[src/netbsd-6-0]: src/doc Ticket #1461

[martin <martin%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/3f8e1faa1325
branches:  netbsd-6-0
changeset: 775211:3f8e1faa1325
user:      martin <martin%NetBSD.org@localhost>
date:      Thu Jul 13 09:47:03 2017 +0000

description:
Ticket #1461

diffstat:

 doc/CHANGES-6.0.7 |  13 ++++++++++++-
 1 files changed, 12 insertions(+), 1 deletions(-)

diffs (24 lines):

diff -r 5841ee7f5d10 -r 3f8e1faa1325 doc/CHANGES-6.0.7
--- a/doc/CHANGES-6.0.7 Thu Jul 13 09:45:57 2017 +0000
+++ b/doc/CHANGES-6.0.7 Thu Jul 13 09:47:03 2017 +0000
@@ -1,4 +1,4 @@
-# $NetBSD: CHANGES-6.0.7,v 1.1.2.98 2017/07/11 21:28:11 snj Exp $
+# $NetBSD: CHANGES-6.0.7,v 1.1.2.99 2017/07/13 09:47:03 martin Exp $
 
 A complete list of changes from the NetBSD 6.0.6 release to the NetBSD 6.0.7
 release:
@@ -12271,3 +12271,14 @@
        Fix CVE-2017-10971 and CVE-2017-10972.
        [mrg, ticket #1459]
 
+crypto/external/bsd/heimdal/dist/lib/krb5/ticket.c 1.3-1.4
+
+       In _krb5_extract_ticket() the KDC-REP service name must be
+       obtained from encrypted version stored in 'enc_part' instead
+       of the unencrypted version stored in 'ticket'.
+       Use of the unecrypted version provides an opportunity for
+       successful server impersonation and other attacks.
+
+       Identified by Jeffrey Altman, Viktor Duchovni and Nico Williams.
+       [christos, ticket #1461]
+