Change KRB5KDC_ERR_NO_ACCEPTABLE_KDF to 100

draft-ietf-krb-wg-pkinit-alg-agility-07 specifies
KDC_ERR_NO_ACCEPTABLE_KDF as 82, but this value conflicts with
KRB_AP_ERR_PRINCIPAL_UNKNOWN from RFC 6111.  The former value has been
reassigned to 100 to fix the conflict.  Use the correct value.

We believe that this error won't crop up in practice for a long time
(when SHA-2 has been superceded by other hash algorithms and people
are desupporting it), by which time implementations will mostly have
been upgraded to use the new value.

(cherry picked from commit 2938851a5ec77ab68bcd1f5cfd07991c7ccabea6)

ticket: 7725 (new)
version_fixed: 1.10.7
status: resolved
Fix typos in kdb5_util master key command outputs

kdb5_util list_mkeys was beginning lines with "KNVO" instead of
"KVNO".  kdb5_util purge_mkeys was displaying "follwing" instead of
"following" for both dry-run and normal cases.

(cherry picked from commit 7fee58ccadf1b61eec9a8c62f47dac43986e2ad1)

ticket: 7744 (new)
version_fixed: 1.10.7
status: resolved
Correctly activate master keys in pre-1.7 KDBs

Starting with 1.7, databases are created with actkvno tl-data in the
K/M entry which gives the initial master key version an activation
time of 0.  A database created before 1.7 will not have this tl-data,
but we should behave in the same way as we do for a more recent
database.

Move the actkvno list synthesis code from krb5_dbe_fetch_act_key_list
to krb5_dbe_lookup_actkvno so it applies to kdb5_util commands as well
as libkadm5.  Synthesize the same list as we would have initialized
the KDB with, with an activation time of 0 for the earliest master
key.

(cherry picked from commit ec560fac83912abaa15fb158101c8174497081c5)

ticket: 7745 (new)
version_fixed: 1.10.7
status: resolved
Fix decoding of mkey kvno in mkey_aux tl-data

krb5_dbe_lookup_mkey_aux was decoding a 16-bit value directly into an
int, resulting in the wrong value on big-endian platforms.  The
consequences are mostly invisible because we ignore this field and try
all mkey_aux nodes in krb5_def_fetch_mkey_list.

(cherry picked from commit 64ec2941af1561ef06e7e885b2ffb65a675516ce)

ticket: 7749 (new)
version_fixed: 1.10.7
status: resolved
Improve LDAP KDB initialization error messages

In krb5_ldap_initialize, don't just blat the LDAP error into the
extended message; give an indication of which LDAP operation we were
trying to do and show what parameters we gave to it.

(Also, krb5_set_error_message can handle a null context argument, so
don't bother to check before calling.)

(cherry picked from commit 5a77bb85294f37d1dfa4c7faedfdfb0d7faaf8dc)

ticket: 7750 (new)
version_fixed: 1.10.7
status: resolved
Multi-realm KDC null deref [CVE-2013-1418]

If a KDC serves multiple realms, certain requests can cause
setup_server_realm() to dereference a null pointer, crashing the KDC.

CVSSv2: AV:N/AC:M/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C

A related but more minor vulnerability requires authentication to
exploit, and is only present if a third-party KDC database module can
dereference a null pointer under certain conditions.

(back ported from commit 5d2d9a1abe46a2c1a8614d4672d08d9d30a5f8bf)

ticket: 7757 (new)
version_fixed: 1.10.7
status: resolved
Update acknowledgments
Updates for krb5-1.10.7
Update for krb5-1.10.7-postrelease
Merge remote branch 'upstream' into krb5-1.10