From 169bc039065ea202246bceba8598472711de2346 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Wed, 30 Jan 2019 23:49:07 +0200 Subject: CVE-2018-16860 Heimdal KDC: Reject PA-S4U2Self with unkeyed checksum BUG: https://bugzilla.samba.org/show_bug.cgi?id=13685 Signed-off-by: Isaac Boukris Reviewed-by: Andrew Bartlett Signed-off-by: Andrew Bartlett --- source4/heimdal/kdc/krb5tgs.c | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'source4/heimdal/kdc/krb5tgs.c') diff --git a/source4/heimdal/kdc/krb5tgs.c b/source4/heimdal/kdc/krb5tgs.c index a888788bb6f..ff7d93138c0 100644 --- a/source4/heimdal/kdc/krb5tgs.c +++ b/source4/heimdal/kdc/krb5tgs.c @@ -1925,6 +1925,13 @@ server_lookup: goto out; } + if (!krb5_checksum_is_keyed(context, self.cksum.cksumtype)) { + free_PA_S4U2Self(&self); + kdc_log(context, config, 0, "Reject PA-S4U2Self with unkeyed checksum"); + ret = KRB5KRB_AP_ERR_INAPP_CKSUM; + goto out; + } + ret = _krb5_s4u2self_to_checksumdata(context, &self, &datack); if (ret) goto out; -- cgit v1.2.1