Kerberos Version 5, Release 1.10

                            Release Notes
                        The MIT Kerberos Team

Copyright and Other Notices
---------------------------

Copyright (C) 1985-2012 by the Massachusetts Institute of Technology
and its contributors.  All rights reserved.

Please see the file named NOTICE for additional notices.

MIT Kerberos is a project of the MIT Kerberos Consortium.  For more
information about the Kerberos Consortium, see http://kerberos.org/

For more information about the MIT Kerberos software, see
    http://web.mit.edu/kerberos/

People interested in participating in the MIT Kerberos development
effort should visit http://k5wiki.kerberos.org/

Building and Installing Kerberos 5
----------------------------------

The first file you should look at is doc/install-guide.ps; it contains
the notes for building and installing Kerberos 5.  The info file
krb5-install.info has the same information in info file format.  You
can view this using the GNU emacs info-mode, or by using the
standalone info file viewer from the Free Software Foundation.  This
is also available as an HTML file, install.html.

Other good files to look at are admin-guide.ps and user-guide.ps,
which contain the system administrator's guide, and the user's guide,
respectively.  They are also available as info files
kerberos-admin.info and krb5-user.info, respectively.  These files are
also available as HTML files.

If you are attempting to build under Windows, please see the
src/windows/README file.

Reporting Bugs
--------------

Please report any problems/bugs/comments using the krb5-send-pr
program.  The krb5-send-pr program will be installed in the sbin
directory once you have successfully compiled and installed Kerberos
V5 (or if you have installed one of our binary distributions).

If you are not able to use krb5-send-pr because you haven't been able
compile and install Kerberos V5 on any platform, you may send mail to
[email protected].

Please keep in mind that unencrypted e-mail is not secure. If you need
to report a security vulnerability, or send sensitive information,
please PGP-encrypt it to [email protected].

You may view bug reports by visiting

    http://krbdev.mit.edu/rt/

and logging in as "guest" with password "guest".

DES transition
--------------

The Data Encryption Standard (DES) is widely recognized as weak.  The
krb5-1.7 release contains measures to encourage sites to migrate away
from using single-DES cryptosystems.  Among these is a configuration
variable that enables "weak" enctypes, which defaults to "false"
beginning with krb5-1.8.

Major changes in 1.10.1
-----------------------

This is a bugfix release.

* Fix access controls for KDB string attributes [CVE-2012-1012]

* Make the ASN.1 encoding of key version numbers interoperate with
  Windows Read-Only Domain Controllers

* Avoid generating spurious password expiry warnings in cases where
  the KDC sends an account expiry time without a password expiry time.

krb5-1.10.1 changes by ticket ID
--------------------------------

7074    workaround for Solaris 8 lacking isblank
7081    Don't use stack variable address in as_req state
7082    Various lookaside cache fixes
7084    Don't check mech in krb5_gss_inquire_cred_by_mech
7087    krb5_gss_get_name_attribute fails to set display_value
7088    Fix uninitialized variable warning in trval.c
7089    Initialize gss_get_name_attribute output buffers
7092    kvno ASN.1 encoding interop with Windows RODCs
7093    Access controls for string RPCs [CVE-2012-1012]
7096    Fix KDB iteration when callback does write calls
7098    Fix spurious password expiry warning

Major changes in 1.10
---------------------

Additional background information on these changes may be found at

    http://k5wiki.kerberos.org/wiki/Release_1.10

and

    http://k5wiki.kerberos.org/wiki/Category:Release_1.10_projects

Code quality:

* Fix MITKRB5-SA-2011-006 and MITKRB5-SA-2011-007 KDC denial of
  service vulnerabilities [CVE-2011-1527 CVE-2011-1528 CVE-2011-1529
  CVE-2011-1530].

* Update the Fortuna implementation to more accurately implement the
  description in _Cryptography Engineering_, and make it the default
  PRNG.

* Add an alternative PRNG that relies on the OS native PRNG.

Developer experience:

* Add the ability for GSSAPI servers to use any keytab key for a
  specified service, if the server specifies a host-based name with no
  hostname component.

* In the build system, identify the source files needed for
  per-message processing within a kernel and ensure that they remain
  independent.

* Allow rd_safe and rd_priv to ignore the remote address.

