[17229] in Kerberos-V5-bugs
[krbdev.mit.edu #9240] git commit
daemon@ATHENA.MIT.EDU (Greg Hudson via RT)
Mon Nov 9 12:02:19 2026
From: "Greg Hudson via RT" <rt@krbdev.mit.edu>
In-Reply-To:
Message-ID: <rt-4.4.3-2-3130793-1794243735-518.9240-5-0@mit.edu>
To: "AdminCc of krbdev.mit.edu Ticket #9240":;
Date: Mon, 09 Nov 2026 12:02:15 -0500
MIME-Version: 1.0
Reply-To: rt@krbdev.mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krb5-bugs-bounces@mit.edu
<URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=9240 >
Add space checks in Leash_krb5_kinit() prompter
MultiInputDialog() is used by the prompter callback supplied by
leashdll initial ticket APIs to krb5_get_init_creds_password(). Add
space checks to this function to prevent a possible buffer overflow if
the prompter is invoked with a long banner string.
Large prompts are currently only admitted by the FAST OTP client
preauth mechanism, which requires the KDC to be authenticated to the
client via the armor ticket.
Discovered by Aisle Research.
(cherry picked from commit 607eb2776c3ae243f2eab2a630f8c10894180e7f)
https://github.com/krb5/krb5/commit/0c24f23ea546e4637d95bd62f35103b7006b5ab0
Author: Greg Hudson <ghudson@mit.edu>
Commit: 0c24f23ea546e4637d95bd62f35103b7006b5ab0
Branch: krb5-1.22
src/windows/leashdll/krb5routines.c | 53 +++++++++++++++++++++++++++++++++++--
1 file changed, 51 insertions(+), 2 deletions(-)
_______________________________________________
krb5-bugs mailing list
krb5-bugs@mit.edu
https://mailman.mit.edu/mailman/listinfo/krb5-bugs
