[17180] in Kerberos-V5-bugs
[krbdev.mit.edu #9234] git commit
daemon@ATHENA.MIT.EDU (Greg Hudson via RT)
Mon Nov 9 11:57:15 2026
From: "Greg Hudson via RT" <rt-comment@krbdev.mit.edu>
In-Reply-To:
Message-ID: <rt-4.4.3-2-3124555-1794243427-126.9234-4-0@mit.edu>
To: "AdminCc of krbdev.mit.edu Ticket #9234":;
Date: Mon, 09 Nov 2026 11:57:07 -0500
MIME-Version: 1.0
Reply-To: rt-comment@krbdev.mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krb5-bugs-bounces@mit.edu
Mon Nov 09 11:57:07 2026: Request 9234 was acted upon.
Transaction: Ticket created by ghudson@mit.edu
Queue: krb5
Subject: git commit
Owner: ghudson@mit.edu
Requestors:
Status: new
Ticket <URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=9234 >
Prevent read overruns in GSSRPC svcauth_unix
In gssrpc__svcauth_unix(), msg->rm_call.cb_cred.oa_length is only
validated after msg->rm_call.cb_cred.oa_base is parsed, admitting read
overruns if the message is undersized. Replace the retrospective
validation with checks before parsing and after each interior length
is read. Reported by Cem Onat Karagun.
https://github.com/krb5/krb5/commit/964fca13050673c620b3ec0b6fb77af1257eacd5
Author: Greg Hudson <ghudson@mit.edu>
Commit: 964fca13050673c620b3ec0b6fb77af1257eacd5
Branch: master
src/lib/rpc/svc_auth_unix.c | 18 +++++-------------
1 file changed, 5 insertions(+), 13 deletions(-)
_______________________________________________
krb5-bugs mailing list
krb5-bugs@mit.edu
https://mailman.mit.edu/mailman/listinfo/krb5-bugs
