rpm/krb5
SHA256
1
0
Fork 0
forked from pool/krb5
Code Pull Requests Activity

- fix KDC null pointer dereference in TGS handling

Browse Source 
(MITKRB5-SA-2011-007, bnc#730393)
  CVE-2011-1530

- fix KDC null pointer dereference in TGS handling
  (MITKRB5-SA-2011-007, bnc#730393)
  CVE-2011-1530
  (RT#6951, bnc#731648)

OBS-URL: https://build.opensuse.org/package/show/network/krb5?expand=0&rev=56
This commit is contained in:
Michael Calmer 2011-12-07 08:41:31 +00:00 committed by Git OBS Bridge
parent f4d30b42a2
commit 6e6175d4bc
5 changed files with 61 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
krb5-1.9-MITKRB5-SA-2011-007.dif Normal file
View File

@ -0,0 +1,42 @@
diff --git a/src/kdc/Makefile.in b/src/kdc/Makefile.in
index f46cad3..102fbaa 100644
--- a/src/kdc/Makefile.in
+++ b/src/kdc/Makefile.in
@@ -67,6 +67,7 @@ check-unix:: rtest
check-pytests::
$(RUNPYTEST) $(srcdir)/t_workers.py $(PYTESTFLAGS)
+ $(RUNPYTEST) $(srcdir)/t_emptytgt.py $(PYTESTFLAGS)
install::
$(INSTALL_PROGRAM) krb5kdc ${DESTDIR}$(SERVER_BINDIR)/krb5kdc
diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c
index c169c54..840a2ef 100644
--- a/src/kdc/do_tgs_req.c
+++ b/src/kdc/do_tgs_req.c
@@ -243,7 +243,8 @@ tgt_again:
if (!tgs_1 || !data_eq(*server_1, *tgs_1)) {
errcode = find_alternate_tgs(request, &server);
firstpass = 0;
- goto tgt_again;
+ if (errcode == 0)
+ goto tgt_again;
}
}
status = "UNKNOWN_SERVER";
diff --git a/src/kdc/t_emptytgt.py b/src/kdc/t_emptytgt.py
new file mode 100644
index 0000000..1760bcd
--- /dev/null
+++ b/src/kdc/t_emptytgt.py
@@ -0,0 +1,8 @@
+#!/usr/bin/python
+from k5test import *
+
+realm = K5Realm(start_kadmind=False, create_host=False)
+output = realm.run_as_client([kvno, 'krbtgt/'], expected_code=1)
+if 'not found in Kerberos database' not in output:
+ fail('TGT lookup for empty realm failed in unexpected way')
+success('Empty tgt lookup.')

7
krb5-mini.changes
View File

@ -1,3 +1,10 @@
-------------------------------------------------------------------
Mon Nov 21 11:24:12 CET 2011 - mc@suse.de
- fix KDC null pointer dereference in TGS handling
(MITKRB5-SA-2011-007, bnc#730393)
CVE-2011-1530
-------------------------------------------------------------------
Mon Nov 21 11:11:54 CET 2011 - mc@suse.de

2
krb5-mini.spec
View File

@ -75,6 +75,7 @@ Patch30: krb5-1.9-MITKRB5-SA-2011-006.dif
Patch31: krb5-1.9-gss_display_status-iakerb.patch
Patch32: krb5-1.9.1-sendto_poll2.patch
Patch33: krb5-1.9.1-sendto_poll3.patch
Patch34: krb5-1.9-MITKRB5-SA-2011-007.dif
BuildRoot: %{_tmppath}/%{name}-%{version}-build
PreReq: mktemp, grep, /bin/touch, coreutils
PreReq: %insserv_prereq %fillup_prereq
@ -240,6 +241,7 @@ Authors:
%patch31 -p1
%patch32 -p1
%patch33 -p1
%patch34 -p1
# Rename the man pages so that they'll get generated correctly.
pushd src
cat %{SOURCE10} | while read manpage ; do

9
krb5.changes
View File

@ -1,8 +1,15 @@
-------------------------------------------------------------------
Mon Nov 21 11:24:12 CET 2011 - mc@suse.de
- fix KDC null pointer dereference in TGS handling
(MITKRB5-SA-2011-007, bnc#730393)
CVE-2011-1530
-------------------------------------------------------------------
Mon Nov 21 11:11:54 CET 2011 - mc@suse.de
- fix KDC HA feature introduced with implementing KDC poll
(RT#6951)
(RT#6951, bnc#731648)
-------------------------------------------------------------------
Fri Nov 18 08:35:52 UTC 2011 - rhafer@suse.de

2
krb5.spec
View File

@ -75,6 +75,7 @@ Patch30: krb5-1.9-MITKRB5-SA-2011-006.dif
Patch31: krb5-1.9-gss_display_status-iakerb.patch
Patch32: krb5-1.9.1-sendto_poll2.patch
Patch33: krb5-1.9.1-sendto_poll3.patch
Patch34: krb5-1.9-MITKRB5-SA-2011-007.dif
BuildRoot: %{_tmppath}/%{name}-%{version}-build
PreReq: mktemp, grep, /bin/touch, coreutils
PreReq: %insserv_prereq %fillup_prereq
@ -240,6 +241,7 @@ Authors:
%patch31 -p1
%patch32 -p1
%patch33 -p1
%patch34 -p1
# Rename the man pages so that they'll get generated correctly.
pushd src
cat %{SOURCE10} | while read manpage ; do