diff options
| -rw-r--r-- | krb5.spec | 14 | ||||
| -rw-r--r-- | krb5_cve_2014_9421_2014_9422_2014_9423_2014_5352_fixed_whitespaces.patch | 324 |
2 files changed, 337 insertions, 1 deletions
@@ -43,7 +43,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.13 -Release: 7%{?dist} +Release: 8%{?dist} # - Maybe we should explode from the now-available-to-everybody tarball instead? # http://web.mit.edu/kerberos/dist/krb5/1.13/krb5-1.13-signed.tar # - The sources below are stored in a lookaside cache. Upload with @@ -98,6 +98,7 @@ Patch137: krb5-CVE_2014_5353_fix_LDAP_misused_policy_name_crash.patch Patch138: krb5-CVE_2014_5354_support_keyless_principals_in_LDAP.patch Patch139: krb5-1.13_kinit_C_loop_krb5bug243.patch Patch140: krb5-1.14-Support-KDC_ERR_MORE_PREAUTH_DATA_REQUIRED.patch +Patch141: krb5_cve_2014_9421_2014_9422_2014_9423_2014_5352_fixed_whitespaces.patch License: MIT URL: http://web.mit.edu/kerberos/www/ @@ -323,6 +324,7 @@ ln NOTICE LICENSE %patch138 -p1 %patch139 -p1 -b .krb5_1_13_kinit_C_loop_krb5bug243 %patch140 -p1 -b .krb5-1.14-support-kdc_err_more_preauth_data_required +%patch141 -p1 -b .krb5_cve_2014_9421_2014_9422_2014_9423_2014_5352_fixed_whitespaces # Take the execute bit off of documentation. chmod -x doc/krb5-protocol/*.txt doc/ccapi/*.html @@ -995,6 +997,16 @@ exit 0 %changelog +* Wed Feb 4 2015 Roland Mainz <rmainz@redhat.com> - 1.13-8 +- fix for CVE-2014-5352 (#1179856) "gss_process_context_token() + incorrectly frees context (MITKRB5-SA-2015-001)" +- fix for CVE-2014-9421 (#1179857) "kadmind doubly frees partial + deserialization results (MITKRB5-SA-2015-001)" +- fix for CVE-2014-9422 (#1179861) "kadmind incorrectly + validates server principal name (MITKRB5-SA-2015-001)" +- fix for CVE-2014-9423 (#1179863) "libgssrpc server applications + leak uninitialized bytes (MITKRB5-SA-2015-001)" + * Wed Feb 4 2015 Roland Mainz <rmainz@redhat.com> - 1.13-7 - Remove "python-sphinx-latex" and "tar" from the build requirements to fix build failures on F22 machines. diff --git a/krb5_cve_2014_9421_2014_9422_2014_9423_2014_5352_fixed_whitespaces.patch b/krb5_cve_2014_9421_2014_9422_2014_9423_2014_5352_fixed_whitespaces.patch new file mode 100644 index 0000000..b0c047b --- /dev/null +++ b/krb5_cve_2014_9421_2014_9422_2014_9423_2014_5352_fixed_whitespaces.patch @@ -0,0 +1,324 @@ +diff -r -u krb5-1.13/src/kadmin/server/kadm_rpc_svc.c krb5-1.13/src/kadmin/server/kadm_rpc_svc.c +--- krb5-1.13/src/kadmin/server/kadm_rpc_svc.c 2014-10-16 01:55:10.000000000 +0200 ++++ krb5-1.13/src/kadmin/server/kadm_rpc_svc.c 2015-02-04 11:29:00.891062971 +0100 +@@ -4,7 +4,7 @@ + * + */ + +-#include <k5-platform.h> ++#include <k5-int.h> + #include <gssrpc/rpc.h> + #include <gssapi/gssapi_krb5.h> /* for gss_nt_krb5_name */ + #include <syslog.h> +@@ -296,14 +296,8 @@ + c1 = krb5_princ_component(kctx, princ, 0); + c2 = krb5_princ_component(kctx, princ, 1); + realm = krb5_princ_realm(kctx, princ); +- if (strncmp(handle->params.realm, realm->data, realm->length) == 0 +- && strncmp("kadmin", c1->data, c1->length) == 0) { +- +- if (strncmp("history", c2->data, c2->length) == 0) +- goto fail_princ; +- else +- success = 1; +- } ++ success = data_eq_string(*realm, handle->params.realm) && ++ data_eq_string(*c1, "kadmin") && !data_eq_string(*c2, "history"); + + fail_princ: + if (!success) { +diff -r -u krb5-1.13/src/lib/gssapi/krb5/context_time.c krb5-1.13/src/lib/gssapi/krb5/context_time.c +--- krb5-1.13/src/lib/gssapi/krb5/context_time.c 2014-10-16 01:55:10.000000000 +0200 ++++ krb5-1.13/src/lib/gssapi/krb5/context_time.c 2015-02-04 11:29:00.891062971 +0100 +@@ -40,7 +40,7 @@ + + ctx = (krb5_gss_ctx_id_rec *) context_handle; + +- if (! ctx->established) { ++ if (ctx->terminated || !ctx->established) { + *minor_status = KG_CTX_INCOMPLETE; + return(GSS_S_NO_CONTEXT); + } +diff -r -u krb5-1.13/src/lib/gssapi/krb5/export_sec_context.c krb5-1.13/src/lib/gssapi/krb5/export_sec_context.c +--- krb5-1.13/src/lib/gssapi/krb5/export_sec_context.c 2014-10-16 01:55:10.000000000 +0200 ++++ krb5-1.13/src/lib/gssapi/krb5/export_sec_context.c 2015-02-04 11:29:00.892063013 +0100 +@@ -45,6 +45,11 @@ + *minor_status = 0; + + ctx = (krb5_gss_ctx_id_t) *context_handle; ++ if (ctx->terminated) { ++ *minor_status = KG_CTX_INCOMPLETE; ++ return (GSS_S_NO_CONTEXT); ++ } ++ + context = ctx->k5_context; + kret = krb5_gss_ser_init(context); + if (kret) +diff -r -u krb5-1.13/src/lib/gssapi/krb5/gssapi_krb5.c krb5-1.13/src/lib/gssapi/krb5/gssapi_krb5.c +--- krb5-1.13/src/lib/gssapi/krb5/gssapi_krb5.c 2014-10-16 01:55:10.000000000 +0200 ++++ krb5-1.13/src/lib/gssapi/krb5/gssapi_krb5.c 2015-02-04 11:29:00.893063056 +0100 +@@ -369,7 +369,7 @@ + + ctx = (krb5_gss_ctx_id_rec *) context_handle; + +- if (!ctx->established) ++ if (ctx->terminated || !ctx->established) + return GSS_S_NO_CONTEXT; + + for (i = 0; i < sizeof(krb5_gss_inquire_sec_context_by_oid_ops)/ +diff -r -u krb5-1.13/src/lib/gssapi/krb5/gssapiP_krb5.h krb5-1.13/src/lib/gssapi/krb5/gssapiP_krb5.h +--- krb5-1.13/src/lib/gssapi/krb5/gssapiP_krb5.h 2014-10-16 01:55:10.000000000 +0200 ++++ krb5-1.13/src/lib/gssapi/krb5/gssapiP_krb5.h 2015-02-04 11:29:00.893063056 +0100 +@@ -206,6 +206,7 @@ + unsigned int established : 1; + unsigned int have_acceptor_subkey : 1; + unsigned int seed_init : 1; /* XXX tested but never actually set */ ++ unsigned int terminated : 1; + OM_uint32 gss_flags; + unsigned char seed[16]; + krb5_gss_name_t here; +diff -r -u krb5-1.13/src/lib/gssapi/krb5/inq_context.c krb5-1.13/src/lib/gssapi/krb5/inq_context.c +--- krb5-1.13/src/lib/gssapi/krb5/inq_context.c 2014-10-16 01:55:10.000000000 +0200 ++++ krb5-1.13/src/lib/gssapi/krb5/inq_context.c 2015-02-04 11:29:00.895063144 +0100 +@@ -105,7 +105,7 @@ + + ctx = (krb5_gss_ctx_id_rec *) context_handle; + +- if (! ctx->established) { ++ if (ctx->terminated || !ctx->established) { + *minor_status = KG_CTX_INCOMPLETE; + return(GSS_S_NO_CONTEXT); + } +diff -r -u krb5-1.13/src/lib/gssapi/krb5/k5seal.c krb5-1.13/src/lib/gssapi/krb5/k5seal.c +--- krb5-1.13/src/lib/gssapi/krb5/k5seal.c 2014-10-16 01:55:10.000000000 +0200 ++++ krb5-1.13/src/lib/gssapi/krb5/k5seal.c 2015-02-04 11:29:00.896063191 +0100 +@@ -342,7 +342,7 @@ + + ctx = (krb5_gss_ctx_id_rec *) context_handle; + +- if (! ctx->established) { ++ if (ctx->terminated || !ctx->established) { + *minor_status = KG_CTX_INCOMPLETE; + return(GSS_S_NO_CONTEXT); + } +diff -r -u krb5-1.13/src/lib/gssapi/krb5/k5sealiov.c krb5-1.13/src/lib/gssapi/krb5/k5sealiov.c +--- krb5-1.13/src/lib/gssapi/krb5/k5sealiov.c 2014-10-16 01:55:10.000000000 +0200 ++++ krb5-1.13/src/lib/gssapi/krb5/k5sealiov.c 2015-02-04 11:29:00.896063191 +0100 +@@ -281,7 +281,7 @@ + } + + ctx = (krb5_gss_ctx_id_rec *)context_handle; +- if (!ctx->established) { ++ if (ctx->terminated || !ctx->established) { + *minor_status = KG_CTX_INCOMPLETE; + return GSS_S_NO_CONTEXT; + } +diff -r -u krb5-1.13/src/lib/gssapi/krb5/k5unseal.c krb5-1.13/src/lib/gssapi/krb5/k5unseal.c +--- krb5-1.13/src/lib/gssapi/krb5/k5unseal.c 2014-10-16 01:55:10.000000000 +0200 ++++ krb5-1.13/src/lib/gssapi/krb5/k5unseal.c 2015-02-04 11:29:00.897063240 +0100 +@@ -492,7 +492,7 @@ + + ctx = (krb5_gss_ctx_id_rec *) context_handle; + +- if (! ctx->established) { ++ if (ctx->terminated || !ctx->established) { + *minor_status = KG_CTX_INCOMPLETE; + return(GSS_S_NO_CONTEXT); + } +diff -r -u krb5-1.13/src/lib/gssapi/krb5/k5unsealiov.c krb5-1.13/src/lib/gssapi/krb5/k5unsealiov.c +--- krb5-1.13/src/lib/gssapi/krb5/k5unsealiov.c 2014-10-16 01:55:10.000000000 +0200 ++++ krb5-1.13/src/lib/gssapi/krb5/k5unsealiov.c 2015-02-04 11:29:00.897063240 +0100 +@@ -625,7 +625,7 @@ + OM_uint32 code; + + ctx = (krb5_gss_ctx_id_rec *)context_handle; +- if (!ctx->established) { ++ if (ctx->terminated || !ctx->established) { + *minor_status = KG_CTX_INCOMPLETE; + return GSS_S_NO_CONTEXT; + } +diff -r -u krb5-1.13/src/lib/gssapi/krb5/lucid_context.c krb5-1.13/src/lib/gssapi/krb5/lucid_context.c +--- krb5-1.13/src/lib/gssapi/krb5/lucid_context.c 2014-10-16 01:55:10.000000000 +0200 ++++ krb5-1.13/src/lib/gssapi/krb5/lucid_context.c 2015-02-04 11:29:00.897063240 +0100 +@@ -75,6 +75,11 @@ + *minor_status = 0; + *data_set = GSS_C_NO_BUFFER_SET; + ++ if (ctx->terminated || !ctx->established) { ++ *minor_status = KG_CTX_INCOMPLETE; ++ return GSS_S_NO_CONTEXT; ++ } ++ + retval = generic_gss_oid_decompose(minor_status, + GSS_KRB5_EXPORT_LUCID_SEC_CONTEXT_OID, + GSS_KRB5_EXPORT_LUCID_SEC_CONTEXT_OID_LENGTH, +diff -r -u krb5-1.13/src/lib/gssapi/krb5/prf.c krb5-1.13/src/lib/gssapi/krb5/prf.c +--- krb5-1.13/src/lib/gssapi/krb5/prf.c 2014-10-16 01:55:10.000000000 +0200 ++++ krb5-1.13/src/lib/gssapi/krb5/prf.c 2015-02-04 11:29:00.899063344 +0100 +@@ -58,6 +58,10 @@ + ns.data = NULL; + + ctx = (krb5_gss_ctx_id_t)context; ++ if (ctx->terminated || !ctx->established) { ++ *minor_status = KG_CTX_INCOMPLETE; ++ return GSS_S_NO_CONTEXT; ++ } + + switch (prf_key) { + case GSS_C_PRF_KEY_FULL: +diff -r -u krb5-1.13/src/lib/gssapi/krb5/process_context_token.c krb5-1.13/src/lib/gssapi/krb5/process_context_token.c +--- krb5-1.13/src/lib/gssapi/krb5/process_context_token.c 2014-10-16 01:55:10.000000000 +0200 ++++ krb5-1.13/src/lib/gssapi/krb5/process_context_token.c 2015-02-04 11:29:00.899063344 +0100 +@@ -39,11 +39,18 @@ + + ctx = (krb5_gss_ctx_id_t) context_handle; + +- if (! ctx->established) { ++ if (ctx->terminated || !ctx->established) { + *minor_status = KG_CTX_INCOMPLETE; + return(GSS_S_NO_CONTEXT); + } + ++ /* We only support context deletion tokens for now, and RFC 4121 does not ++ * define a context deletion token. */ ++ if (ctx->proto) { ++ *minor_status = 0; ++ return(GSS_S_DEFECTIVE_TOKEN); ++ } ++ + /* "unseal" the token */ + + if (GSS_ERROR(majerr = kg_unseal(minor_status, context_handle, +@@ -52,8 +59,8 @@ + KG_TOK_DEL_CTX))) + return(majerr); + +- /* that's it. delete the context */ +- +- return(krb5_gss_delete_sec_context(minor_status, &context_handle, +- GSS_C_NO_BUFFER)); ++ /* Mark the context as terminated, but do not delete it (as that would ++ * leave the caller with a dangling context handle). */ ++ ctx->terminated = 1; ++ return(GSS_S_COMPLETE); + } +diff -r -u krb5-1.13/src/lib/gssapi/krb5/wrap_size_limit.c krb5-1.13/src/lib/gssapi/krb5/wrap_size_limit.c +--- krb5-1.13/src/lib/gssapi/krb5/wrap_size_limit.c 2014-10-16 01:55:10.000000000 +0200 ++++ krb5-1.13/src/lib/gssapi/krb5/wrap_size_limit.c 2015-02-04 11:29:00.899063344 +0100 +@@ -95,7 +95,7 @@ + } + + ctx = (krb5_gss_ctx_id_rec *) context_handle; +- if (! ctx->established) { ++ if (ctx->terminated || !ctx->established) { + *minor_status = KG_CTX_INCOMPLETE; + return(GSS_S_NO_CONTEXT); + } +diff -r -u krb5-1.13/src/lib/gssapi/mechglue/mglueP.h krb5-1.13/src/lib/gssapi/mechglue/mglueP.h +--- krb5-1.13/src/lib/gssapi/mechglue/mglueP.h 2014-10-16 01:55:10.000000000 +0200 ++++ krb5-1.13/src/lib/gssapi/mechglue/mglueP.h 2015-02-04 11:29:00.901063453 +0100 +@@ -25,7 +25,6 @@ + */ + typedef struct gss_union_ctx_id_struct { + struct gss_union_ctx_id_struct *loopback; +- struct gss_union_ctx_id_struct *interposer; + gss_OID mech_type; + gss_ctx_id_t internal_ctx_id; + } gss_union_ctx_id_desc, *gss_union_ctx_id_t; +diff -r -u krb5-1.13/src/lib/kadm5/kadm_rpc_xdr.c krb5-1.13/src/lib/kadm5/kadm_rpc_xdr.c +--- krb5-1.13/src/lib/kadm5/kadm_rpc_xdr.c 2014-10-16 01:55:10.000000000 +0200 ++++ krb5-1.13/src/lib/kadm5/kadm_rpc_xdr.c 2015-02-04 11:29:00.901063453 +0100 +@@ -320,6 +320,7 @@ + free(tl); + tl = tl2; + } ++ *tl_data_head = NULL; + break; + + case XDR_ENCODE: +@@ -1096,6 +1097,7 @@ + case XDR_FREE: + if(*objp != NULL) + krb5_free_principal(context, *objp); ++ *objp = NULL; + break; + } + return TRUE; +diff -r -u krb5-1.13/src/lib/rpc/auth_gssapi_misc.c krb5-1.13/src/lib/rpc/auth_gssapi_misc.c +--- krb5-1.13/src/lib/rpc/auth_gssapi_misc.c 2014-10-16 01:55:10.000000000 +0200 ++++ krb5-1.13/src/lib/rpc/auth_gssapi_misc.c 2015-02-04 11:29:00.901063453 +0100 +@@ -322,7 +322,6 @@ + if (! (*xdr_func)(&temp_xdrs, xdr_ptr)) { + PRINTF(("gssapi_unwrap_data: deserializing arguments failed\n")); + gss_release_buffer(minor, &out_buf); +- xdr_free(xdr_func, xdr_ptr); + XDR_DESTROY(&temp_xdrs); + return FALSE; + } +diff -r -u krb5-1.13/src/lib/rpc/svc_auth_gss.c krb5-1.13/src/lib/rpc/svc_auth_gss.c +--- krb5-1.13/src/lib/rpc/svc_auth_gss.c 2014-10-16 01:55:10.000000000 +0200 ++++ krb5-1.13/src/lib/rpc/svc_auth_gss.c 2015-02-04 11:29:00.903063567 +0100 +@@ -65,16 +65,6 @@ + + extern SVCAUTH svc_auth_none; + +-/* +- * from mit-krb5-1.2.1 mechglue/mglueP.h: +- * Array of context IDs typed by mechanism OID +- */ +-typedef struct gss_union_ctx_id_t { +- gss_OID mech_type; +- gss_ctx_id_t internal_ctx_id; +-} gss_union_ctx_id_desc, *gss_union_ctx_id_t; +- +- + static auth_gssapi_log_badauth_func log_badauth = NULL; + static caddr_t log_badauth_data = NULL; + static auth_gssapi_log_badauth2_func log_badauth2 = NULL; +@@ -239,16 +229,8 @@ + gd->ctx = GSS_C_NO_CONTEXT; + goto errout; + } +- /* +- * ANDROS: krb5 mechglue returns ctx of size 8 - two pointers, +- * one to the mechanism oid, one to the internal_ctx_id +- */ +- if ((gr->gr_ctx.value = mem_alloc(sizeof(gss_union_ctx_id_desc))) == NULL) { +- fprintf(stderr, "svcauth_gss_accept_context: out of memory\n"); +- goto errout; +- } +- memcpy(gr->gr_ctx.value, gd->ctx, sizeof(gss_union_ctx_id_desc)); +- gr->gr_ctx.length = sizeof(gss_union_ctx_id_desc); ++ gr->gr_ctx.value = "xxxx"; ++ gr->gr_ctx.length = 4; + + /* gr->gr_win = 0x00000005; ANDROS: for debugging linux kernel version... */ + gr->gr_win = sizeof(gd->seqmask) * 8; +@@ -520,8 +502,6 @@ + + if (!svcauth_gss_nextverf(rqst, htonl(gr.gr_win))) { + gss_release_buffer(&min_stat, &gr.gr_token); +- mem_free(gr.gr_ctx.value, +- sizeof(gss_union_ctx_id_desc)); + ret_freegc (AUTH_FAILED); + } + *no_dispatch = TRUE; +@@ -531,7 +511,6 @@ + + gss_release_buffer(&min_stat, &gr.gr_token); + gss_release_buffer(&min_stat, &gd->checksum); +- mem_free(gr.gr_ctx.value, sizeof(gss_union_ctx_id_desc)); + if (!call_stat) + ret_freegc (AUTH_FAILED); + +diff -r -u krb5-1.13/src/tests/gssapi/t_prf.c krb5-1.13/src/tests/gssapi/t_prf.c +--- krb5-1.13/src/tests/gssapi/t_prf.c 2014-10-16 01:55:10.000000000 +0200 ++++ krb5-1.13/src/tests/gssapi/t_prf.c 2015-02-04 11:29:00.903063567 +0100 +@@ -127,6 +127,7 @@ + uctx.mech_type = &mech_krb5; + uctx.internal_ctx_id = (gss_ctx_id_t)&kgctx; + kgctx.k5_context = NULL; ++ kgctx.established = 1; + kgctx.have_acceptor_subkey = 1; + kb1.contents = k1buf; + kb2.contents = k2buf; |