* Rework KDC and kadmind networking code to use an event loop
  architecture.

* Add a plugin interface for providing configuration information.

Administrator experience:

* Add more complete support for renaming principals.

* Add the profile variable ignore_acceptor_hostname in libdefaults. If
  set, GSSAPI will ignore the hostname component of acceptor names
  supplied by the server, allowing any keytab key matching the service
  to be used.

* Add support for string attributes on principal entries.

* Allow password changes to work over NATs.

End-user experience:

* Add the DIR credential cache type, which can hold a collection of
  credential caches.

* Enhance kinit, klist, and kdestroy to support credential cache
  collections if the cache type supports it.

* Add the kswitch command, which changes the selected default cache
  within a collection.

* Add heuristic support for choosing client credentials based on the
  service realm.

* Add support for $HOME/.k5identity, which allows credential choice
  based on configured rules.

* Add support for localization. (No translations are provided in this
  release, but the infrastructure is present for redistributors to
  supply them.)

Protocol evolution:

* Make PKINIT work with FAST in the client library.

krb5-1.10 changes by ticket ID
------------------------------

6118    rename principals
6323    kadmin: rename support
6430    Avoid looping when preauth can't be generated
6617    uninitialized values used in mkey-migration code
6732    checks for openpty() aren't made using -lutil
6770    kg_unseal leads to overlap of source and desitination in memcpy...
6813    memory leak in gss_accept_sec_context
6814    Improve kdb5_util load locking and recovery
6816    potential memory leak in spnego
6817    potential null dereference in gss mechglue
6835    accept_sec_context RFC4121 support bug in 1.8.3
6851    pkinit can't parse some valid cms messages
6854    kadmin's ktremove can remove wrong entries when removing kvno 0
6855    Improve acceptor name flexibility
6857    missing ifdefs around IPv6 code
6858    Assume ELF on FreeBSD if objformat doesn't exist
6863    memory leak on SPNEGO error path
6868    Defer hostname lookups in krb5_sendto_kdc
6872    Fix memory leak in t_expire_warn
6874    Fortuna as default PRNG
6878    Add test script for user2user programs
6887    Use first principal in keytab when verifying creds
6890    Implement draft-josefsson-gss-capsulate
6891    Add gss_userok and gss_pname_to_uid
6892    Prevent bleed-through of mechglue symbols into loaded mechs
6893    error codes from error responses can be discarded when there's e-data
6894    More sensical mech selection for gss_acquire_cred/accept_sec_context
6895    gss_duplicate_name SPI for SPNEGO
6896    Allow anonymous name to be imported with empty name buffer
6897    Default principal name in the acceptor cred corresponds to
        first entry in associated keytab.
6898    Set correct minor_status value in call to gss_display_status.
6902    S4U impersonated credential KRB5_CC_NOT_FOUND
6904    Install k5login(5) as well as .k5login(5)
6905    support poll() in sendto_kdc.c
6909    Kernel subset
6910    Account lockout policy parameters not documented
6911    Account lockout policy options time format
6914    krb5-1.9.1 static compile error +preliminary patch (fwd)
6915    klist -s trips over referral entries
6918    Localize user interface strings using gettext
6921    Convert preauth_plugin.h to new plugin framework
6922    Work around glibc getaddrinfo PTR lookups
6923    Use AI_ADDRCONFIG for more efficient getaddrinfo
6924    Fix multiple libkdb_ldap memory leaks
6927    chpass_util.c improvements
6928    use timegm() for krb5int_gmt_mktime() when available
6929    Pluggable configuration
6931    Add libedit/readline support to ss.
6933    blocking recv caused our server to hang
6934    don't require a default realm
6936    multiple mechanisms and spnego_gss_init_sec_context
6944    gss_acquire_cred erroneous failure and potential segfault for caller
6945    spnego_gss_acquire_cred_impersonate_name incorrect usage of
        impersonator_cred_handle
