[17231] in Kerberos-V5-bugs
[krbdev.mit.edu #9241] git commit
daemon@ATHENA.MIT.EDU (Greg Hudson via RT)
Mon Nov 9 12:02:32 2026
From: "Greg Hudson via RT" <rt@krbdev.mit.edu>
In-Reply-To:
Message-ID: <rt-4.4.3-2-3130889-1794243739-1074.9241-5-0@mit.edu>
To: "AdminCc of krbdev.mit.edu Ticket #9241":;
Date: Mon, 09 Nov 2026 12:02:19 -0500
MIME-Version: 1.0
Reply-To: rt@krbdev.mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krb5-bugs-bounces@mit.edu
<URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=9241 >
Remove unsafe principal parsing from Leashdll
In Leash_int_kinit_ex(), remove the code to parse and reassemble the
principal name; it has no length checks and could overflow
stack-allocated buffers if a long principal name is supplied. This
parsing code was used to perform krb4 fallbacks if getting tickets via
krb5 failed, and is no longer useful.
Discovered by Aisle Research.
(cherry picked from commit 54b7bbe13dd1d4d2646c4fbcc8d68925603924fb)
https://github.com/krb5/krb5/commit/faf817da5341b849fd53e191ef05b54151195632
Author: Greg Hudson <ghudson@mit.edu>
Commit: faf817da5341b849fd53e191ef05b54151195632
Branch: krb5-1.22
src/windows/leashdll/lshfunc.c | 82 ++++--------------------------------------
1 file changed, 7 insertions(+), 75 deletions(-)
_______________________________________________
krb5-bugs mailing list
krb5-bugs@mit.edu
https://mailman.mit.edu/mailman/listinfo/krb5-bugs
