[2652] in Kerberos-V5-bugs
krb5-kdc/361: Bug Report
daemon@ATHENA.MIT.EDU (Kenneth D. Renard" (CICC/HPCD))
Fri Jan 31 14:45:45 1997
Resent-From: gnats@rt-11.MIT.EDU (GNATS Management)
Resent-To: krb5-unassigned@RT-11.MIT.EDU
Resent-Reply-To: krb5-bugs@MIT.EDU,
"Kenneth D. Renard" (CICC/HPCD) <kdrenard@ARL.MIL>
Date: Fri, 31 Jan 97 14:42:57 EST
From: "Kenneth D. Renard" (CICC/HPCD) <kdrenard@ARL.MIL>
To: krb5-bugs@MIT.EDU
Cc: kdrenard@ARL.MIL
>Number: 361
>Category: krb5-kdc
>Synopsis: KDC crashes on incompatible kvno/keytypes
>Confidential: no
>Severity: serious
>Priority: high
>Responsible: krb5-unassigned
>State: open
>Class: sw-bug
>Submitter-Id: unknown
>Arrival-Date: Fri Jan 31 14:44:01 EST 1997
>Last-Modified:
>Originator: Kenneth D. Renard <kdrenard>
>Organization:
Army Research Lab
>Release: 1.0 (plus, b6, and probably b7)
>Environment:
System: SunOS murdock.arl.mil 5.5.1 Generic_103640-03 sun4u sparc SUNW,Ultra-1
Architecture: sun4
>Description:
In lib/kdb/keytab.c, return value from krb5_dbe_find_enctype()
is not checked. If an error occurs and key_data is not returned
correctly, next call to krb5_dbekd_decrypt_key_data() chokes on
invalid pointer and crashes KDC.
>How-To-Repeat:
(Error observed on Beta6 KDC, but code is the same in v1.0.)
A cross-realm principal was created in both realms:
REALM1: krbtgt/REALM2@REALM1 kvno = 1
REALM2: krbtgt/REALM2@REALM1 kvno = 2
A cross-realm authentication attempt was made from REALM1 to REALM2.
REALM2 looked up krbtgt/REALM2@REALM1 in krb5_ktkdb_get_entry()
(keytab.c line 117). The call to krb5_dbe_find_enctype() (keytab.c
line 130) was unsuccessful in matching kvnos and returned ENOENT
without filling in the krb5_key_data pointer.
krb5_ktkdb_get_entry() ingored this error code and the following call
to krb5_dbekd_decrypt_key_data() choked when passed a bogus
krb5_key_data pointer and dumped core.
>Fix:
Check return value of krb5_dbe_find_enctype() call
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
RCS file: RCS/keytab.c,v
retrieving revision 1.1
retrieving revision 1.2
diff -c -r1.1 -r1.2
*** /tmp/T0a02311 Fri Jan 31 14:38:57 1997
--- /tmp/T1a02311 Fri Jan 31 14:38:57 1997
***************
*** 127,133 ****
}
/* match key */
krb5_dbm_db_get_mkey(context, id->ops, &master_key);
! krb5_dbe_find_enctype(context, &db_entry, enctype, -1, kvno, &key_data);
if (kerror = krb5_dbekd_decrypt_key_data(context, master_key, key_data,
&entry->key, NULL))
--- 127,135 ----
}
/* match key */
krb5_dbm_db_get_mkey(context, id->ops, &master_key);
! if (kerror = krb5_dbe_find_enctype(context, &db_entry, enctype, -1, kvno,
! &key_data))
! goto error;
if (kerror = krb5_dbekd_decrypt_key_data(context, master_key, key_data,
&entry->key, NULL))
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
>Audit-Trail:
>Unformatted:
X-send-pr-version: 3.99
