[26187] in CVS-changelog-for-Kerberos-V5
svn rev #25527: branches/krb5-1-9/src/kdc/
daemon@ATHENA.MIT.EDU (tlyu@mit.edu)
Tue Dec 6 15:59:17 2011
Date: Tue, 6 Dec 2011 15:59:16 -0500
From: tlyu@mit.edu
Message-Id: <201112062059.pB6KxGYv001803@drugstore.mit.edu>
To: cvs-krb5@mit.edu
Reply-To: krbdev@mit.edu
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
http://src.mit.edu/fisheye/changelog/krb5/?cs=25527
Commit By: tlyu
Log Message:
ticket: 7043
subject: SA-2011-007 KDC null pointer deref in TGS handling [CVE-2011-1530]
version_fixed: 1.9.3
pull up r25525 from trunk
------------------------------------------------------------------------
r25525 | tlyu | 2011-12-06 15:42:46 -0500 (Tue, 06 Dec 2011) | 8 lines
ticket: 7042
subject: SA-2011-007 KDC null pointer deref in TGS handling [CVE-2011-1530]
target_version: 1.10
tags: pullup
Fix a null pointer dereference condition that could cause a denial of
service.
Changed Files:
U branches/krb5-1-9/src/kdc/Makefile.in
U branches/krb5-1-9/src/kdc/do_tgs_req.c
A branches/krb5-1-9/src/kdc/t_emptytgt.py
Modified: branches/krb5-1-9/src/kdc/Makefile.in
===================================================================
--- branches/krb5-1-9/src/kdc/Makefile.in 2011-12-06 20:52:18 UTC (rev 25526)
+++ branches/krb5-1-9/src/kdc/Makefile.in 2011-12-06 20:59:16 UTC (rev 25527)
@@ -67,6 +67,7 @@
check-pytests::
$(RUNPYTEST) $(srcdir)/t_workers.py $(PYTESTFLAGS)
+ $(RUNPYTEST) $(srcdir)/t_emptytgt.py $(PYTESTFLAGS)
install::
$(INSTALL_PROGRAM) krb5kdc ${DESTDIR}$(SERVER_BINDIR)/krb5kdc
Modified: branches/krb5-1-9/src/kdc/do_tgs_req.c
===================================================================
--- branches/krb5-1-9/src/kdc/do_tgs_req.c 2011-12-06 20:52:18 UTC (rev 25526)
+++ branches/krb5-1-9/src/kdc/do_tgs_req.c 2011-12-06 20:59:16 UTC (rev 25527)
@@ -243,7 +243,8 @@
if (!tgs_1 || !data_eq(*server_1, *tgs_1)) {
errcode = find_alternate_tgs(request, &server);
firstpass = 0;
- goto tgt_again;
+ if (errcode == 0)
+ goto tgt_again;
}
}
status = "UNKNOWN_SERVER";
Added: branches/krb5-1-9/src/kdc/t_emptytgt.py
===================================================================
--- branches/krb5-1-9/src/kdc/t_emptytgt.py (rev 0)
+++ branches/krb5-1-9/src/kdc/t_emptytgt.py 2011-12-06 20:59:16 UTC (rev 25527)
@@ -0,0 +1,8 @@
+#!/usr/bin/python
+from k5test import *
+
+realm = K5Realm(start_kadmind=False, create_host=False)
+output = realm.run_as_client([kvno, 'krbtgt/'], expected_code=1)
+if 'not found in Kerberos database' not in output:
+ fail('TGT lookup for empty realm failed in unexpected way')
+success('Empty tgt lookup.')
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
