diff options
| author | Nalin Dahyabhai <nalin@dahyabhai.net> | 2013-11-04 15:55:03 -0500 |
|---|---|---|
| committer | Nalin Dahyabhai <nalin@dahyabhai.net> | 2013-11-04 16:11:59 -0500 |
| commit | ed5a4a1ffbbef227a272997232c2d9a81bea2461 (patch) | |
| tree | 890be139db0588aea81283909f278ca7bd246344 | |
| parent | a244d8f93c578960ecdd15a172e6f45963f22462 (diff) | |
| download | krb5-ed5a4a1ffbbef227a272997232c2d9a81bea2461.tar.gz krb5-ed5a4a1ffbbef227a272997232c2d9a81bea2461.tar.xz krb5-ed5a4a1ffbbef227a272997232c2d9a81bea2461.zip | |
Switch to 1.11 backport of the CVE-2013-1418 patch
| -rw-r--r-- | krb5-CVE-2013-1418.patch | 22 |
1 files changed, 11 insertions, 11 deletions
diff --git a/krb5-CVE-2013-1418.patch b/krb5-CVE-2013-1418.patch index 593c02c..11c5b4b 100644 --- a/krb5-CVE-2013-1418.patch +++ b/krb5-CVE-2013-1418.patch @@ -1,8 +1,6 @@ -Adjusted to apply to 1.11.3. - -commit 5d2d9a1abe46a2c1a8614d4672d08d9d30a5f8bf +commit 05c544eef3633b774ca38154ba4c2bf3416b471b Author: Tom Yu <tlyu@mit.edu> -Date: Mon Nov 4 13:44:29 2013 -0500 +Date: Mon Nov 4 15:33:09 2013 -0500 Multi-realm KDC null deref [CVE-2013-1418] @@ -15,21 +13,23 @@ Date: Mon Nov 4 13:44:29 2013 -0500 exploit, and is only present if a third-party KDC database module can dereference a null pointer under certain conditions. - ticket: 7755 (new) - target_version: 1.12 - tags: pullup + (back ported from commit 5d2d9a1abe46a2c1a8614d4672d08d9d30a5f8bf) + + ticket: 7756 (new) + version_fixed: 1.11.4 + status: resolved diff --git a/src/kdc/main.c b/src/kdc/main.c -index 0f5961a..a7ffe63 100644 +index 1624046..8a085a2 100644 --- a/src/kdc/main.c +++ b/src/kdc/main.c -@@ -124,6 +124,9 @@ setup_server_realm(struct server_handle *handle, krb5_principal sprinc) - kdc_realm_t **kdc_realmlist = handle->kdc_realmlist; +@@ -125,6 +125,9 @@ setup_server_realm(struct server_handle *handle, krb5_principal sprinc) int kdc_numrealms = handle->kdc_numrealms; + kret = 0; + if (sprinc == NULL) + return NULL; + - kret = 0; if (kdc_numrealms > 1) { if (!(newrealm = find_realm_data(handle, sprinc->realm.data, + (krb5_ui_4) sprinc->realm.length))) |