From 948224678079adbfcfc654a224a85b63602f775080424f510900b1811a891cd8 Mon Sep 17 00:00:00 2001 From: Michael Calmer Date: Mon, 11 Oct 2010 08:46:56 +0000 Subject: [PATCH] - fix a dereference of an uninitialized pointer while processing authorization data. CVE-2010-1322, MITKRB5-SA-2010-006 (bnc#640990) OBS-URL: https://build.opensuse.org/package/show/network/krb5?expand=0&rev=27 --- krb5-1.8-MITKRB5-SA-2010-006.dif | 33 ++++++++++++++++++++++++++++++++ krb5-mini.changes | 7 +++++++ krb5-mini.spec | 4 +++- krb5.changes | 7 +++++++ krb5.spec | 2 ++ 5 files changed, 52 insertions(+), 1 deletion(-) create mode 100644 krb5-1.8-MITKRB5-SA-2010-006.dif diff --git a/krb5-1.8-MITKRB5-SA-2010-006.dif b/krb5-1.8-MITKRB5-SA-2010-006.dif new file mode 100644 index 0000000..3f5f5bb --- /dev/null +++ b/krb5-1.8-MITKRB5-SA-2010-006.dif @@ -0,0 +1,33 @@ +Index: krb5-1.8.1/src/kdc/kdc_authdata.c +=================================================================== +--- krb5-1.8.1.orig/src/kdc/kdc_authdata.c ++++ krb5-1.8.1/src/kdc/kdc_authdata.c +@@ -495,7 +495,7 @@ merge_authdata (krb5_context context, + krb5_boolean copy, + krb5_boolean ignore_kdc_issued) + { +- size_t i, nadata = 0; ++ size_t i, j, nadata = 0; + krb5_authdata **authdata = *out_authdata; + + if (in_authdata == NULL || in_authdata[0] == NULL) +@@ -529,16 +529,16 @@ merge_authdata (krb5_context context, + in_authdata = tmp; + } + +- for (i = 0; in_authdata[i] != NULL; i++) { ++ for (i = 0, j = 0; in_authdata[i] != NULL; i++) { + if (ignore_kdc_issued && + is_kdc_issued_authdatum(context, in_authdata[i], 0)) { + free(in_authdata[i]->contents); + free(in_authdata[i]); + } else +- authdata[nadata + i] = in_authdata[i]; ++ authdata[nadata + j++] = in_authdata[i]; + } + +- authdata[nadata + i] = NULL; ++ authdata[nadata + j] = NULL; + + free(in_authdata); + diff --git a/krb5-mini.changes b/krb5-mini.changes index b57f654..528b1c9 100644 --- a/krb5-mini.changes +++ b/krb5-mini.changes @@ -1,3 +1,10 @@ +------------------------------------------------------------------- +Mon Sep 27 11:42:43 CEST 2010 - mc@suse.de + +- fix a dereference of an uninitialized pointer while processing + authorization data. + CVE-2010-1322, MITKRB5-SA-2010-006 (bnc#640990) + ------------------------------------------------------------------- Mon Jun 21 21:31:53 UTC 2010 - lchiquitto@novell.com diff --git a/krb5-mini.spec b/krb5-mini.spec index 15234ab..a56ca24 100644 --- a/krb5-mini.spec +++ b/krb5-mini.spec @@ -1,5 +1,5 @@ # -# spec file for package krb5-mini (Version 1.8.1) +# spec file for package krb5 (Version 1.8.1) # # Copyright (c) 2010 SUSE LINUX Products GmbH, Nuernberg, Germany. # @@ -58,6 +58,7 @@ Patch8: krb5-1.6.3-fix-ipv6-query.dif Patch9: krb5-1.7-MITKRB5-SA-2010-004.dif Patch10: krb5-MITKRB5-SA-2010-005.dif Patch11: krb5-1.8.1-gssapi-error-table.dif +Patch12: krb5-1.8-MITKRB5-SA-2010-006.dif BuildRoot: %{_tmppath}/%{name}-%{version}-build PreReq: mktemp, grep, /bin/touch, coreutils PreReq: %insserv_prereq %fillup_prereq @@ -208,6 +209,7 @@ Authors: %patch9 -p1 %patch10 -p1 %patch11 -p1 +%patch12 -p1 # Rename the man pages so that they'll get generated correctly. pushd src cat %{SOURCE10} | while read manpage ; do diff --git a/krb5.changes b/krb5.changes index b57f654..528b1c9 100644 --- a/krb5.changes +++ b/krb5.changes @@ -1,3 +1,10 @@ +------------------------------------------------------------------- +Mon Sep 27 11:42:43 CEST 2010 - mc@suse.de + +- fix a dereference of an uninitialized pointer while processing + authorization data. + CVE-2010-1322, MITKRB5-SA-2010-006 (bnc#640990) + ------------------------------------------------------------------- Mon Jun 21 21:31:53 UTC 2010 - lchiquitto@novell.com diff --git a/krb5.spec b/krb5.spec index b1d0036..94215e0 100644 --- a/krb5.spec +++ b/krb5.spec @@ -58,6 +58,7 @@ Patch8: krb5-1.6.3-fix-ipv6-query.dif Patch9: krb5-1.7-MITKRB5-SA-2010-004.dif Patch10: krb5-MITKRB5-SA-2010-005.dif Patch11: krb5-1.8.1-gssapi-error-table.dif +Patch12: krb5-1.8-MITKRB5-SA-2010-006.dif BuildRoot: %{_tmppath}/%{name}-%{version}-build PreReq: mktemp, grep, /bin/touch, coreutils PreReq: %insserv_prereq %fillup_prereq @@ -208,6 +209,7 @@ Authors: %patch9 -p1 %patch10 -p1 %patch11 -p1 +%patch12 -p1 # Rename the man pages so that they'll get generated correctly. pushd src cat %{SOURCE10} | while read manpage ; do