diff options
| author | Tom Yu <tlyu@mit.edu> | 2011-10-18 18:51:35 +0000 |
|---|---|---|
| committer | Tom Yu <tlyu@mit.edu> | 2011-10-18 18:51:35 +0000 |
| commit | 7390de6c860fbb764efe2e7e85d599edaf97fb96 (patch) | |
| tree | 88c97a153344f0b3847ded2cb8af279ca76fa407 /src/plugins/kdb/db2 | |
| parent | ddea50b5a7e04a28e2a15b2989125ccc4532ccf6 (diff) | |
| download | krb5-7390de6c860fbb764efe2e7e85d599edaf97fb96.tar.gz krb5-7390de6c860fbb764efe2e7e85d599edaf97fb96.tar.xz krb5-7390de6c860fbb764efe2e7e85d599edaf97fb96.zip | |
SA-2011-006 KDC denial of service [CVE-2011-1527 CVE-2011-1528 CVE-2011-1529]
Fix null pointer dereference and assertion failure conditions that
could cause a denial of service.
ticket: 6981
target_version: 1.10
tags: pullup
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25368 dc483132-0cff-0310-8789-dd5450dbe970
Diffstat (limited to 'src/plugins/kdb/db2')
| -rw-r--r-- | src/plugins/kdb/db2/lockout.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/src/plugins/kdb/db2/lockout.c b/src/plugins/kdb/db2/lockout.c index da5e761925..ba542128b0 100644 --- a/src/plugins/kdb/db2/lockout.c +++ b/src/plugins/kdb/db2/lockout.c @@ -165,6 +165,9 @@ krb5_db2_lockout_audit(krb5_context context, return 0; } + if (entry == NULL) + return 0; + if (!db_ctx->disable_lockout) { code = lookup_lockout_policy(context, entry, &max_fail, &failcnt_interval, &lockout_duration); @@ -172,6 +175,15 @@ krb5_db2_lockout_audit(krb5_context context, return code; } + /* + * Don't continue to modify the DB for an already locked account. + * (In most cases, status will be KRB5KDC_ERR_CLIENT_REVOKED, and + * this check is unneeded, but in rare cases, we can fail with an + * integrity error or preauth failure before a policy check.) + */ + if (locked_check_p(context, stamp, max_fail, lockout_duration, entry)) + return 0; + /* Only mark the authentication as successful if the entry * required preauthentication, otherwise we have no idea. */ if (status == 0 && (entry->attributes & KRB5_KDB_REQUIRES_PRE_AUTH)) { |