[17197] in Kerberos-V5-bugs
[krbdev.mit.edu #9240] git commit
daemon@ATHENA.MIT.EDU (Greg Hudson via RT)
Mon Nov 9 11:59:12 2026
From: "Greg Hudson via RT" <rt-comment@krbdev.mit.edu>
In-Reply-To:
Message-ID: <rt-4.4.3-2-3126683-1794243547-1271.9240-4-0@mit.edu>
To: "AdminCc of krbdev.mit.edu Ticket #9240":;
Date: Mon, 09 Nov 2026 11:59:07 -0500
MIME-Version: 1.0
Reply-To: rt-comment@krbdev.mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krb5-bugs-bounces@mit.edu
Mon Nov 09 11:59:07 2026: Request 9240 was acted upon.
Transaction: Ticket created by ghudson@mit.edu
Queue: krb5
Subject: git commit
Owner: ghudson@mit.edu
Requestors:
Status: new
Ticket <URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=9240 >
Add space checks in Leash_krb5_kinit() prompter
MultiInputDialog() is used by the prompter callback supplied by
leashdll initial ticket APIs to krb5_get_init_creds_password(). Add
space checks to this function to prevent a possible buffer overflow if
the prompter is invoked with a long banner string.
Large prompts are currently only admitted by the FAST OTP client
preauth mechanism, which requires the KDC to be authenticated to the
client via the armor ticket.
Discovered by Aisle Research.
https://github.com/krb5/krb5/commit/607eb2776c3ae243f2eab2a630f8c10894180e7f
Author: Greg Hudson <ghudson@mit.edu>
Commit: 607eb2776c3ae243f2eab2a630f8c10894180e7f
Branch: master
src/windows/leashdll/krb5routines.c | 53 +++++++++++++++++++++++++++++++++++--
1 file changed, 51 insertions(+), 2 deletions(-)
_______________________________________________
krb5-bugs mailing list
krb5-bugs@mit.edu
https://mailman.mit.edu/mailman/listinfo/krb5-bugs
