rpm/krb5
SHA256
1
0
Fork 0
forked from pool/krb5
Code Pull Requests Activity

- fix kdc remote denial of service

Browse Source 
(MITKRB5-SA-2011-006, bnc#719393)
  CVE-2011-1527, CVE-2011-1528, CVE-2011-1529

- fix kdc remote denial of service
  (MITKRB5-SA-2011-006, bnc#719393)
  CVE-2011-1527, CVE-2011-1528, CVE-2011-1529

OBS-URL: https://build.opensuse.org/package/show/network/krb5?expand=0&rev=51
This commit is contained in:
Michael Calmer 2011-10-19 07:48:04 +00:00 committed by Git OBS Bridge
parent 0b3bb9a064
commit f55551038a
5 changed files with 94 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

75
krb5-1.9-MITKRB5-SA-2011-006.dif Normal file
View File

@ -0,0 +1,75 @@
diff --git a/src/plugins/kdb/db2/lockout.c b/src/plugins/kdb/db2/lockout.c
index b473611..50c60b7 100644
--- a/src/plugins/kdb/db2/lockout.c
+++ b/src/plugins/kdb/db2/lockout.c
@@ -169,6 +169,9 @@ krb5_db2_lockout_audit(krb5_context context,
return 0;
}
+ if (entry == NULL)
+ return 0;
+
if (!db_ctx->disable_lockout) {
code = lookup_lockout_policy(context, entry, &max_fail,
&failcnt_interval, &lockout_duration);
@@ -176,6 +179,15 @@ krb5_db2_lockout_audit(krb5_context context,
return code;
}
+ /*
+ * Don't continue to modify the DB for an already locked account.
+ * (In most cases, status will be KRB5KDC_ERR_CLIENT_REVOKED, and
+ * this check is unneeded, but in rare cases, we can fail with an
+ * integrity error or preauth failure before a policy check.)
+ */
+ if (locked_check_p(context, stamp, max_fail, lockout_duration, entry))
+ return 0;
+
/* Only mark the authentication as successful if the entry
* required preauthentication, otherwise we have no idea. */
if (status == 0 && (entry->attributes & KRB5_KDB_REQUIRES_PRE_AUTH)) {
diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
index 552e39a..c2f44ab 100644
--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
+++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
@@ -105,6 +105,7 @@ krb5_ldap_get_principal(krb5_context context, krb5_const_principal searchfor,
CHECK_LDAP_HANDLE(ldap_context);
if (is_principal_in_realm(ldap_context, searchfor) != 0) {
+ st = KRB5_KDB_NOENTRY;
krb5_set_error_message (context, st, "Principal does not belong to realm");
goto cleanup;
}
diff --git a/src/plugins/kdb/ldap/libkdb_ldap/lockout.c b/src/plugins/kdb/ldap/libkdb_ldap/lockout.c
index a218dc7..fd164dd 100644
--- a/src/plugins/kdb/ldap/libkdb_ldap/lockout.c
+++ b/src/plugins/kdb/ldap/libkdb_ldap/lockout.c
@@ -165,6 +165,9 @@ krb5_ldap_lockout_audit(krb5_context context,
return 0;
}
+ if (entry == NULL)
+ return 0;
+
if (!ldap_context->disable_lockout) {
code = lookup_lockout_policy(context, entry, &max_fail,
&failcnt_interval,
@@ -173,9 +176,16 @@ krb5_ldap_lockout_audit(krb5_context context,
return code;
}
- entry->mask = 0;
+ /*
+ * Don't continue to modify the DB for an already locked account.
+ * (In most cases, status will be KRB5KDC_ERR_CLIENT_REVOKED, and
+ * this check is unneeded, but in rare cases, we can fail with an
+ * integrity error or preauth failure before a policy check.)
+ */
+ if (locked_check_p(context, stamp, max_fail, lockout_duration, entry))
+ return 0;
- assert (!locked_check_p(context, stamp, max_fail, lockout_duration, entry));
+ entry->mask = 0;
/* Only mark the authentication as successful if the entry
* required preauthentication, otherwise we have no idea. */

7
krb5-mini.changes
View File

@ -1,3 +1,10 @@
-------------------------------------------------------------------
Mon Oct 17 16:11:03 CEST 2011 - mc@suse.de
- fix kdc remote denial of service
(MITKRB5-SA-2011-006, bnc#719393)
CVE-2011-1527, CVE-2011-1528, CVE-2011-1529
-------------------------------------------------------------------
Tue Aug 23 13:52:03 CEST 2011 - mc@suse.de

4
krb5-mini.spec
View File

@ -29,7 +29,7 @@ BuildRequires: bison libcom_err-devel ncurses-devel
BuildRequires: keyutils keyutils-devel
BuildRequires: libselinux-devel
Version: 1.9.1
Release: 2
Release: 21
%if ! 0%{?build_mini}
BuildRequires: libopenssl-devel openldap2-devel
BuildRequires: pam-devel
@ -71,6 +71,7 @@ Patch23: krb5-pkinit-cms2.patch
Patch24: krb5-trunk-chpw-err.patch
Patch25: krb5-trunk-gss_delete_sec.patch
Patch26: krb5-trunk-kadmin-oldproto.patch
Patch30: krb5-1.9-MITKRB5-SA-2011-006.dif
BuildRoot: %{_tmppath}/%{name}-%{version}-build
PreReq: mktemp, grep, /bin/touch, coreutils
PreReq: %insserv_prereq %fillup_prereq
@ -232,6 +233,7 @@ Authors:
%patch24
%patch25 -p1
%patch26
%patch30 -p1
# Rename the man pages so that they'll get generated correctly.
pushd src
cat %{SOURCE10} | while read manpage ; do

7
krb5.changes
View File

@ -1,3 +1,10 @@
-------------------------------------------------------------------
Mon Oct 17 16:11:03 CEST 2011 - mc@suse.de
- fix kdc remote denial of service
(MITKRB5-SA-2011-006, bnc#719393)
CVE-2011-1527, CVE-2011-1528, CVE-2011-1529
-------------------------------------------------------------------
Tue Aug 23 13:52:03 CEST 2011 - mc@suse.de

2
krb5.spec
View File

@ -71,6 +71,7 @@ Patch23: krb5-pkinit-cms2.patch
Patch24: krb5-trunk-chpw-err.patch
Patch25: krb5-trunk-gss_delete_sec.patch
Patch26: krb5-trunk-kadmin-oldproto.patch
Patch30: krb5-1.9-MITKRB5-SA-2011-006.dif
BuildRoot: %{_tmppath}/%{name}-%{version}-build
PreReq: mktemp, grep, /bin/touch, coreutils
PreReq: %insserv_prereq %fillup_prereq
@ -232,6 +233,7 @@ Authors:
%patch24
%patch25 -p1
%patch26
%patch30 -p1
# Rename the man pages so that they'll get generated correctly.
pushd src
cat %{SOURCE10} | while read manpage ; do