* Thu May 14 2015 Roland Mainz <rmainz@redhat.com> - 1.13.2-0
- Update to krb5-1.13.2 - drop patch for krb5-1.13.2-CVE_2015_2694_requires_preauth_bypass_in_PKINIT_enabled_KDC, fixed in krb5-1.13.2 - drop patch for krb5-1.12.1-CVE_2014_5355_fix_krb5_read_message_handling, fixed in krb5-1.13.2 - Add script processing for upcoming Zanata l10n support - Minor spec cleanup
This commit is contained in:
Roland Mainz
parent
3ae7a21305
commit
9997960299
3
.gitignore
vendored
3
.gitignore
vendored
@ -117,3 +117,6 @@ krb5-1.8.3-pdf.tar.gz
|
||||
/krb5-1.13.tar.gz.asc
|
||||
/krb5-1.13-pdf.tar.xz
|
||||
/krb5-1.13.1-pdf.pax.xz
|
||||
/krb5-1.13.2.tar.gz
|
||||
/krb5-1.13.2.tar.gz.asc
|
||||
/krb5-1.13.2-pdf.pax.xz
|
||||
|
||||
@ -1,110 +0,0 @@
|
||||
From 21e4e653d8258d525f4b6ca87797d42a8bccc282 Mon Sep 17 00:00:00 2001
|
||||
From: Greg Hudson <ghudson@mit.edu>
|
||||
Date: Tue, 9 Dec 2014 12:37:44 -0500
|
||||
Subject: [PATCH] Fix krb5_read_message handling [CVE-2014-5355]
|
||||
|
||||
In recvauth_common, do not use strcmp against the data fields of
|
||||
krb5_data objects populated by krb5_read_message(), as there is no
|
||||
guarantee that they are C strings. Instead, create an expected
|
||||
krb5_data value and use data_eq().
|
||||
|
||||
In the sample user-to-user server application, check that the received
|
||||
client principal name is null-terminated before using it with printf
|
||||
and krb5_parse_name.
|
||||
|
||||
CVE-2014-5355:
|
||||
|
||||
In MIT krb5, when a server process uses the krb5_recvauth function, an
|
||||
unauthenticated remote attacker can cause a NULL dereference by
|
||||
sending a zero-byte version string, or a read beyond the end of
|
||||
allocated storage by sending a non-null-terminated version string.
|
||||
The example user-to-user server application (uuserver) is similarly
|
||||
vulnerable to a zero-length or non-null-terminated principal name
|
||||
string.
|
||||
|
||||
The krb5_recvauth function reads two version strings from the client
|
||||
using krb5_read_message(), which produces a krb5_data structure
|
||||
containing a length and a pointer to an octet sequence. krb5_recvauth
|
||||
assumes that the data pointer is a valid C string and passes it to
|
||||
strcmp() to verify the versions. If the client sends an empty octet
|
||||
sequence, the data pointer will be NULL and strcmp() will dereference
|
||||
a NULL pointer, causing the process to crash. If the client sends a
|
||||
non-null-terminated octet sequence, strcmp() will read beyond the end
|
||||
of the allocated storage, possibly causing the process to crash.
|
||||
|
||||
uuserver similarly uses krb5_read_message() to read a client principal
|
||||
name, and then passes it to printf() and krb5_parse_name() without
|
||||
verifying that it is a valid C string.
|
||||
|
||||
The krb5_recvauth function is used by kpropd and the Kerberized
|
||||
versions of the BSD rlogin and rsh daemons. These daemons are usually
|
||||
run out of inetd or in a mode which forks before processing incoming
|
||||
connections, so a process crash will generally not result in a
|
||||
complete denial of service.
|
||||
|
||||
Thanks to Tim Uglow for discovering this issue.
