Hi Brian,
I've uploaded heimdal with the attached debdiff to delayed/2. Let me
know if you're o.k. with it and I'll reuplod without delay.
Cheers,
-- Guido
diff --git a/debian/changelog b/debian/changelog
index ff30793..8d5c8be 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,11 @@
+heimdal (7.1.0+dfsg-13.1) unstable; urgency=medium
+
+ * Non-maintainer upload
+ * CVE-2017-11103: Fix Orpheus' Lyre KDC-REP service name validation.
+ (Closes: #868208)
+
+ -- Guido Günther <a...@sigxcpu.org> Fri, 14 Jul 2017 14:43:35 +0200
+
heimdal (7.1.0+dfsg-13) unstable; urgency=medium
* Add missing symbols base64_decode and base64_encode back into
diff --git a/debian/patches/CVE-2017-11103-Orpheus-Lyre-KDC-REP-service-name-validati.patch b/debian/patches/CVE-2017-11103-Orpheus-Lyre-KDC-REP-service-name-validati.patch
new file mode 100644
index 0000000..2ba14d8
--- /dev/null
+++ b/debian/patches/CVE-2017-11103-Orpheus-Lyre-KDC-REP-service-name-validati.patch
@@ -0,0 +1,30 @@
+From: =?utf-8?q?Guido_G=C3=BCnther?= <a...@sigxcpu.org>
+Date: Fri, 14 Jul 2017 14:41:53 +0200
+Subject: CVE-2017-11103: Orpheus' Lyre KDC-REP service name validation
+
+In _krb5_extract_ticket() the KDC-REP service name must be obtained from
+encrypted version stored in 'enc_part' instead of the unencrypted
+version
+stored in 'ticket'. Use of the unecrypted version provides an
+opportunity for successful server impersonation and other attacks.
+
+Identified by Jeffrey Altman, Viktor Duchovni and Nico Williams.
+---
+ lib/krb5/ticket.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/lib/krb5/ticket.c b/lib/krb5/ticket.c
+index d95d96d..b8d81c6 100644
+--- a/lib/krb5/ticket.c
++++ b/lib/krb5/ticket.c
+@@ -705,8 +705,8 @@ _krb5_extract_ticket(krb5_context context,
+ /* check server referral and save principal */
+ ret = _krb5_principalname2krb5_principal (context,
+ &tmp_principal,
+- rep->kdc_rep.ticket.sname,
+- rep->kdc_rep.ticket.realm);
++ rep->enc_part.sname,
++ rep->enc_part.srealm);
+ if (ret)
+ goto out;
+ if((flags & EXTRACT_TICKET_ALLOW_SERVER_MISMATCH) == 0){
diff --git a/debian/patches/series b/debian/patches/series
index 4189cdf..1045627 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -16,3 +16,4 @@ disable_iprop
canonical_host
CVE-2017-6594
0018-Add-back-in-base64_encode-and-base64_decode.patch
+CVE-2017-11103-Orpheus-Lyre-KDC-REP-service-name-validati.patch
