From 0b3bb9a0648f491ba12b84061a1254a652f3cdbe283fa4ca579ab3cc5f67584b Mon Sep 17 00:00:00 2001 From: OBS User buildservice-autocommit Date: Wed, 24 Aug 2011 11:36:07 +0000 Subject: [PATCH 1/2] Updating link to change in openSUSE:Factory/krb5 revision 72.0 OBS-URL: https://build.opensuse.org/package/show/network/krb5?expand=0&rev=791524bc053d34f24fab2de0182f0e31 --- krb5-doc.spec | 2 +- krb5-mini.spec | 4 ++-- krb5.spec | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/krb5-doc.spec b/krb5-doc.spec index 6ad64d2..ff17cdc 100644 --- a/krb5-doc.spec +++ b/krb5-doc.spec @@ -21,7 +21,7 @@ Name: krb5-doc BuildRequires: ghostscript-library latex2html texlive Version: 1.9.1 -Release: 1 +Release: 2 %define srcRoot krb5-1.9.1 Summary: MIT Kerberos5 Implementation--Documentation License: MIT License (or similar) diff --git a/krb5-mini.spec b/krb5-mini.spec index 5fb0b70..58e6539 100644 --- a/krb5-mini.spec +++ b/krb5-mini.spec @@ -1,5 +1,5 @@ # -# spec file for package krb5 +# spec file for package krb5-mini # # Copyright (c) 2011 SUSE LINUX Products GmbH, Nuernberg, Germany. # @@ -29,7 +29,7 @@ BuildRequires: bison libcom_err-devel ncurses-devel BuildRequires: keyutils keyutils-devel BuildRequires: libselinux-devel Version: 1.9.1 -Release: 1 +Release: 2 %if ! 0%{?build_mini} BuildRequires: libopenssl-devel openldap2-devel BuildRequires: pam-devel diff --git a/krb5.spec b/krb5.spec index 53791aa..a5e13fc 100644 --- a/krb5.spec +++ b/krb5.spec @@ -29,7 +29,7 @@ BuildRequires: bison libcom_err-devel ncurses-devel BuildRequires: keyutils keyutils-devel BuildRequires: libselinux-devel Version: 1.9.1 -Release: 1 +Release: 21 %if ! 0%{?build_mini} BuildRequires: libopenssl-devel openldap2-devel BuildRequires: pam-devel From f55551038a5940df84ddbb64f9637278e2031b6189bfe668aeca4b3da574113d Mon Sep 17 00:00:00 2001 From: Michael Calmer Date: Wed, 19 Oct 2011 07:48:04 +0000 Subject: [PATCH 2/2] - fix kdc remote denial of service (MITKRB5-SA-2011-006, bnc#719393) CVE-2011-1527, CVE-2011-1528, CVE-2011-1529 - fix kdc remote denial of service (MITKRB5-SA-2011-006, bnc#719393) CVE-2011-1527, CVE-2011-1528, CVE-2011-1529 OBS-URL: https://build.opensuse.org/package/show/network/krb5?expand=0&rev=51 --- krb5-1.9-MITKRB5-SA-2011-006.dif | 75 ++++++++++++++++++++++++++++++++ krb5-mini.changes | 7 +++ krb5-mini.spec | 4 +- krb5.changes | 7 +++ krb5.spec | 2 + 5 files changed, 94 insertions(+), 1 deletion(-) create mode 100644 krb5-1.9-MITKRB5-SA-2011-006.dif diff --git a/krb5-1.9-MITKRB5-SA-2011-006.dif b/krb5-1.9-MITKRB5-SA-2011-006.dif new file mode 100644 index 0000000..f7aa03e --- /dev/null +++ b/krb5-1.9-MITKRB5-SA-2011-006.dif @@ -0,0 +1,75 @@ +diff --git a/src/plugins/kdb/db2/lockout.c b/src/plugins/kdb/db2/lockout.c +index b473611..50c60b7 100644 +--- a/src/plugins/kdb/db2/lockout.c ++++ b/src/plugins/kdb/db2/lockout.c +@@ -169,6 +169,9 @@ krb5_db2_lockout_audit(krb5_context context, + return 0; + } + ++ if (entry == NULL) ++ return 0; ++ + if (!db_ctx->disable_lockout) { + code = lookup_lockout_policy(context, entry, &max_fail, + &failcnt_interval, &lockout_duration); +@@ -176,6 +179,15 @@ krb5_db2_lockout_audit(krb5_context context, + return code; + } + ++ /* ++ * Don't continue to modify the DB for an already locked account. ++ * (In most cases, status will be KRB5KDC_ERR_CLIENT_REVOKED, and ++ * this check is unneeded, but in rare cases, we can fail with an ++ * integrity error or preauth failure before a policy check.) ++ */ ++ if (locked_check_p(context, stamp, max_fail, lockout_duration, entry)) ++ return 0; ++ + /* Only mark the authentication as successful if the entry + * required preauthentication, otherwise we have no idea. */ + if (status == 0 && (entry->attributes & KRB5_KDB_REQUIRES_PRE_AUTH)) { +diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c +index 552e39a..c2f44ab 100644 +--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c ++++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c +@@ -105,6 +105,7 @@ krb5_ldap_get_principal(krb5_context context, krb5_const_principal searchfor, + CHECK_LDAP_HANDLE(ldap_context); + + if (is_principal_in_realm(ldap_context, searchfor) != 0) { ++ st = KRB5_KDB_NOENTRY; + krb5_set_error_message (context, st, "Principal does not belong to realm"); + goto cleanup; + } +diff --git a/src/plugins/kdb/ldap/libkdb_ldap/lockout.c b/src/plugins/kdb/ldap/libkdb_ldap/lockout.c +index a218dc7..fd164dd 100644 +--- a/src/plugins/kdb/ldap/libkdb_ldap/lockout.c ++++ b/src/plugins/kdb/ldap/libkdb_ldap/lockout.c +@@ -165,6 +165,9 @@ krb5_ldap_lockout_audit(krb5_context context, + return 0; + } + ++ if (entry == NULL) ++ return 0; ++ + if (!ldap_context->disable_lockout) { + code = lookup_lockout_policy(context, entry, &max_fail, + &failcnt_interval, +@@ -173,9 +176,16 @@ krb5_ldap_lockout_audit(krb5_context context, + return code; + } + +- entry->mask = 0; ++ /* ++ * Don't continue to modify the DB for an already locked account. ++ * (In most cases, status will be KRB5KDC_ERR_CLIENT_REVOKED, and ++ * this check is unneeded, but in rare cases, we can fail with an ++ * integrity error or preauth failure before a policy check.) ++ */ ++ if (locked_check_p(context, stamp, max_fail, lockout_duration, entry)) ++ return 0; + +- assert (!locked_check_p(context, stamp, max_fail, lockout_duration, entry)); ++ entry->mask = 0; + + /* Only mark the authentication as successful if the entry + * required preauthentication, otherwise we have no idea. */ diff --git a/krb5-mini.changes b/krb5-mini.changes index 3fdefe6..416c4a5 100644 --- a/krb5-mini.changes +++ b/krb5-mini.changes @@ -1,3 +1,10 @@ +------------------------------------------------------------------- +Mon Oct 17 16:11:03 CEST 2011 - mc@suse.de + +- fix kdc remote denial of service + (MITKRB5-SA-2011-006, bnc#719393) + CVE-2011-1527, CVE-2011-1528, CVE-2011-1529 + ------------------------------------------------------------------- Tue Aug 23 13:52:03 CEST 2011 - mc@suse.de diff --git a/krb5-mini.spec b/krb5-mini.spec index 58e6539..85dc3aa 100644 --- a/krb5-mini.spec +++ b/krb5-mini.spec @@ -29,7 +29,7 @@ BuildRequires: bison libcom_err-devel ncurses-devel BuildRequires: keyutils keyutils-devel BuildRequires: libselinux-devel Version: 1.9.1 -Release: 2 +Release: 21 %if ! 0%{?build_mini} BuildRequires: libopenssl-devel openldap2-devel BuildRequires: pam-devel @@ -71,6 +71,7 @@ Patch23: krb5-pkinit-cms2.patch Patch24: krb5-trunk-chpw-err.patch Patch25: krb5-trunk-gss_delete_sec.patch Patch26: krb5-trunk-kadmin-oldproto.patch +Patch30: krb5-1.9-MITKRB5-SA-2011-006.dif BuildRoot: %{_tmppath}/%{name}-%{version}-build PreReq: mktemp, grep, /bin/touch, coreutils PreReq: %insserv_prereq %fillup_prereq @@ -232,6 +233,7 @@ Authors: %patch24 %patch25 -p1 %patch26 +%patch30 -p1 # Rename the man pages so that they'll get generated correctly. pushd src cat %{SOURCE10} | while read manpage ; do diff --git a/krb5.changes b/krb5.changes index 3fdefe6..416c4a5 100644 --- a/krb5.changes +++ b/krb5.changes @@ -1,3 +1,10 @@ +------------------------------------------------------------------- +Mon Oct 17 16:11:03 CEST 2011 - mc@suse.de + +- fix kdc remote denial of service + (MITKRB5-SA-2011-006, bnc#719393) + CVE-2011-1527, CVE-2011-1528, CVE-2011-1529 + ------------------------------------------------------------------- Tue Aug 23 13:52:03 CEST 2011 - mc@suse.de diff --git a/krb5.spec b/krb5.spec index a5e13fc..08b9c75 100644 --- a/krb5.spec +++ b/krb5.spec @@ -71,6 +71,7 @@ Patch23: krb5-pkinit-cms2.patch Patch24: krb5-trunk-chpw-err.patch Patch25: krb5-trunk-gss_delete_sec.patch Patch26: krb5-trunk-kadmin-oldproto.patch +Patch30: krb5-1.9-MITKRB5-SA-2011-006.dif BuildRoot: %{_tmppath}/%{name}-%{version}-build PreReq: mktemp, grep, /bin/touch, coreutils PreReq: %insserv_prereq %fillup_prereq @@ -232,6 +233,7 @@ Authors: %patch24 %patch25 -p1 %patch26 +%patch30 -p1 # Rename the man pages so that they'll get generated correctly. pushd src cat %{SOURCE10} | while read manpage ; do