git: 143a962d0e87 - stable/13 - Heimdal: CVE-2018-16860 Heimdal KDC: Reject PA-S4U2Self with unkeyed checksum

The branch stable/13 has been updated by cy:

URL: https://cgit.FreeBSD.org/src/commit/?id=143a962d0e871c60b91589aa1045afdeca13742b

commit 143a962d0e871c60b91589aa1045afdeca13742b
Author:     Cy Schubert <cy@FreeBSD.org>
AuthorDate: 2024-02-14 20:04:30 +0000
Commit:     Cy Schubert <cy@FreeBSD.org>
CommitDate: 2024-02-21 13:44:08 +0000

    Heimdal: CVE-2018-16860 Heimdal KDC: Reject PA-S4U2Self with unkeyed checksum
    
    Upstream's explanation of the problem:
    
        S4U2Self is an extension to Kerberos used in Active Directory to allow
        a service to request a kerberos ticket to itself from the Kerberos Key
        Distribution Center (KDC) for a non-Kerberos authenticated user
        (principal in Kerboros parlance). This is useful to allow internal
        code paths to be standardized around Kerberos.
    
        S4U2Proxy (constrained-delegation) is an extension of this mechanism
        allowing this impersonation to a second service over the network. It
        allows a privileged server that obtained a S4U2Self ticket to itself
        to then assert the identity of that principal to a second service and
        present itself as that principal to get services from the second
        service.
    
        There is a flaw in Samba's AD DC in the Heimdal KDC. When the Heimdal
        KDC checks the checksum that is placed on the S4U2Self packet by the
        server to protect the requested principal against modification, it
        does not confirm that the checksum algorithm that protects the user
        name (principal) in the request is keyed.  This allows a
        man-in-the-middle attacker who can intercept the request to the KDC to
        modify the packet by replacing the user name (principal) in the
        request with any desired user name (principal) that exists in the KDC
        and replace the checksum protecting that name with a CRC32 checksum
        (which requires no prior knowledge to compute).
    
        This would allow a S4U2Self ticket requested on behalf of user name
        (principal) user@EXAMPLE.COM to any service to be changed to a
        S4U2Self ticket with a user name (principal) of
        Administrator@EXAMPLE.COM. This ticket would then contain the PAC of
        the modified user name (principal).
    
    Reported by:    emaste
    Security:       CVE-2018-16860
    Obtained from:  Upstream c6257cc2c
    
    (cherry picked from commit 24339377490f9e362d040712b534d2963decd2d7)
---
 crypto/heimdal/kdc/krb5tgs.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/crypto/heimdal/kdc/krb5tgs.c b/crypto/heimdal/kdc/krb5tgs.c
index cde869522e23..cf1cd3dc1ad0 100644
--- a/crypto/heimdal/kdc/krb5tgs.c
+++ b/crypto/heimdal/kdc/krb5tgs.c
@@ -1892,6 +1892,13 @@ server_lookup:
 		goto out;
 	    }
 
+	    if (!krb5_checksum_is_keyed(context, self.cksum.cksumtype)) {
+		free_PA_S4U2Self(&self);
+		kdc_log(context, config, 0, "Reject PA-S4U2Self with unkeyed checksum");
+		ret = KRB5KRB_AP_ERR_INAPP_CKSUM;
+		goto out;
+	    }
+
 	    ret = _krb5_s4u2self_to_checksumdata(context, &self, &datack);
 	    if (ret)
 		goto out;