[src/netbsd-6-0]: src/crypto/external/bsd/heimdal/dist/lib/krb5 Pull up follo...

[martin <martin%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/5841ee7f5d10
branches:  netbsd-6-0
changeset: 775210:5841ee7f5d10
user:      martin <martin%NetBSD.org@localhost>
date:      Thu Jul 13 09:45:57 2017 +0000

description:
Pull up following revision(s) (requested by christos in ticket #1461):
        crypto/external/bsd/heimdal/dist/lib/krb5/ticket.c: revision 1.3
        crypto/external/bsd/heimdal/dist/lib/krb5/ticket.c: revision 1.4
<a  rel="nofollow" href="https://orpheus-lyre.info/design/index.html";>https://orpheus-lyre.info/design/index.html</a>
<a  rel="nofollow" href="https://github.com/heimdal/heimdal/commit/6dd3eb836bbb80a00ffced4ad57077a1cdf227ea";>https://github.com/heimdal/heimdal/commit/6dd3eb836bbb80a00ffced4ad57077a1cdf227ea</a>
In _krb5_extract_ticket() the KDC-REP service name must be obtained from
encrypted version stored in 'enc_part' instead of the unencrypted version
stored in 'ticket'.  Use of the unecrypted version provides an
opportunity for successful server impersonation and other attacks.
Identified by Jeffrey Altman, Viktor Duchovni and Nico Williams.
XXX: pullup 6, 7, 8.
fix typo.

diffstat:

 crypto/external/bsd/heimdal/dist/lib/krb5/ticket.c |  6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)

diffs (20 lines):

diff -r 34d6e07cfb16 -r 5841ee7f5d10 crypto/external/bsd/heimdal/dist/lib/krb5/ticket.c
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/ticket.c        Tue Jul 11 21:28:11 2017 +0000
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/ticket.c        Thu Jul 13 09:45:57 2017 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: ticket.c,v 1.1.1.1 2011/04/13 18:15:39 elric Exp $     */
+/*     $NetBSD: ticket.c,v 1.1.1.1.12.1 2017/07/13 09:45:57 martin Exp $       */
 
 /*
  * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan
@@ -715,8 +715,8 @@
     /* check server referral and save principal */
     ret = _krb5_principalname2krb5_principal (context,
                                              &tmp_principal,
-                                             rep->kdc_rep.ticket.sname,
-                                             rep->kdc_rep.ticket.realm);
+                                             rep->enc_part.sname,
+                                             rep->enc_part.srealm);
     if (ret)
        goto out;
     if((flags & EXTRACT_TICKET_ALLOW_SERVER_MISMATCH) == 0){