|
||||
|
||||
CVSSv2: AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C
|
||||
|
||||
[tlyu@mit.edu: CVSS score]
|
||||
|
||||
(cherry picked from commit 102bb6ebf20f9174130c85c3b052ae104e5073ec)
|
||||
|
||||
ticket: 8050
|
||||
version_fixed: 1.13.2
|
||||
status: resolved
|
||||
---
|
||||
src/appl/user_user/server.c | 4 +++-
|
||||
src/lib/krb5/krb/recvauth.c | 9 ++++++---
|
||||
2 files changed, 9 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/src/appl/user_user/server.c b/src/appl/user_user/server.c
|
||||
index 09ea4e0..f2b5b61 100644
|
||||
--- a/src/appl/user_user/server.c
|
||||
+++ b/src/appl/user_user/server.c
|
||||
@@ -111,8 +111,10 @@ int main(argc, argv)
|
||||
}
|
||||
#endif
|
||||
|
||||
+ /* principal name must be sent null-terminated. */
|
||||
retval = krb5_read_message(context, (krb5_pointer) &sock, &pname_data);
|
||||
- if (retval) {
|
||||
+ if (retval || pname_data.length == 0 ||
|
||||
+ pname_data.data[pname_data.length - 1] != '\0') {
|
||||
com_err ("uu-server", retval, "reading pname");
|
||||
return 2;
|
||||
}
|
||||
diff --git a/src/lib/krb5/krb/recvauth.c b/src/lib/krb5/krb/recvauth.c
|
||||
index da836283..5adc6dd 100644
|
||||
--- a/src/lib/krb5/krb/recvauth.c
|
||||
+++ b/src/lib/krb5/krb/recvauth.c
|
||||
@@ -59,6 +59,7 @@ recvauth_common(krb5_context context,
|
||||
krb5_rcache rcache = 0;
|
||||
krb5_octet response;
|
||||
krb5_data null_server;
|
||||
+ krb5_data d;
|
||||
int need_error_free = 0;
|
||||
int local_rcache = 0, local_authcon = 0;
|
||||
|
||||
@@ -77,7 +78,8 @@ recvauth_common(krb5_context context,
|
||||
*/
|
||||
if ((retval = krb5_read_message(context, fd, &inbuf)))
|
||||
return(retval);
|
||||
- if (strcmp(inbuf.data, sendauth_version)) {
|
||||
+ d = make_data((char *)sendauth_version, strlen(sendauth_version) + 1);
|
||||
+ if (!data_eq(inbuf, d)) {
|
||||
problem = KRB5_SENDAUTH_BADAUTHVERS;
|
||||
response = 1;
|
||||
}
|
||||
@@ -93,8 +95,9 @@ recvauth_common(krb5_context context,
|
||||
*/
|
||||
if ((retval = krb5_read_message(context, fd, &inbuf)))
|
||||
return(retval);
|
||||
- if (appl_version && strcmp(inbuf.data, appl_version)) {
|
||||
- if (!problem) {
|
||||
+ if (appl_version != NULL && !problem) {
|
||||
+ d = make_data(appl_version, strlen(appl_version) + 1);
|
||||
+ if (!data_eq(inbuf, d)) {
|
||||
problem = KRB5_SENDAUTH_BADAPPLVERS;
|
||||
response = 2;
|
||||
}
|
||||
@ -1,100 +0,0 @@
|
||||
From e3b5a5e5267818c97750b266df50b6a3d4649604 Mon Sep 17 00:00:00 2001
|
||||
From: Greg Hudson <ghudson@mit.edu>
|
||||
Date: Tue, 24 Mar 2015 12:02:37 -0400
|
||||
Subject: [PATCH] Prevent requires_preauth bypass [CVE-2015-2694]
|
||||
|
||||
In the OTP kdcpreauth module, don't set the TKT_FLG_PRE_AUTH bit until
|
||||
the request is successfully verified. In the PKINIT kdcpreauth
|
||||
module, don't respond with code 0 on empty input or an unconfigured
|
||||
realm. Together these bugs could cause the KDC preauth framework to
|
||||
erroneously treat a request as pre-authenticated.
|
||||
|
||||
CVE-2015-2694:
|
||||
|
||||
In MIT krb5 1.12 and later, when the KDC is configured with PKINIT
|
||||
support, an unauthenticated remote attacker can bypass the
|
||||
requires_preauth flag on a client principal and obtain a ciphertext
|
||||
encrypted in the principal's long-term key. This ciphertext could be
|
||||
used to conduct an off-line dictionary attack against the user's
|
||||
password.
