From: Andrew Bartlett Date: Tue, 1 Nov 2022 01:47:12 +0000 (+1300) Subject: CVE-2022-37966 HEIMDAL: Look up the server keys to combine with clients etype list... X-Git-Tag: talloc-2.4.0~309 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=538315a2aa6d03b7639b49eb1576efa8755fefec;p=thirdparty%2Fsamba.git CVE-2022-37966 HEIMDAL: Look up the server keys to combine with clients etype list to select a session key We need to select server, not client, to compare client etypes against. (It is not useful to compare the client-supplied encryption types with the client's own long-term keys.) BUG: https://bugzilla.samba.org/show_bug.cgi?id=15237 Signed-off-by: Andrew Bartlett Reviewed-by: Stefan Metzmacher --- diff --git a/selftest/knownfail_heimdal_kdc b/selftest/knownfail_heimdal_kdc index a97ccb7d71a..9f492f81402 100644 --- a/selftest/knownfail_heimdal_kdc +++ b/selftest/knownfail_heimdal_kdc @@ -163,8 +163,3 @@ ^samba.tests.krb5.group_tests.samba.tests.krb5.group_tests.GroupTests.test_group_resource_sids_given_compression_tgs_req_to_krbtgt.ad_dc ^samba.tests.krb5.group_tests.samba.tests.krb5.group_tests.GroupTests.test_group_resource_sids_given_compression_tgs_req_to_service.ad_dc ^samba.tests.krb5.group_tests.samba.tests.krb5.group_tests.GroupTests.test_group_resource_sids_given_no_compression_tgs_req_to_krbtgt.ad_dc -# -# Encryption type tests -# -^samba.tests.krb5.etype_tests.samba.tests.krb5.etype_tests.EtypeTests.test_as_aes_requested.ad_dc -^samba.tests.krb5.etype_tests.samba.tests.krb5.etype_tests.EtypeTests.test_as_rc4_supported_aes_requested.ad_dc diff --git a/third_party/heimdal/kdc/kerberos5.c b/third_party/heimdal/kdc/kerberos5.c index 0a7934310cc..3e0f2dbd6b6 100644 --- a/third_party/heimdal/kdc/kerberos5.c +++ b/third_party/heimdal/kdc/kerberos5.c @@ -2212,7 +2212,7 @@ _kdc_as_rep(astgs_request_t r) * intersection of the client's requested enctypes and the server's (like a * root krbtgt, but not necessarily) etypes from its HDB entry. */ - ret = _kdc_find_etype(r, (is_tgs ? KFE_IS_TGS:0) | KFE_USE_CLIENT, + ret = _kdc_find_etype(r, (is_tgs ? KFE_IS_TGS:0), b->etype.val, b->etype.len, &r->sessionetype, NULL, NULL); if (ret) {