[11824] in Kerberos-V5-bugs
[krbdev.mit.edu #6833] SVN Commit
daemon@ATHENA.MIT.EDU (Tom Yu via RT)
Sat Dec 4 00:11:21 2010
Mail-followup-to: rt@krbdev.mit.edu
mail-copies-to: never
From: "Tom Yu via RT" <rt-comment@krbdev.MIT.EDU>
In-Reply-To: <rt-6833@krbdev.mit.edu>
Message-ID: <rt-6833-33578.0.896364614202625@krbdev.mit.edu>
To: "'AdminCc of krbdev.mit.edu Ticket #6833'":;"'AdminCc of krbdev.mit.edu Ticket #6833'":;@MIT.EDU
Date: Sat, 4 Dec 2010 00:11:05 -0500 (EST)
Reply-To: rt-comment@krbdev.MIT.EDU
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krb5-bugs-bounces@mit.edu
Apply patch for MITKRB5-SA-2010-007.
Fix multiple checksum handling bugs, as described in:
CVE-2010-1324
CVE-2010-1323
CVE-2010-4020
CVE-2010-4021
* Return the correct (keyed) checksums as the mandatory checksum type
for DES enctypes.
* Restrict simplified-profile checksums to their corresponding etypes.
* Add internal checks to reduce the risk of stream ciphers being used
with simplified-profile key derivation or other algorithms relying
on the block encryption primitive.
* Use the mandatory checksum type for the PKINIT KDC signature,
instead of the first-listed keyed checksum.
* Use the mandatory checksum type when sending KRB-SAFE messages by
default, instead of the first-listed keyed checksum.
* Use the mandatory checksum type for the t_kperf test program.
* Use the mandatory checksum type (without additional logic) for the
FAST request checksum.
* Preserve the existing checksum choices (unkeyed checksums for DES
enctypes) for the authenticator checksum, using explicit logic.
* Ensure that SAM checksums received from the KDC are keyed.
* Ensure that PAC checksums are keyed.
http://src.mit.edu/fisheye/changelog/krb5/?cs=24560
Commit By: tlyu
Revision: 24560
Changed Files:
U branches/krb5-1-8/src/lib/crypto/krb/cksumtypes.c
U branches/krb5-1-8/src/lib/crypto/krb/dk/derive.c
U branches/krb5-1-8/src/lib/crypto/krb/keyed_checksum_types.c
U branches/krb5-1-8/src/lib/gssapi/krb5/util_crypt.c
U branches/krb5-1-8/src/lib/krb5/krb/mk_safe.c
U branches/krb5-1-8/src/lib/krb5/krb/pac.c
U branches/krb5-1-8/src/lib/krb5/krb/preauth2.c
U branches/krb5-1-8/src/plugins/preauth/pkinit/pkinit_srv.c
_______________________________________________
krb5-bugs mailing list
krb5-bugs@mit.edu
https://mailman.mit.edu/mailman/listinfo/krb5-bugs