|
||||
|
||||
CVSSv2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N/E:POC/RL:OF/RC:C
|
||||
|
||||
ticket: 8160 (new)
|
||||
target_version: 1.13.2
|
||||
tags: pullup
|
||||
subject: requires_preauth bypass in PKINIT-enabled KDC [CVE-2015-2694]
|
||||
---
|
||||
src/plugins/preauth/otp/main.c | 10 +++++++---
|
||||
src/plugins/preauth/pkinit/pkinit_srv.c | 4 ++--
|
||||
2 files changed, 9 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/src/plugins/preauth/otp/main.c b/src/plugins/preauth/otp/main.c
|
||||
index bf9c6a8..7941b4a 100644
|
||||
--- a/src/plugins/preauth/otp/main.c
|
||||
+++ b/src/plugins/preauth/otp/main.c
|
||||
@@ -42,6 +42,7 @@ static krb5_preauthtype otp_pa_type_list[] =
|
||||
struct request_state {
|
||||
krb5_kdcpreauth_verify_respond_fn respond;
|
||||
void *arg;
|
||||
+ krb5_enc_tkt_part *enc_tkt_reply;
|
||||
};
|
||||
|
||||
static krb5_error_code
|
||||
@@ -159,6 +160,9 @@ on_response(void *data, krb5_error_code retval, otp_response response)
|
||||
if (retval == 0 && response != otp_response_success)
|
||||
retval = KRB5_PREAUTH_FAILED;
|
||||
|
||||
+ if (retval == 0)
|
||||
+ rs.enc_tkt_reply->flags |= TKT_FLG_PRE_AUTH;
|
||||
+
|
||||
rs.respond(rs.arg, retval, NULL, NULL, NULL);
|
||||
}
|
||||
|
||||
@@ -263,8 +267,6 @@ otp_verify(krb5_context context, krb5_data *req_pkt, krb5_kdc_req *request,
|
||||
krb5_data d, plaintext;
|
||||
char *config;
|
||||
|
||||
- enc_tkt_reply->flags |= TKT_FLG_PRE_AUTH;
|
||||
-
|
||||
/* Get the FAST armor key. */
|
||||
armor_key = cb->fast_armor(context, rock);
|
||||
if (armor_key == NULL) {
|
||||
@@ -298,12 +300,14 @@ otp_verify(krb5_context context, krb5_data *req_pkt, krb5_kdc_req *request,
|
||||
goto error;
|
||||
}
|
||||
|
||||
- /* Create the request state. */
|
||||
+ /* Create the request state. Save the response callback, and the
|
||||
+ * enc_tkt_reply pointer so we can set the TKT_FLG_PRE_AUTH flag later. */
|
||||
rs = k5alloc(sizeof(struct request_state), &retval);
|
||||
if (rs == NULL)
|
||||
goto error;
|
||||
rs->arg = arg;
|
||||
rs->respond = respond;
|
||||
+ rs->enc_tkt_reply = enc_tkt_reply;
|
||||
|
||||
/* Get the principal's OTP configuration string. */
|
||||
retval = cb->get_string(context, rock, "otp", &config);
|
||||
diff --git a/src/plugins/preauth/pkinit/pkinit_srv.c b/src/plugins/preauth/pkinit/pkinit_srv.c
|
||||
index b472741..5b1d73e 100644
|
||||
--- a/src/plugins/preauth/pkinit/pkinit_srv.c
|
||||
+++ b/src/plugins/preauth/pkinit/pkinit_srv.c
|
||||
@@ -301,7 +301,7 @@ pkinit_server_verify_padata(krb5_context context,
|
||||
|
||||
pkiDebug("pkinit_verify_padata: entered!\n");
|
||||
if (data == NULL || data->length <= 0 || data->contents == NULL) {
|
||||
- (*respond)(arg, 0, NULL, NULL, NULL);
|
||||
+ (*respond)(arg, EINVAL, NULL, NULL, NULL);
|
||||
return;
|
||||
}
|
||||
|
||||
@@ -313,7 +313,7 @@ pkinit_server_verify_padata(krb5_context context,
|
||||
|
||||
plgctx = pkinit_find_realm_context(context, moddata, request->server);
|
||||
if (plgctx == NULL) {
|
||||
- (*respond)(arg, 0, NULL, NULL, NULL);
|
||||
+ (*respond)(arg, EINVAL, NULL, NULL, NULL);
|
||||
return;
|
||||
}
|
||||
|
||||
Loading…
Reference in New Issue
Block a user