CVE-2018-16860 Heimdal KDC: Reject PA-S4U2Self with unkeyed checksum

[metze/samba/wip.git] / source4 / heimdal / kdc / krb5tgs.c

diff --git a/source4/heimdal/kdc/krb5tgs.c b/source4/heimdal/kdc/krb5tgs.c
index a888788bb6fd60e66bf45be033bcb9f1aa5fef84..ff7d93138c05d0a1995fae574144fd700754b4cd 100644 (file)
--- a/source4/heimdal/kdc/krb5tgs.c
+++ b/source4/heimdal/kdc/krb5tgs.c
@@ -1925,6 +1925,13 @@ server_lookup:
                goto out;
            }
 
+           if (!krb5_checksum_is_keyed(context, self.cksum.cksumtype)) {
+               free_PA_S4U2Self(&self);
+               kdc_log(context, config, 0, "Reject PA-S4U2Self with unkeyed checksum");
+               ret = KRB5KRB_AP_ERR_INAPP_CKSUM;
+               goto out;
+           }
+
            ret = _krb5_s4u2self_to_checksumdata(context, &self, &datack);
            if (ret)
                goto out;