RT RT/krbdev.mit.edu: Ticket #6877 Don't reject AP-REQs based on PACs Signed in as guest.
[Logout]

[Home] [Search] [Configuration]

[Display] [History] [Basics] [Dates] [People] [Links] [Jumbo]

 
 

 The Basics  
Id
6877
Status
resolved
Worked
0 min
Priority
0/0
Queue
krb5
 

 Keyword Selections  
Component
Tags
Version_reported
Version_Fixed
  • 1.8.4
Target_Version
 

 Relationships  
Depends on:
Depended on by:
Parents:
Children:

Refers to:
  • 6839: (tlyu) handle MS PACs that lack server checksum [resolved]
  • 6870: (ghudson) Don't reject AP-REQs based on PACs [resolved]
Referred to by:
 
 Dates  
Created: Mon Feb 28 12:42:33 2011
Starts: Not set
Started: Mon Feb 28 12:42:33 2011
Last Contact: Not set
Due: Not set
Updated: Mon Feb 28 13:12:43 2011 by tlyu
 

 People  
Owner
 tlyu
Requestors
 tlyu@mit.edu
Cc
 
AdminCc
 
 

 More about Taylor Yu  
Comments about this user:
No comment entered about this user
This user's 25 highest priority tickets:
 

History   Display mode: [Brief headers] [Full headers]
      Mon Feb 28 12:42:33 2011  tlyu - Ticket created    
     
From: tlyu@mit.edu
Subject: SVN Commit


back-port r24640 from trunk

 ------------------------------------------------------------------------
 r24640 | ghudson | 2011-02-16 18:34:37 -0500 (Wed, 16 Feb 2011) | 14 lines

 ticket: 6870
 subject: Don't reject AP-REQs based on PACs
 target_version: 1.9.1
 tags: pullup

 Experience has shown that it was a mistake to fail AP-REQ verification
 based on failure to verify the signature of PAC authdata contained in
 the ticket.  We've had two rounds of interoperability issues with the
 hmac-md5 checksum code, an interoperability issue OSX generating
 unsigned PACs, and another problem where PACs are copied by older KDCs
 from a cross-realm TGT into the service ticket.  If a PAC signature
 cannot be verified, just don't mark it as verified and continue on
 with the AP exchange.

https://github.com/krb5/krb5/commit/c34804a019ce01c52684d52c2822ce2682af7c5d
Commit By: tlyu
Revision: 24671
Changed Files:
U   branches/krb5-1-8/src/lib/krb5/krb/pac.c


Download (untitled) 960b
      Mon Feb 28 12:42:33 2011  tlyu - Requestor tlyu@mit.edu added    
      Mon Feb 28 12:42:33 2011  tlyu - Status changed from new to resolved    
      Mon Feb 28 12:42:33 2011  tlyu - Version_Fixed 1.8.4 added    
      Mon Feb 28 13:12:43 2011  tlyu - Ticket 6877 RefersTo ticket 6870.    
      Mon Feb 28 13:12:43 2011  tlyu - Ticket 6877 RefersTo ticket 6839.