6951    assertion failure when connections fail in service_fds()
6953    Add the DIR ccache type
6954    Add new cache collection APIs
6955    Remove unneeded cccol behaviors
6956    Add ccache collection support to tools
6957    Add krb5_cc_select() API and pluggable interface
6958    Make gss-krb5 use cache collection
6961    Support pkinit: SignedData with no signers (KDC)
6962    pkinit: client: Use SignedData for anonymous
6964    Support special salt type in default krb5_dbe_cpw.
6965    Remove CFLAGS and external deps from krb5-config --libs
6966    Eliminate domain-based client realm walk
6968    [PATCH] Man page fixes
6969    Create e_data as pa_data in KDC interfaces.
6971    Use type-safe callbacks in preauth interface
6974    Make krb5_pac_sign public
6975    Add PKINIT NSS support
6976    Hide gak_fct interface and arguments in clpreauth
6977    Install krb5/preauth_plugin.h
6978    Allow rd_priv/rd_safe without remote address
6979    Allow password changes over NATs
6980    Ensure termination in Windows vsnprintf wrapper
6981    SA-2011-006 KDC denial of service [CVE-2011-1527 CVE-2011-1528
        CVE-2011-1529]
6987    Fix krb5_cc_set_config
6988    Fix handling of null edata method in KDC preauth
6989    fix tar invocation in mkrel
6992    Make krb5_find_authdata public
6994    Fix intermediate key length in hmac-md5 checksum
6995    Initialize typed_e_data in as_req_state
6996    Make krb5_check_clockskew public
6997    don't build po/ if msgfmt is missing
6999    compile warnings, mininum version check for pkinit (NSS code paths)
7000    Exit on error in kadmind kprop child
7002    verto sshould have a pointer to upstream sources and be in NOTICE
7003    Fix month/year units in getdate
7006    Fix format string for TRACE_INIT_CREDS_SERVICE
7014    Fix com_err.h dependencies in gss-kernel-lib
7015    Add plugin interface_names entry for ccselect
7017    Simplify and fix kdcpreauth request_body callback
7018    Update verto to 0.2.2 release
7019    Make verto context available to kdcpreauth modules
7020    reading minor error message doesn't work for the IAKERB mech
7021    Fix failure interval of 0 in LDAP lockout code
7023    Clean up client-side preauth error data handling
7027    FAST PKINIT
7029    Fix --with-system-verto without pkg-config
7030    Ldap dependency for parallel builds
7033    krb5 1.10 KRB5_PADATA_ENC_TIMESTAMP isn't working
7034    mk_cred: memory management
7035    krb5_lcc_store() now ignores config credentials
7036    Fix free ofuninitialized memory in sname_to_princ
7037    Use LsaDeregisterLogonProcess(), not CloseHandle()
7038    Added support for loading of Krb5.ini from Windows APPDATA
7039    Handle TGS referrals to the same realm
7042    SA-2011-007 KDC null pointer deref in TGS handling [CVE-2011-1530]
7049    Fix subkey memory leak in krb5_get_credentials
7050    KfW changes for krb5-1.10
7051    krb5_server_decrypt_ticket_keytab wrongly succeeds
7053    Verify acceptor's mech in SPNEGO initiator
7055    Rename Table of Contents.hhc
7057    Krb5 1.9.x does not build on Solaris 8 - Implicit function
        declaration error
7060    Convert securid module edata method
7065    delete duplicate NOTICE file
7067    documentation license to CC-BY-SA 3.0 Unported
7077    LIBS should not include PKINIT_CRYPTO_IMPL_LIBS
7078    Use INSTALL_DATA to install message catalogues

Acknowledgements
----------------

Past and present Sponsors of the MIT Kerberos Consortium:

    Apple
    Carnegie Mellon University
    Centrify Corporation
    Columbia University
    Cornell University
    The Department of Defense of the United States of America (DoD)
    Fidelity Investments
    Google
    Iowa State University
    MIT
    Michigan State University
    Microsoft
    The National Aeronautics and Space Administration
        of the United States of America (NASA)
    Network Appliance (NetApp)
    Nippon Telephone and Telegraph (NTT)
    Oracle
    Pennsylvania State University
    Red Hat
    Stanford University
    TeamF1, Inc.
    The University of Alaska
    The University of Michigan
    The University of Pennsylvania

Past and present members of the Kerberos Team at MIT:

