[25878] in CVS-changelog-for-Kerberos-V5
svn rev #25368: trunk/src/plugins/kdb/ db2/ ldap/libkdb_ldap/
daemon@ATHENA.MIT.EDU (tlyu@mit.edu)
Tue Oct 18 14:51:37 2011
Date: Tue, 18 Oct 2011 14:51:35 -0400
From: tlyu@mit.edu
Message-Id: <201110181851.p9IIpZPW012876@drugstore.mit.edu>
To: cvs-krb5@mit.edu
Reply-To: krbdev@mit.edu
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
http://src.mit.edu/fisheye/changelog/krb5/?cs=25368
Commit By: tlyu
Log Message:
ticket: 6981
subject: SA-2011-006 KDC denial of service [CVE-2011-1527 CVE-2011-1528 CVE-2011-1529]
target_version: 1.10
tags: pullup
Fix null pointer dereference and assertion failure conditions that
could cause a denial of service.
Changed Files:
U trunk/src/plugins/kdb/db2/lockout.c
U trunk/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
U trunk/src/plugins/kdb/ldap/libkdb_ldap/lockout.c
Modified: trunk/src/plugins/kdb/db2/lockout.c
===================================================================
--- trunk/src/plugins/kdb/db2/lockout.c 2011-10-18 16:32:28 UTC (rev 25367)
+++ trunk/src/plugins/kdb/db2/lockout.c 2011-10-18 18:51:35 UTC (rev 25368)
@@ -165,6 +165,9 @@
return 0;
}
+ if (entry == NULL)
+ return 0;
+
if (!db_ctx->disable_lockout) {
code = lookup_lockout_policy(context, entry, &max_fail,
&failcnt_interval, &lockout_duration);
@@ -172,6 +175,15 @@
return code;
}
+ /*
+ * Don't continue to modify the DB for an already locked account.
+ * (In most cases, status will be KRB5KDC_ERR_CLIENT_REVOKED, and
+ * this check is unneeded, but in rare cases, we can fail with an
+ * integrity error or preauth failure before a policy check.)
+ */
+ if (locked_check_p(context, stamp, max_fail, lockout_duration, entry))
+ return 0;
+
/* Only mark the authentication as successful if the entry
* required preauthentication, otherwise we have no idea. */
if (status == 0 && (entry->attributes & KRB5_KDB_REQUIRES_PRE_AUTH)) {
Modified: trunk/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
===================================================================
--- trunk/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c 2011-10-18 16:32:28 UTC (rev 25367)
+++ trunk/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c 2011-10-18 18:51:35 UTC (rev 25368)
@@ -104,6 +104,7 @@
CHECK_LDAP_HANDLE(ldap_context);
if (is_principal_in_realm(ldap_context, searchfor) != 0) {
+ st = KRB5_KDB_NOENTRY;
krb5_set_error_message(context, st,
_("Principal does not belong to realm"));
goto cleanup;
Modified: trunk/src/plugins/kdb/ldap/libkdb_ldap/lockout.c
===================================================================
--- trunk/src/plugins/kdb/ldap/libkdb_ldap/lockout.c 2011-10-18 16:32:28 UTC (rev 25367)
+++ trunk/src/plugins/kdb/ldap/libkdb_ldap/lockout.c 2011-10-18 18:51:35 UTC (rev 25368)
@@ -161,6 +161,9 @@
return 0;
}
+ if (entry == NULL)
+ return 0;
+
if (!ldap_context->disable_lockout) {
code = lookup_lockout_policy(context, entry, &max_fail,
&failcnt_interval,
@@ -169,10 +172,17 @@
return code;
}
+ /*
+ * Don't continue to modify the DB for an already locked account.
+ * (In most cases, status will be KRB5KDC_ERR_CLIENT_REVOKED, and
+ * this check is unneeded, but in rare cases, we can fail with an
+ * integrity error or preauth failure before a policy check.)
+ */
+ if (locked_check_p(context, stamp, max_fail, lockout_duration, entry))
+ return 0;
+
entry->mask = 0;
- assert (!locked_check_p(context, stamp, max_fail, lockout_duration, entry));
-
/* Only mark the authentication as successful if the entry
* required preauthentication, otherwise we have no idea. */
if (status == 0 && (entry->attributes & KRB5_KDB_REQUIRES_PRE_AUTH)) {
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
