From 5dd54c880f7fc9f78eee2a33a616ff35f4f4926b Mon Sep 17 00:00:00 2001
From: christos <christos@NetBSD.org>
Date: Tue, 11 Jul 2017 17:45:31 +0000
Subject: [PATCH] https://orpheus-lyre.info/design/index.html
 https://github.com/heimdal/heimdal/commit/6dd3eb836bbb80a00ffced4ad57077a1cdf227ea

In _krb5_extract_ticket() the KDC-REP service name must be obtained from
encrypted version stored in 'enc_part' instead of the unencrypted version
stored in 'ticket'.  Use of the unecrypted version provides an
opportunity for successful server impersonation and other attacks.

Identified by Jeffrey Altman, Viktor Duchovni and Nico Williams.

XXX: pullup 6, 7, 8.
---
 crypto/external/bsd/heimdal/dist/lib/krb5/ticket.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/crypto/external/bsd/heimdal/dist/lib/krb5/ticket.c b/crypto/external/bsd/heimdal/dist/lib/krb5/ticket.c
index 343ef7bd4c7d..66f048376917 100644
--- a/crypto/external/bsd/heimdal/dist/lib/krb5/ticket.c
+++ b/crypto/external/bsd/heimdal/dist/lib/krb5/ticket.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ticket.c,v 1.2 2017/01/28 21:31:49 christos Exp $	*/
+/*	$NetBSD: ticket.c,v 1.3 2017/07/11 17:45:31 christos Exp $	*/
 
 /*
  * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan
@@ -707,8 +707,8 @@ _krb5_extract_ticket(krb5_context context,
     /* check server referral and save principal */
     ret = _krb5_principalname2krb5_principal (context,
 					      &tmp_principal,
-					      rep->kdc_rep.ticket.sname,
-					      rep->kdc_rep.ticket.realm);
+					      rep->enc_part.sname,
+					      rep->enc_part.realm);
     if (ret)
 	goto out;
     if((flags & EXTRACT_TICKET_ALLOW_SERVER_MISMATCH) == 0){