diff options
author | Nalin Dahyabhai <nalin@dahyabhai.net> | 2011-10-18 14:28:34 -0400 |
---|---|---|
committer | Nalin Dahyabhai <nalin@dahyabhai.net> | 2011-10-18 14:28:34 -0400 |
commit | 1e46cd03de1f572574ed3c5fc46e493d0ded254f (patch) | |
tree | 65260e522f0eff16e1caab0ab975e0555dd6281f | |
parent | 229de03940b3aea0f515b605fe6a52d4c9140c34 (diff) | |
download | krb5-1e46cd03de1f572574ed3c5fc46e493d0ded254f.tar.gz krb5-1e46cd03de1f572574ed3c5fc46e493d0ded254f.tar.xz krb5-1e46cd03de1f572574ed3c5fc46e493d0ded254f.zip |
- apply upstream patch to fix a null pointer dereference with the LDAP kdb backend (CVE-2011-1527, #744125), an assertion failure with multiple kdb backends (CVE-2011-1528), and a null pointer dereference with multiple kdb backends (CVE-2011-1529) (#737711)krb5-1.9.1-17.fc16
-rw-r--r-- | krb5-1.9-MITKRB5-SA-2011-006.patch | 75 | ||||
-rw-r--r-- | krb5.spec | 10 |
2 files changed, 84 insertions, 1 deletions
diff --git a/krb5-1.9-MITKRB5-SA-2011-006.patch b/krb5-1.9-MITKRB5-SA-2011-006.patch new file mode 100644 index 0000000..05a22ca --- /dev/null +++ b/krb5-1.9-MITKRB5-SA-2011-006.patch @@ -0,0 +1,75 @@ +diff --git a/src/plugins/kdb/db2/lockout.c b/src/plugins/kdb/db2/lockout.c +index b473611..50c60b7 100644 +--- a/src/plugins/kdb/db2/lockout.c ++++ b/src/plugins/kdb/db2/lockout.c +@@ -169,6 +169,9 @@ krb5_db2_lockout_audit(krb5_context context, + return 0; + } + ++ if (entry == NULL) ++ return 0; ++ + if (!db_ctx->disable_lockout) { + code = lookup_lockout_policy(context, entry, &max_fail, + &failcnt_interval, &lockout_duration); +@@ -176,6 +179,15 @@ krb5_db2_lockout_audit(krb5_context context, + return code; + } + ++ /* ++ * Don't continue to modify the DB for an already locked account. ++ * (In most cases, status will be KRB5KDC_ERR_CLIENT_REVOKED, and ++ * this check is unneeded, but in rare cases, we can fail with an ++ * integrity error or preauth failure before a policy check.) ++ */ ++ if (locked_check_p(context, stamp, max_fail, lockout_duration, entry)) ++ return 0; ++ + /* Only mark the authentication as successful if the entry + * required preauthentication, otherwise we have no idea. */ + if (status == 0 && (entry->attributes & KRB5_KDB_REQUIRES_PRE_AUTH)) { +diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c +index 552e39a..c2f44ab 100644 +--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c ++++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c +@@ -105,6 +105,7 @@ krb5_ldap_get_principal(krb5_context context, krb5_const_principal searchfor, + CHECK_LDAP_HANDLE(ldap_context); + + if (is_principal_in_realm(ldap_context, searchfor) != 0) { ++ st = KRB5_KDB_NOENTRY; + krb5_set_error_message (context, st, "Principal does not belong to realm"); + goto cleanup; + } +diff --git a/src/plugins/kdb/ldap/libkdb_ldap/lockout.c b/src/plugins/kdb/ldap/libkdb_ldap/lockout.c +index a218dc7..fd164dd 100644 +--- a/src/plugins/kdb/ldap/libkdb_ldap/lockout.c ++++ b/src/plugins/kdb/ldap/libkdb_ldap/lockout.c +@@ -165,6 +165,9 @@ krb5_ldap_lockout_audit(krb5_context context, + return 0; + } + ++ if (entry == NULL) ++ return 0; ++ + if (!ldap_context->disable_lockout) { + code = lookup_lockout_policy(context, entry, &max_fail, + &failcnt_interval, +@@ -173,9 +176,16 @@ krb5_ldap_lockout_audit(krb5_context context, + return code; + } + +- entry->mask = 0; ++ /* ++ * Don't continue to modify the DB for an already locked account. ++ * (In most cases, status will be KRB5KDC_ERR_CLIENT_REVOKED, and ++ * this check is unneeded, but in rare cases, we can fail with an ++ * integrity error or preauth failure before a policy check.) ++ */ ++ if (locked_check_p(context, stamp, max_fail, lockout_duration, entry)) ++ return 0; + +- assert (!locked_check_p(context, stamp, max_fail, lockout_duration, entry)); ++ entry->mask = 0; + + /* Only mark the authentication as successful if the entry + * required preauthentication, otherwise we have no idea. */ @@ -6,7 +6,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.9.1 -Release: 16%{?dist} +Release: 17%{?dist} # Maybe we should explode from the now-available-to-everybody tarball instead? # http://web.mit.edu/kerberos/dist/krb5/1.9/krb5-1.9.1-signed.tar Source0: krb5-%{version}.tar.gz @@ -63,6 +63,7 @@ Patch86: krb5-1.9-debuginfo.patch Patch87: krb5-1.9.1-sendto_poll2.patch Patch88: krb5-1.9-crossrealm.patch Patch89: krb5-1.9.1-sendto_poll3.patch +Patch90: krb5-1.9-MITKRB5-SA-2011-006.patch License: MIT URL: http://web.mit.edu/kerberos/www/ @@ -223,6 +224,7 @@ ln -s NOTICE LICENSE %patch87 -p1 -b .sendto_poll2 %patch88 -p1 -b .crossrealm %patch89 -p1 -b .sendto_poll3 +%patch90 -p1 -b .2011-006 gzip doc/*.ps sed -i -e '1s!\[twoside\]!!;s!%\(\\usepackage{hyperref}\)!\1!' doc/api/library.tex @@ -701,6 +703,12 @@ exit 0 %{_sbindir}/uuserver %changelog +* Tue Oct 18 2011 Nalin Dahyabhai <nalin@redhat.com> 1.9.1-17 +- apply upstream patch to fix a null pointer dereference with the LDAP kdb + backend (CVE-2011-1527, #744125), an assertion failure with multiple kdb + backends (CVE-2011-1528), and a null pointer dereference with multiple kdb + backends (CVE-2011-1529) (#737711) + * Fri Oct 7 2011 Nalin Dahyabhai <nalin@redhat.com> 1.9.1-16 - kadmin.service: fix #723723 again - kadmin.service,krb5kdc.service: remove optional use of $KRB5REALM in command |