[26265] in CVS-changelog-for-Kerberos-V5
svn rev #3327: trunk/telnet/libtelnet/
daemon@ATHENA.MIT.EDU (ghudson@mit.edu)
Tue Dec 27 11:59:41 2011
Date: Tue, 27 Dec 2011 11:59:37 -0500
From: ghudson@mit.edu
Message-Id: <201112271659.pBRGxb7x026261@drugstore.mit.edu>
To: krb5-appl-commits@mit.edu
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krb5-appl-commits-bounces@mit.edu
Commit By: ghudson
Log Message:
ticket: 7056
subject: SA-2011-008 keyid buffer overflow [CVE-2011-4862]
Prevent a buffer overflow in encrypt_keyid if the remote party
supplies a keyid larger than MAXKEYLEN bytes.
Changed Files:
U trunk/telnet/libtelnet/encrypt.c
Modified: trunk/telnet/libtelnet/encrypt.c
===================================================================
--- trunk/telnet/libtelnet/encrypt.c 2011-11-08 17:30:41 UTC (rev 3326)
+++ trunk/telnet/libtelnet/encrypt.c 2011-12-27 16:59:36 UTC (rev 3327)
@@ -757,6 +757,9 @@
int dir = kp->dir;
register int ret = 0;
+ if (len > MAXKEYLEN)
+ len = MAXKEYLEN;
+
if (!(ep = (*kp->getcrypt)(*kp->modep))) {
if (len == 0)
return;
_______________________________________________
Krb5-appl-commits mailing list
Krb5-appl-commits@mit.edu
http://mailman.mit.edu/mailman/listinfo/krb5-appl-commits
