Fix KDC uninit ptrs [CVE-2012-1014 CVE-2012-1015]

Fix KDC heap corruption and crash vulnerabilities [MITKRB5-SA-2012-001
CVE-2012-1014 CVE-2012-1015].

CVE-2012-1015: The cleanup code in kdc_handle_protected_negotiation()
in kdc_util.c could free an uninitialized pointer in some error
conditions involving "similar" enctypes and a failure in
krb5_c_make_checksum().  Initialize the pointer correctly.

Additionally, adjust the handling of "similar" enctypes to avoid
advertising enctypes that could lead to inadvertent triggering of
CVE-2012-1015 (possibly in unpatched KDCs).

CVE-2012-1014: process_as_req() could encounter an error condition
(typically a malformed AS-REQ message) that could cause its cleanup
code to dereference an uninitialized pointer, causing a crash.
Initialize the pointer correctly.

ticket: 7226 (new)
version_fixed: 1.10.3
status: resolved
Fix oid set construction in gss_inquire_cred()

Use gssapi calls to construct the oid sets.  It is not safe on windows
to use malloc to hand-construct the set and then call gss_release_oid_set()
to clean it up.

Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>

(cherry picked from commit 4cfdf8da69f52c778af4faaea663981a67634bb6)

ticket: 7227
version_fixed: 1.10.3
status: resolved
Further fixes for WSA/Posix error translation

Don't translate '0' (no error).
Handle WSAEAFNOSUPPORT and WSAEINVAL.
Add Posix->WSA translation.
Add default translation for unrecognized errors.

[ghudson@mit.edu: Merged with master and adjusted comments.]

Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>

(cherry picked from commit 66d8bb6d684f203d008409752c90355964443e3e)

Correct comments in port-sockets.h

(cherry picked from commit 666be8d6bd1063774c4260e2119ba4aed8fbfa9f)

ticket: 7228
version_fixed: 1.10.3
Remove unused struct and switch_to stub

Only one mslsa ccache is supported, so switch_to is not needed.
Likewise, struct krb5int_lcc_iterator is unneccesary.

Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
fix leak in cci_os_ipc_thread_init()

Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
Load additional krb5 and come_err funcs

Required for multiple identity management and for migration of code from
leashdll to leash proper.

Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
Change kfw destroy ticket confirmation message

OKCANCEL -> YESNO
Add MB_ICONEXCLAMATION
Change text

Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
Fix _APS_NEXT_* macros in leash/resource.h

Avoids conflicts when adding new resources via visual studio.

Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
Target Windows Vista in leash/stdafx.h

Define WINVER, _WIN32_WINNT to target Vista+
Required for ribbon ui.

Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
kfw allow multiple cmdline options; add "-noribbon"

Use ribbon ui by default; -noribbon reverts to old ui

Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
Leash ui menu updates

Eliminate Action menu:
 -move Ticket manipulation to File menu
 -eliminate "Reset Window Size/Pos", "Synchronize Time", "Update Display"

Update Options menu:
 -eliminate all the "Properties" items:
	"Leash ", "Kerberos ", "Kerberos v4 ", "Kerberos v5 ", and "AFS"
	TODO: move functionality to advanced install/registry keys.

Update View menu:
 -add "Time Issued", "Renewable Until", "Flags","Encryption Type"
   and "Valid Until"
 -remove "Large Icons", "Toolbar", "Status Bar", "Debug Window"

Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
kfw prep for convert to ribbon toolbar

Upgrade classes: CWinApp->CWinAppEx, CFrameWnd->CFrameWndEx,
CStatusBar->CMFCStatusBar, CToolBar->CMFCToolBar.
Call AfxOleInit() from CLeashApp::InitInstance()
Do not call LoadBarState() (crashes)
or GetToolTarCtrl() (no longer exists)

Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
MSVC-generated updates to support ribbon ui.

Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
kfw implement ribbon UI

Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
Base LeashView on ListView; ViewColumn abstraction

Punting FormView since we really only need the ListCtrl and using
ListView makes the header column and window resizing work.
ViewColumn abstraction eliminates some copy/paste code blocks.
HDN_ITEMCHANGED tracks user changes to column widths.
Remove CTreeCtrl-related code.
Also remove some unused code that was generating warnings.

Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
Only create toolbar when not using ribbon UI

When we do create the toolbar, dock it.

Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
kfw "Initialize Ticket" -> "Get Ticket"

Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
leash refactoring prep for multiple identity support

Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
LeashKRB5GetTickets() iterates all credential caches, a la 'klist -A'

TODO: still uses only a single TICKETINFO which does not seem correct.

Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
Add krbrTimestampToFileTime() utility to LeashView.cpp