diff --git a/krb5-1.8-MITKRB5-SA-2010-006.dif b/krb5-1.8-MITKRB5-SA-2010-006.dif new file mode 100644 index 0000000..3f5f5bb --- /dev/null +++ b/krb5-1.8-MITKRB5-SA-2010-006.dif @@ -0,0 +1,33 @@ +Index: krb5-1.8.1/src/kdc/kdc_authdata.c +=================================================================== +--- krb5-1.8.1.orig/src/kdc/kdc_authdata.c ++++ krb5-1.8.1/src/kdc/kdc_authdata.c +@@ -495,7 +495,7 @@ merge_authdata (krb5_context context, + krb5_boolean copy, + krb5_boolean ignore_kdc_issued) + { +- size_t i, nadata = 0; ++ size_t i, j, nadata = 0; + krb5_authdata **authdata = *out_authdata; + + if (in_authdata == NULL || in_authdata[0] == NULL) +@@ -529,16 +529,16 @@ merge_authdata (krb5_context context, + in_authdata = tmp; + } + +- for (i = 0; in_authdata[i] != NULL; i++) { ++ for (i = 0, j = 0; in_authdata[i] != NULL; i++) { + if (ignore_kdc_issued && + is_kdc_issued_authdatum(context, in_authdata[i], 0)) { + free(in_authdata[i]->contents); + free(in_authdata[i]); + } else +- authdata[nadata + i] = in_authdata[i]; ++ authdata[nadata + j++] = in_authdata[i]; + } + +- authdata[nadata + i] = NULL; ++ authdata[nadata + j] = NULL; + + free(in_authdata); + diff --git a/krb5-doc.spec b/krb5-doc.spec index f8c27e2..d266bc3 100644 --- a/krb5-doc.spec +++ b/krb5-doc.spec @@ -21,7 +21,7 @@ Name: krb5-doc BuildRequires: ghostscript-library latex2html texlive Version: 1.8.1 -Release: 4 +Release: 7 %define srcRoot krb5-1.8.1 Summary: MIT Kerberos5 Implementation--Documentation License: MIT License (or similar) diff --git a/krb5-mini.changes b/krb5-mini.changes index b57f654..528b1c9 100644 --- a/krb5-mini.changes +++ b/krb5-mini.changes @@ -1,3 +1,10 @@ +------------------------------------------------------------------- +Mon Sep 27 11:42:43 CEST 2010 - mc@suse.de + +- fix a dereference of an uninitialized pointer while processing + authorization data. + CVE-2010-1322, MITKRB5-SA-2010-006 (bnc#640990) + ------------------------------------------------------------------- Mon Jun 21 21:31:53 UTC 2010 - lchiquitto@novell.com diff --git a/krb5-mini.spec b/krb5-mini.spec index 15234ab..db86b16 100644 --- a/krb5-mini.spec +++ b/krb5-mini.spec @@ -28,7 +28,7 @@ Url: http://web.mit.edu/kerberos/www/ BuildRequires: bison libcom_err-devel ncurses-devel BuildRequires: keyutils keyutils-devel Version: 1.8.1 -Release: 4 +Release: 7 %if ! 0%{?build_mini} BuildRequires: libopenssl-devel openldap2-devel # bug437293 @@ -58,6 +58,7 @@ Patch8: krb5-1.6.3-fix-ipv6-query.dif Patch9: krb5-1.7-MITKRB5-SA-2010-004.dif Patch10: krb5-MITKRB5-SA-2010-005.dif Patch11: krb5-1.8.1-gssapi-error-table.dif +Patch12: krb5-1.8-MITKRB5-SA-2010-006.dif BuildRoot: %{_tmppath}/%{name}-%{version}-build PreReq: mktemp, grep, /bin/touch, coreutils PreReq: %insserv_prereq %fillup_prereq @@ -208,6 +209,7 @@ Authors: %patch9 -p1 %patch10 -p1 %patch11 -p1 +%patch12 -p1 # Rename the man pages so that they'll get generated correctly. pushd src cat %{SOURCE10} | while read manpage ; do diff --git a/krb5.changes b/krb5.changes index b57f654..528b1c9 100644 --- a/krb5.changes +++ b/krb5.changes @@ -1,3 +1,10 @@ +------------------------------------------------------------------- +Mon Sep 27 11:42:43 CEST 2010 - mc@suse.de + +- fix a dereference of an uninitialized pointer while processing + authorization data. + CVE-2010-1322, MITKRB5-SA-2010-006 (bnc#640990) + ------------------------------------------------------------------- Mon Jun 21 21:31:53 UTC 2010 - lchiquitto@novell.com diff --git a/krb5.spec b/krb5.spec index b1d0036..6884430 100644 --- a/krb5.spec +++ b/krb5.spec @@ -28,7 +28,7 @@ Url: http://web.mit.edu/kerberos/www/ BuildRequires: bison libcom_err-devel ncurses-devel BuildRequires: keyutils keyutils-devel Version: 1.8.1 -Release: 4 +Release: 7 %if ! 0%{?build_mini} BuildRequires: libopenssl-devel openldap2-devel # bug437293 @@ -58,6 +58,7 @@ Patch8: krb5-1.6.3-fix-ipv6-query.dif Patch9: krb5-1.7-MITKRB5-SA-2010-004.dif Patch10: krb5-MITKRB5-SA-2010-005.dif Patch11: krb5-1.8.1-gssapi-error-table.dif +Patch12: krb5-1.8-MITKRB5-SA-2010-006.dif BuildRoot: %{_tmppath}/%{name}-%{version}-build PreReq: mktemp, grep, /bin/touch, coreutils PreReq: %insserv_prereq %fillup_prereq @@ -208,6 +209,7 @@ Authors: %patch9 -p1 %patch10 -p1 %patch11 -p1 +%patch12 -p1 # Rename the man pages so that they'll get generated correctly. pushd src cat %{SOURCE10} | while read manpage ; do