checkPassword is insecure about ccs-pykerberos

[macosforgebot]

@wsanchez originally submitted this as comment:1:⁠ticket:833

• Owner changed from @wsanchez to @cyrusdaboo
• Milestone set to Later

[macosforgebot]

@cyrusdaboo originally submitted this as comment:8:⁠ticket:833

• Status changed from new to closed
• Resolution set to Documentation changed

---

Added comments on checkPassword in r13268.

[macosforgebot]

@wsanchez originally submitted this as comment:9:⁠ticket:833

• Status changed from closed to reopened
• Resolution Documentation changed deleted

---

Hrm, I wanna re-open this. I'd suggest we rename checkPassword to checkPassword_insecure so that it's clearly marked as a bad idea, and maybe made private (leading underbar or something).

But unless fixing the implementation as suggested doesn't make sense, I think this bug should stay open.

[HariSekhon]

What is the implication of using this method for infrastructure testing & monitoring?

KDC spoofing might result in a false positive that infrastructure is online but would it result in credential compromise given Krb is designed to run over untrusted networks and only hashes timestamps and tickets instead of sending the actual pw/hashes? Is there any way it could lead to TGT theft or similar?

[bjornfor]

Link to CVE entry about this security issue: https://www.cvedetails.com/cve/CVE-2015-3206/

[mohitbaviskar1999]

@cyrusdaboo are you still working on this issue ?