heimdal: CVE-2019-14870

Debian Bug report logs - #946786
heimdal: CVE-2019-14870

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: heimdal: CVE-2019-14870

Date: Sun, 15 Dec 2019 21:33:26 +0100

Source: heimdal
Version: 7.5.0+dfsg-3
Severity: important
Tags: security upstream

Hi,

The following vulnerability was published for heimdal.

CVE-2019-14870[0]:
| All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and
| 4.11.x before 4.11.3 have an issue, where the S4U (MS-SFU) Kerberos
| delegation model includes a feature allowing for a subset of clients
| to be opted out of constrained delegation in any way, either S4U2Self
| or regular Kerberos authentication, by forcing all tickets for these
| clients to be non-forwardable. In AD this is implemented by a user
| attribute delegation_not_allowed (aka not-delegated), which translates
| to disallow-forwardable. However the Samba AD DC does not do that for
| S4U2Self and does set the forwardable flag even if the impersonated
| client has the not-delegated flag set.

This issue affects as well heimdal itself.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2019-14870
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14870
[1] https://github.com/heimdal/heimdal/pull/663
[2] https://github.com/heimdal/heimdal/pull/664 (port to 7.1 branch)

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Send a report that this bug log contains spam.