Subject: Editing and content comments + Security concern

From: "Douglas E. Engert" <[email-masked]>
Date: Wed, 02 Oct 2002 07:31:38 -0500

3.1.3 p3  "If there is more than one supported strong encryption type in the etype 
           list, the first valid etype..." Should it read the first strong valid etype..."
           
3.1.5 p2 " user user "

3.3.1 p2 Using a network service to obtain the configuration path could be a point of
attack,
if the network service was to return a path which was not the "correct" path. This could
lead
a valid KDC but one not on the correct path to substitute its own path to the expect
expected,
realm, so it can impersonate a host, so as to obtain a forward credential of a user. 
For example, A, B, C and H are realms. B shared keys with a A, C and H. user@A wants to get
to
server@C. Hackers control DNS, which might be used as the network service. Network service
should return path as A, B, C, but returns A, B, H, C. H and DNS then routes the user to 
a dummy realm C, which returns dummy server@C. User then forwards TGT to the dummy server.
which is then used to attack impersonate the user in any realm.  
Moral of the story: User must trust the network service to return valid path. 
Because of section 3.3.3 p2 "closest" This attack may only work if clint  had contacted a 
service in H first, and had a TGT for H, and thought the path to C was via H.   

3.4.1 "Transfer interrupted"...

-- 

 Douglas E. Engert  <[email-masked]>
 Argonne National Laboratory
 9700 South Cass Avenue
 Argonne, Illinois  60439 
 (630) 252-5444