rpms/krb5
7
0
Fork 0
Code Issues Pull Requests Releases Activity

- apply upstream patch to fix a null pointer dereference with the LDAP kdb backend (CVE-2011-1527, #744125), an assertion failure with multiple kdb backends (CVE-2011-1528), and a null pointer dereference with multiple kdb backends (CVE-2011-1529) (#737711)

Browse Source
This commit is contained in:
Nalin Dahyabhai 2011-10-18 14:28:08 -04:00
parent 73b7dd3ece
commit af8b546790
2 changed files with 84 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

75
krb5-1.9-MITKRB5-SA-2011-006.patch Normal file
View File

@ -0,0 +1,75 @@
diff --git a/src/plugins/kdb/db2/lockout.c b/src/plugins/kdb/db2/lockout.c
index b473611..50c60b7 100644
--- a/src/plugins/kdb/db2/lockout.c
+++ b/src/plugins/kdb/db2/lockout.c
@@ -169,6 +169,9 @@ krb5_db2_lockout_audit(krb5_context context,
return 0;
}
+ if (entry == NULL)
+ return 0;
+
if (!db_ctx->disable_lockout) {
code = lookup_lockout_policy(context, entry, &max_fail,
&failcnt_interval, &lockout_duration);
@@ -176,6 +179,15 @@ krb5_db2_lockout_audit(krb5_context context,
return code;
}
+ /*
+ * Don't continue to modify the DB for an already locked account.
+ * (In most cases, status will be KRB5KDC_ERR_CLIENT_REVOKED, and
+ * this check is unneeded, but in rare cases, we can fail with an
+ * integrity error or preauth failure before a policy check.)
+ */
+ if (locked_check_p(context, stamp, max_fail, lockout_duration, entry))
+ return 0;
+
/* Only mark the authentication as successful if the entry
* required preauthentication, otherwise we have no idea. */
if (status == 0 && (entry->attributes & KRB5_KDB_REQUIRES_PRE_AUTH)) {
diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
index 552e39a..c2f44ab 100644
--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
+++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
@@ -105,6 +105,7 @@ krb5_ldap_get_principal(krb5_context context, krb5_const_principal searchfor,
CHECK_LDAP_HANDLE(ldap_context);
if (is_principal_in_realm(ldap_context, searchfor) != 0) {
+ st = KRB5_KDB_NOENTRY;
krb5_set_error_message (context, st, "Principal does not belong to realm");
goto cleanup;
}
diff --git a/src/plugins/kdb/ldap/libkdb_ldap/lockout.c b/src/plugins/kdb/ldap/libkdb_ldap/lockout.c
index a218dc7..fd164dd 100644
--- a/src/plugins/kdb/ldap/libkdb_ldap/lockout.c
+++ b/src/plugins/kdb/ldap/libkdb_ldap/lockout.c
@@ -165,6 +165,9 @@ krb5_ldap_lockout_audit(krb5_context context,
return 0;
}
+ if (entry == NULL)
+ return 0;
+
if (!ldap_context->disable_lockout) {
code = lookup_lockout_policy(context, entry, &max_fail,
&failcnt_interval,
@@ -173,9 +176,16 @@ krb5_ldap_lockout_audit(krb5_context context,
return code;
}
- entry->mask = 0;
+ /*
+ * Don't continue to modify the DB for an already locked account.
+ * (In most cases, status will be KRB5KDC_ERR_CLIENT_REVOKED, and
+ * this check is unneeded, but in rare cases, we can fail with an
+ * integrity error or preauth failure before a policy check.)
+ */
+ if (locked_check_p(context, stamp, max_fail, lockout_duration, entry))
+ return 0;
- assert (!locked_check_p(context, stamp, max_fail, lockout_duration, entry));
+ entry->mask = 0;
/* Only mark the authentication as successful if the entry
* required preauthentication, otherwise we have no idea. */

10
krb5.spec
View File

@ -6,7 +6,7 @@
Summary: The Kerberos network authentication system Summary: The Kerberos network authentication system
Name: krb5 Name: krb5
Version: 1.9.1 Version: 1.9.1
Release: 17%{?dist} Release: 18%{?dist}
# Maybe we should explode from the now-available-to-everybody tarball instead? # Maybe we should explode from the now-available-to-everybody tarball instead?
# http://web.mit.edu/kerberos/dist/krb5/1.9/krb5-1.9.1-signed.tar # http://web.mit.edu/kerberos/dist/krb5/1.9/krb5-1.9.1-signed.tar
Source0: krb5-%{version}.tar.gz Source0: krb5-%{version}.tar.gz
@ -64,6 +64,7 @@ Patch87: krb5-1.9.1-sendto_poll2.patch
Patch88: krb5-1.9-crossrealm.patch Patch88: krb5-1.9-crossrealm.patch
Patch89: krb5-1.9.1-sendto_poll3.patch Patch89: krb5-1.9.1-sendto_poll3.patch
Patch90: krb5-trunk-ext_pac_sign.patch Patch90: krb5-trunk-ext_pac_sign.patch
Patch91: krb5-1.9-MITKRB5-SA-2011-006.patch
License: MIT License: MIT
URL: http://web.mit.edu/kerberos/www/ URL: http://web.mit.edu/kerberos/www/
@ -225,6 +226,7 @@ ln -s NOTICE LICENSE
%patch88 -p1 -b .crossrealm %patch88 -p1 -b .crossrealm
%patch89 -p1 -b .sendto_poll3 %patch89 -p1 -b .sendto_poll3
%patch90 -p1 -b .ext_pac_sign %patch90 -p1 -b .ext_pac_sign
%patch91 -p1 -b .2011-006
gzip doc/*.ps gzip doc/*.ps
sed -i -e '1s!\[twoside\]!!;s!%\(\\usepackage{hyperref}\)!\1!' doc/api/library.tex sed -i -e '1s!\[twoside\]!!;s!%\(\\usepackage{hyperref}\)!\1!' doc/api/library.tex
@ -703,6 +705,12 @@ exit 0
%{_sbindir}/uuserver %{_sbindir}/uuserver
%changelog %changelog
* Tue Oct 18 2011 Nalin Dahyabhai <nalin@redhat.com> 1.9.1-18
- apply upstream patch to fix a null pointer dereference with the LDAP kdb
backend (CVE-2011-1527, #744125), an assertion failure with multiple kdb
backends (CVE-2011-1528), and a null pointer dereference with multiple kdb
backends (CVE-2011-1529) (#737711)
* Thu Oct 13 2011 Nalin Dahyabhai <nalin@redhat.com> 1.9.1-17 * Thu Oct 13 2011 Nalin Dahyabhai <nalin@redhat.com> 1.9.1-17
- pull in patch from trunk to rename krb5int_pac_sign() to krb5_pac_sign() and - pull in patch from trunk to rename krb5int_pac_sign() to krb5_pac_sign() and
make it public (#745533) make it public (#745533)