    Danilo Almeida
    Jeffrey Altman
    Justin Anderson
    Richard Basch
    Mitch Berger
    Jay Berkenbilt
    Andrew Boardman
    Bill Bryant
    Steve Buckley
    Joe Calzaretta
    John Carr
    Mark Colan
    Don Davis
    Alexandra Ellwood
    Carlos Garay
    Dan Geer
    Nancy Gilman
    Matt Hancher
    Thomas Hardjono
    Sam Hartman
    Paul Hill
    Marc Horowitz
    Eva Jacobus
    Miroslav Jurisic
    Barry Jaspan
    Geoffrey King
    Kevin Koch
    John Kohl
    HaoQi Li
    Jonathan Lin
    Peter Litwack
    Scott McGuire
    Steve Miller
    Kevin Mitchell
    Cliff Neuman
    Paul Park
    Ezra Peisach
    Chris Provenzano
    Ken Raeburn
    Jon Rochlis
    Jeff Schiller
    Jen Selby
    Robert Silk
    Bill Sommerfeld
    Jennifer Steiner
    Ralph Swick
    Brad Thompson
    Harry Tsai
    Zhanna Tsitkova
    Ted Ts'o
    Marshall Vale
    Tom Yu

The following external contributors have provided code, patches, bug
reports, suggestions, and valuable resources:

    Ian Abbott
    Brandon Allbery
    Russell Allbery
    Brian Almeida
    Michael B Allen
    Heinz-Ado Arnolds
    Derek Atkins
    Mark Bannister
    David Bantz
    Alex Baule
    Adam Bernstein
    Arlene Berry
    Jeff Blaine
    Radoslav Bodo
    Emmanuel Bouillon
    Michael Calmer
    Julien Chaffraix
    Ravi Channavajhala
    Srinivas Cheruku
    Leonardo Chiquitto
    Howard Chu
    Andrea Cirulli
    Christopher D. Clausen
    Kevin Coffman
    Simon Cooper
    Sylvain Cortes
    Nalin Dahyabhai
    Mark Davies
    Dennis Davis
    Mark Deneen
    Roland Dowdeswell
    Jason Edgecombe
    Mark Eichin
    Shawn M. Emery
    Douglas E. Engert
    Peter Eriksson
    Juha Erkkilä
    Ronni Feldt
    Bill Fellows
    JC Ferguson
    William Fiveash
    Ákos Frohner
    Marcus Granado
    Scott Grizzard
    Helmut Grohne
    Steve Grubb
    Philip Guenther
    Dominic Hargreaves
    Jakob Haufe
    Paul B. Henson
    Jeff Hodges
    Christopher Hogan
    Love Hörnquist Åstrand
    Ken Hornstein
    Henry B. Hotz
    Luke Howard
    Jakub Hrozek
    Shumon Huque
    Jeffrey Hutzelman
    Wyllys Ingersoll
    Holger Isenberg
    Pavel Jindra
    Joel Johnson
    Mikkel Kruse
    Volker Lendecke
    Jan iankko Lieskovsky
    Kevin Longfellow
    Ryan Lynch
    Nathaniel McCallum
    Greg McClement
    Cameron Meadors
    Alexey Melnikov
    Franklyn Mendez
    Markus Moeller
    Kyle Moffett
    Paul Moore
    Keiichi Mori
    Zbysek Mraz
    Edward Murrell
    Nikos Nikoleris
    Felipe Ortega
    Andrej Ota
    Dmitri Pal
    Javier Palacios
    Tom Parker
    Ezra Peisach
    W. Michael Petullo
    Mark Phalan
    Jonathan Reams
    Robert Relyea
    Martin Rex
    Jason Rogers
    Mike Roszkowski
    Guillaume Rousse
    Tom Shaw
    Peter Shoults
    Simo Sorce
    Michael Spang
    Michael Ströder
    Bjørn Tore Sund
    Rathor Vipin
    Jorgen Wahlsten
    Max (Weijun) Wang
    John Washington
    Kevin Wasserman
    Margaret Wasserman
    Marcus Watts
    Simon Wilkinson
    Nicolas Williams
    Ross Wilper
    Xu Qiang
    Hanz van Zijst

The above is not an exhaustive list; many others have contributed in
various ways to the MIT Kerberos development effort over the years.
Other acknowledgments (for bug reports and patches) are in the
doc/CHANGES file.