[28761] in CVS-changelog-for-Kerberos-V5
krb5 commit [krb5-1.11]: Fix null deref in SPNEGO acceptor
daemon@ATHENA.MIT.EDU (Tom Yu)
Fri Feb 6 18:49:28 2015
Date: Fri, 6 Feb 2015 18:44:42 -0500
From: Tom Yu <tlyu@mit.edu>
Message-Id: <201502062344.t16NigwQ001261@drugstore.mit.edu>
To: cvs-krb5@mit.edu
Reply-To: krbdev@mit.edu
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/90df9bcfe3124ccac2cf2399e3286103076a2271
commit 90df9bcfe3124ccac2cf2399e3286103076a2271
Author: Greg Hudson <ghudson@mit.edu>
Date: Tue Jul 15 12:56:01 2014 -0400
Fix null deref in SPNEGO acceptor [CVE-2014-4344]
When processing a continuation token, acc_ctx_cont was dereferencing
the initial byte of the token without checking the length. This could
result in a null dereference.
CVE-2014-4344:
In MIT krb5 1.5 and newer, an unauthenticated or partially
authenticated remote attacker can cause a NULL dereference and
application crash during a SPNEGO negotiation by sending an empty
token as the second or later context token from initiator to acceptor.
The attacker must provide at least one valid context token in the
security context negotiation before sending the empty token. This can
be done by an unauthenticated attacker by forcing SPNEGO to
renegotiate the underlying mechanism, or by using IAKERB to wrap an
unauthenticated AS-REQ as the first token.
CVSSv2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C/E:POC/RL:OF/RC:C
[kaduk@mit.edu: CVE summary, CVSSv2 vector]
(cherry picked from commit 524688ce87a15fc75f87efc8c039ba4c7d5c197b)
ticket: 8114 (new)
subject: NULL dereference in SPNEGO acceptor for continuation tokens [CVE-2014-4344]
version_fixed: 1.11.6
status: resolved
src/lib/gssapi/spnego/spnego_mech.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/src/lib/gssapi/spnego/spnego_mech.c b/src/lib/gssapi/spnego/spnego_mech.c
index 805c593..1c5a46b 100644
--- a/src/lib/gssapi/spnego/spnego_mech.c
+++ b/src/lib/gssapi/spnego/spnego_mech.c
@@ -1437,7 +1437,7 @@ acc_ctx_cont(OM_uint32 *minstat,
ptr = bufstart = buf->value;
#define REMAIN (buf->length - (ptr - bufstart))
- if (REMAIN > INT_MAX)
+ if (REMAIN == 0 || REMAIN > INT_MAX)
return GSS_S_DEFECTIVE_TOKEN;
/*
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
