From b54c6a0718666be217e2700c8d05b4ed5a148d66 Mon Sep 17 00:00:00 2001
From: Nalin Dahyabhai <nalin@fedoraproject.org>
Date: Tue, 4 Sep 2007 18:10:23 +0000
Subject: [PATCH] - incorporate fixes for MITKRB5-SA-2007-006 (CVE-2007-3999,
 CVE-2007-4000)

---
 CVE-2007-3999.patch | 19 +++++++++++++++++++
 CVE-2007-4000.patch | 22 ++++++++++++++++++++++
 krb5.spec           |  9 ++++++++-
 3 files changed, 49 insertions(+), 1 deletion(-)
 create mode 100644 CVE-2007-3999.patch
 create mode 100644 CVE-2007-4000.patch

diff --git a/CVE-2007-3999.patch b/CVE-2007-3999.patch
new file mode 100644
index 0000000..e8be46b
--- /dev/null
+++ b/CVE-2007-3999.patch
@@ -0,0 +1,19 @@
+*** src/lib/rpc/svc_auth_gss.c  (revision 20254)
+--- src/lib/rpc/svc_auth_gss.c  (local)
+***************
+*** 339,345 ****
+  	oa = &msg->rm_call.cb_cred;
+  	IXDR_PUT_ENUM(buf, oa->oa_flavor);
+  	IXDR_PUT_LONG(buf, oa->oa_length);
+! 	if (oa->oa_length) {
+  		memcpy((caddr_t)buf, oa->oa_base, oa->oa_length);
+  		buf += RNDUP(oa->oa_length) / sizeof(int32_t);
+  	}
+--- 339,345 ----
+  	oa = &msg->rm_call.cb_cred;
+  	IXDR_PUT_ENUM(buf, oa->oa_flavor);
+  	IXDR_PUT_LONG(buf, oa->oa_length);
+! 	if (oa->oa_length && oa->oa_length <= sizeof(rpchdr)) {
+  		memcpy((caddr_t)buf, oa->oa_base, oa->oa_length);
+  		buf += RNDUP(oa->oa_length) / sizeof(int32_t);
+  	}
diff --git a/CVE-2007-4000.patch b/CVE-2007-4000.patch
new file mode 100644
index 0000000..e01e4f8
--- /dev/null
+++ b/CVE-2007-4000.patch
@@ -0,0 +1,22 @@
+*** src/lib/kadm5/srv/svr_policy.c      (revision 20254)
+--- src/lib/kadm5/srv/svr_policy.c      (local)
+***************
+*** 211,218 ****
+      if((mask & KADM5_POLICY))
+  	return KADM5_BAD_MASK;
+  		
+!     ret = krb5_db_get_policy(handle->context, entry->policy, &p, &cnt);
+!     if( ret && (cnt==0) )
+  	return KADM5_UNK_POLICY;
+
+      if ((mask & KADM5_PW_MAX_LIFE))
+--- 211,219 ----
+      if((mask & KADM5_POLICY))
+  	return KADM5_BAD_MASK;
+  		
+!     if ((ret = krb5_db_get_policy(handle->context, entry->policy, &p, &cnt)))
+!       return ret;
+!     if (cnt != 1)
+  	return KADM5_UNK_POLICY;
+
+      if ((mask & KADM5_PW_MAX_LIFE))
diff --git a/krb5.spec b/krb5.spec
index a403f4a..f642c8d 100644
--- a/krb5.spec
+++ b/krb5.spec
@@ -14,7 +14,7 @@
 Summary: The Kerberos network authentication system.
 Name: krb5
 Version: 1.6.2
-Release: 4%{?dist}
+Release: 5%{?dist}
 # Maybe we should explode from the now-available-to-everybody tarball instead?
 # http://web.mit.edu/kerberos/dist/krb5/1.6/krb5-1.6.2-signed.tar
 Source0: krb5-%{version}.tar.gz
@@ -84,6 +84,8 @@ Patch56: krb5-1.6.2-doublelog.patch
 Patch57: krb5-1.6.2-login_chdir.patch
 Patch58: krb5-1.6.2-key_exp.patch
 Patch59: krb5-kpasswd_tcp.patch
+Patch65: CVE-2007-3999.patch
+Patch66: CVE-2007-4000.patch
 
 Patch60: krb5-1.6.1-pam.patch
 Patch61: krb5-trunk-manpaths.patch
@@ -206,6 +208,9 @@ installed on systems which are meant provide these services.
 %endif
 
 %changelog
+* Tue Sep  4 2007 Nalin Dahyabhai <nalin@redhat.com> 1.6.2-5
+- incorporate fixes for MITKRB5-SA-2007-006 (CVE-2007-3999, CVE-2007-4000)
+
 * Sat Aug 25 2007 Nalin Dahyabhai <nalin@redhat.com> 1.6.2-4
 - cover more cases in labeling files on creation
 - add missing gawk build dependency
@@ -1208,6 +1213,8 @@ popd
 %patch51 -p0 -b .ldap_init
 %patch52 -p0 -b .ldap_man
 %patch53 -p1 -b .nodeplibs
+%patch64 -p0 -b .2007-3999
+%patch65 -p0 -b .2007-4000
 #%patch55 -p1 -b .empty
 #%patch56 -p1 -b .doublelog
 #%patch57 -p1 -b .login_chdir