host.${h1} || { ec=1 ; eval "${testfailed}"; }
fgrep "cross-realm ${H3} -> ${H1} via [${H2}, ${R}]" messages.log > /dev/null || { ec=1 ; eval "${testfailed}"; }
echo "Getting x-realm tickets with hierarchical referrals for $H3 -> $R"
${kgetcred} --hostbased --canonicalize foo host.${r} || { ec=1 ; eval "${testfailed}"; }
fgrep "cross-realm ${H3} -> ${R} via [${H2}]" messages.log > /dev/null || { ec=1 ; eval "${testfailed}"; }
echo "Getting x-realm tickets with hierarchical referrals for $H3 -> $H2"
${kgetcred} --hostbased --canonicalize foo host.${h2} || { ec=1 ; eval "${testfailed}"; }
fgrep "cross-realm ${H3} -> ${H2}" messages.log > /dev/null || { ec=1 ; eval "${testfailed}"; }
${kdestroy}
echo "Testing multi-hop [capaths] referral logic"

4
tests/kdc/krb5.conf.in
View File

@@ -40,6 +40,9 @@
SOME-REALM7.UK = {
kdc = localhost:@port@
}
SOME-REALM8.UK = {
kdc = localhost:@port@
}
TEST-HTTP.H5L.SE = {
kdc = http/localhost:@port@
}
@@ -147,6 +150,7 @@
SOME-REALM6.US = SOME-REALM5.FR
SOME-REALM7.UK = SOME-REALM6.US
SOME-REALM7.UK = SOME-REALM5.FR
SOME-REALM8.UK = SOME-REALM6.US
}
H4.H2.TEST.H5L.SE = {
H1.TEST.H5L.SE = H3.H2.TEST.H5L.SE