- fix kdc remote denial of service

(MITKRB5-SA-2011-006, bnc#719393)
  CVE-2011-1527, CVE-2011-1528, CVE-2011-1529

- fix kdc remote denial of service
  (MITKRB5-SA-2011-006, bnc#719393)
  CVE-2011-1527, CVE-2011-1528, CVE-2011-1529

OBS-URL: https://build.opensuse.org/package/show/network/krb5?expand=0&rev=51

krb5-1.9-MITKRB5-SA-2011-006.dif

@@ -0,0 +1,75 @@
+diff --git a/src/plugins/kdb/db2/lockout.c b/src/plugins/kdb/db2/lockout.c
+index b473611..50c60b7 100644
+--- a/src/plugins/kdb/db2/lockout.c
++++ b/src/plugins/kdb/db2/lockout.c
+@@ -169,6 +169,9 @@ krb5_db2_lockout_audit(krb5_context context,
+         return 0;
+     }
+ 
++    if (entry == NULL)
++        return 0;
++
+     if (!db_ctx->disable_lockout) {
+         code = lookup_lockout_policy(context, entry, &max_fail,
+                                      &failcnt_interval, &lockout_duration);
+@@ -176,6 +179,15 @@ krb5_db2_lockout_audit(krb5_context context,
+             return code;
+     }
+ 
++    /*
++     * Don't continue to modify the DB for an already locked account.
++     * (In most cases, status will be KRB5KDC_ERR_CLIENT_REVOKED, and
++     * this check is unneeded, but in rare cases, we can fail with an
++     * integrity error or preauth failure before a policy check.)
++     */
++    if (locked_check_p(context, stamp, max_fail, lockout_duration, entry))
++        return 0;
++
+     /* Only mark the authentication as successful if the entry
+      * required preauthentication, otherwise we have no idea. */
+     if (status == 0 && (entry->attributes & KRB5_KDB_REQUIRES_PRE_AUTH)) {
+diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
+index 552e39a..c2f44ab 100644
+--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
++++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
+@@ -105,6 +105,7 @@ krb5_ldap_get_principal(krb5_context context, krb5_const_principal searchfor,
+     CHECK_LDAP_HANDLE(ldap_context);
+ 
+     if (is_principal_in_realm(ldap_context, searchfor) != 0) {
++        st = KRB5_KDB_NOENTRY;
+         krb5_set_error_message (context, st, "Principal does not belong to realm");
+         goto cleanup;
+     }
+diff --git a/src/plugins/kdb/ldap/libkdb_ldap/lockout.c b/src/plugins/kdb/ldap/libkdb_ldap/lockout.c
+index a218dc7..fd164dd 100644
+--- a/src/plugins/kdb/ldap/libkdb_ldap/lockout.c
++++ b/src/plugins/kdb/ldap/libkdb_ldap/lockout.c
+@@ -165,6 +165,9 @@ krb5_ldap_lockout_audit(krb5_context context,
+         return 0;
+     }
+ 
++    if (entry == NULL)
++        return 0;
++
+     if (!ldap_context->disable_lockout) {
+         code = lookup_lockout_policy(context, entry, &max_fail,
+                                      &failcnt_interval,
+@@ -173,9 +176,16 @@ krb5_ldap_lockout_audit(krb5_context context,
+             return code;
+     }
+ 
+-    entry->mask = 0;
++    /*
++     * Don't continue to modify the DB for an already locked account.
++     * (In most cases, status will be KRB5KDC_ERR_CLIENT_REVOKED, and
++     * this check is unneeded, but in rare cases, we can fail with an
++     * integrity error or preauth failure before a policy check.)
++     */
++    if (locked_check_p(context, stamp, max_fail, lockout_duration, entry))
++        return 0;
+ 
+-    assert (!locked_check_p(context, stamp, max_fail, lockout_duration, entry));
++    entry->mask = 0;
+ 
+     /* Only mark the authentication as successful if the entry
+      * required preauthentication, otherwise we have no idea. */

krb5-mini.changes

@@ -1,3 +1,10 @@
+-------------------------------------------------------------------
+Mon Oct 17 16:11:03 CEST 2011 - mc@suse.de
+
+- fix kdc remote denial of service
+  (MITKRB5-SA-2011-006, bnc#719393)
+  CVE-2011-1527, CVE-2011-1528, CVE-2011-1529
+
 -------------------------------------------------------------------
 Tue Aug 23 13:52:03 CEST 2011 - mc@suse.de
 

krb5-mini.spec

@@ -29,7 +29,7 @@ BuildRequires:  bison libcom_err-devel ncurses-devel
 BuildRequires:  keyutils keyutils-devel
 BuildRequires:  libselinux-devel
 Version:        1.9.1
-Release:        2
+Release:        21
 %if ! 0%{?build_mini}
 BuildRequires:  libopenssl-devel openldap2-devel
 BuildRequires:  pam-devel
@@ -71,6 +71,7 @@ Patch23:        krb5-pkinit-cms2.patch
 Patch24:        krb5-trunk-chpw-err.patch
 Patch25:        krb5-trunk-gss_delete_sec.patch
 Patch26:        krb5-trunk-kadmin-oldproto.patch
+Patch30:        krb5-1.9-MITKRB5-SA-2011-006.dif
 BuildRoot:      %{_tmppath}/%{name}-%{version}-build
 PreReq:         mktemp, grep, /bin/touch, coreutils
 PreReq:         %insserv_prereq %fillup_prereq 
@@ -232,6 +233,7 @@ Authors:
 %patch24
 %patch25 -p1
 %patch26
+%patch30 -p1
 # Rename the man pages so that they'll get generated correctly.
 pushd src
 cat %{SOURCE10} | while read manpage ; do

krb5.changes

@@ -1,3 +1,10 @@
+-------------------------------------------------------------------
+Mon Oct 17 16:11:03 CEST 2011 - mc@suse.de
+
+- fix kdc remote denial of service
+  (MITKRB5-SA-2011-006, bnc#719393)
+  CVE-2011-1527, CVE-2011-1528, CVE-2011-1529
+
 -------------------------------------------------------------------
 Tue Aug 23 13:52:03 CEST 2011 - mc@suse.de
 

krb5.spec

@@ -71,6 +71,7 @@ Patch23:        krb5-pkinit-cms2.patch
 Patch24:        krb5-trunk-chpw-err.patch
 Patch25:        krb5-trunk-gss_delete_sec.patch
 Patch26:        krb5-trunk-kadmin-oldproto.patch
+Patch30:        krb5-1.9-MITKRB5-SA-2011-006.dif
 BuildRoot:      %{_tmppath}/%{name}-%{version}-build
 PreReq:         mktemp, grep, /bin/touch, coreutils
 PreReq:         %insserv_prereq %fillup_prereq 
@@ -232,6 +233,7 @@ Authors:
 %patch24
 %patch25 -p1
 %patch26
+%patch30 -p1
 # Rename the man pages so that they'll get generated correctly.
 pushd src
 cat %{SOURCE10} | while read manpage ; do