Repository navigation
kerberos: check ticket and authenticator times in KerberosSSP acceptor - #5240
Open
musthaf-bughunter wants to merge 1 commit into
Open
musthaf-bughunter wants to merge 1 commit into
musthaf-bughunter wants to merge 1 commit into
Conversation
GSS_Accept_sec_context never checked the ticket validity period or the authenticator timestamp (RFC4120 sect 3.2.3), so expired tickets and replayed AP-REQs were accepted. AI-Assisted: yes (Claude Opus 5.5)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
KerberosSSP.GSS_Accept_sec_contextdecrypts the ticket and the authenticator but never checks the ticketstarttime/endtimeor the authenticatorctime(kerberos.py#L5903-L5931). A server usingKerberosSSP(SMB, LDAP, DCE/RPC) therefore accepts expired tickets, and an AP-REQ captured on the wire can be replayed at any later time.The patch applies the RFC4120 sect 3.2.3 checks with a 5 minute skew and returns
KRB_AP_ERR_TKT_NYV/KRB_AP_ERR_TKT_EXPIRED/KRB_AP_ERR_SKEW. Passive mode (pcap decryption) skips them. Thedcerpc.utsKerberosSSP functional test used a captured, expired ticket, so it now refreshes its times withTicketer. A regression test is added tokerberos.uts.