diff options
author | Nalin Dahyabhai <nalin@fedoraproject.org> | 2009-04-07 18:16:27 +0000 |
---|---|---|
committer | Nalin Dahyabhai <nalin@fedoraproject.org> | 2009-04-07 18:16:27 +0000 |
commit | 3b45fba643145ee49ce02042b9724acac59c9930 (patch) | |
tree | 20b7ac4ccab707794f57ae740a327a8cdbdb1e5d | |
parent | bc37108874fd61e1abf35d018264267bc233390b (diff) | |
download | krb5-3b45fba643145ee49ce02042b9724acac59c9930.tar.gz krb5-3b45fba643145ee49ce02042b9724acac59c9930.tar.xz krb5-3b45fba643145ee49ce02042b9724acac59c9930.zip |
- remove obsolete patch for CVE-2009-0845krb5-1_6_3-18_fc10
- add patches for read overflow and null pointer dereference in the
implementation of the SPNEGO mechanism (CVE-2009-0844, CVE-2009-0845)
- add patch for attempt to free uninitialized pointer in libkrb5
(CVE-2009-0846)
- add patch to fix length validation bug in libkrb5 (CVE-2009-0847)
-rw-r--r-- | krb5-1.6.3-spnego-crash.patch | 16 | ||||
-rw-r--r-- | krb5.spec | 17 |
2 files changed, 14 insertions, 19 deletions
diff --git a/krb5-1.6.3-spnego-crash.patch b/krb5-1.6.3-spnego-crash.patch deleted file mode 100644 index 1b2c8ee..0000000 --- a/krb5-1.6.3-spnego-crash.patch +++ /dev/null @@ -1,16 +0,0 @@ -Upstream change #22099, triggered by report from Marcus Granado, fix by Tom Yu. -In a nutshell, when return_token is neither NO_TOKEN_SEND nor CHECK_MIC, we -might still not want a reply token, for example if it's ERROR_TOKEN_SEND. -diff -up src/lib/gssapi/spnego/spnego_mech.c src/lib/gssapi/spnego/spnego_mech.c ---- src/lib/gssapi/spnego/spnego_mech.c 2009-03-17 16:47:10.000000000 -0400 -+++ src/lib/gssapi/spnego/spnego_mech.c 2009-03-17 16:47:14.000000000 -0400 -@@ -1248,7 +1248,8 @@ spnego_gss_accept_sec_context(void *ct, - &negState, &return_token); - } - cleanup: -- if (return_token != NO_TOKEN_SEND && return_token != CHECK_MIC) { -+ if (return_token == INIT_TOKEN_SEND || -+ return_token == CONT_TOKEN_SEND) { - tmpret = make_spnego_tokenTarg_msg(negState, sc->internal_mech, - &mechtok_out, mic_out, - return_token, @@ -16,7 +16,7 @@ Summary: The Kerberos network authentication system. Name: krb5 Version: 1.6.3 -Release: 17%{?dist} +Release: 18%{?dist} # Maybe we should explode from the now-available-to-everybody tarball instead? # http://web.mit.edu/kerberos/dist/krb5/1.6/krb5-1.6.2-signed.tar Source0: krb5-%{version}.tar.gz @@ -102,7 +102,9 @@ Patch77: krb5-CVE-2007-5971.patch Patch78: krb5-1.6.3-lucid-acceptor.patch Patch79: krb5-trunk-ftp_mget_case.patch Patch80: krb5-trunk-preauth-master.patch -Patch81: krb5-1.6.3-spnego-crash.patch +Patch82: krb5-CVE-2009-0844-0845-2.patch +Patch83: krb5-CVE-2009-0846.patch +Patch84: krb5-CVE-2009-0847.patch License: MIT URL: http://web.mit.edu/kerberos/www/ @@ -233,6 +235,13 @@ to obtain initial credentials from a KDC using a private key and a certificate. %changelog +* Tue Apr 7 2009 Nalin Dahyabhai <nalin@redhat.com> 1.6.3-18 +- add patches for read overflow and null pointer dereference in the + implementation of the SPNEGO mechanism (CVE-2009-0844, CVE-2009-0845) +- add patch for attempt to free uninitialized pointer in libkrb5 + (CVE-2009-0846) +- add patch to fix length validation bug in libkrb5 (CVE-2009-0847) + * Tue Mar 17 2009 Nalin Dahyabhai <nalin@redhat.com> 1.6.3-17 - libgssapi_krb5: backport fix for some errors which can occur when we fail to set up the server half of a context (CVE-2009-0845) @@ -1395,7 +1404,9 @@ popd %patch78 -p0 -b .lucid_acceptor %patch79 -p0 -b .ftp_mget_case %patch80 -p0 -b .preauth_master -%patch81 -p0 -b .spnego-crash +%patch82 -p1 -b .CVE-2009-0844-0845-2 +%patch83 -p1 -b .CVE-2009-0846 +%patch84 -p1 -b .CVE-2009-0847 cp src/krb524/README README.krb524 gzip doc/*.ps |