[3317] in Kerberos-V5-bugs
krb5-libs/1065: krb5_get_init_creds_password does not warn about password expiration
daemon@ATHENA.MIT.EDU (Dan Riley)
Fri Feb 22 15:01:44 2002
Resent-From: gnats@rt-11.mit.edu (GNATS Management)
Resent-To: krb5-unassigned@rt-11.mit.edu
Resent-Reply-To: krb5-bugs@mit.edu, dsr@mail.lns.cornell.edu
Message-Id: <200202221955.OAA0000019806@lnscu6.lns.cornell.edu>
From: Dan Riley <dsr@mail.lns.cornell.edu>
Reply-To: dsr@mail.lns.cornell.edu
To: krb5-bugs@mit.edu
Errors-To: krb5-bugs-admin@mit.edu
Date: Fri, 22 Feb 2002 14:55:46 -0500 (EST)
>Number: 1065
>Category: krb5-libs
>Synopsis: gic_pwd does not warn about password expiration
>Confidential: no
>Severity: non-critical
>Priority: medium
>Responsible: krb5-unassigned
>State: open
>Class: sw-bug
>Submitter-Id: unknown
>Arrival-Date: Fri Feb 22 14:56:00 EST 2002
>Last-Modified:
>Originator: Dan Riley
>Organization:
LNS, Cornell U.
>Release: krb5-1.2.3
>Environment:
System: OSF1 lnscu6.lns.cornell.edu V4.0 1229 alpha
Machine: alpha
>Description:
If given a prompter krb5_get_init_creds_password is supposed to warn
the user when password expiration is near. It does not do so if no
in_tkt_service is provided, due to a logic bug. The code
if (prompter &&
(in_tkt_service &&
(strcmp(in_tkt_service, "kadmin/changepw") != 0)) &&
[...]
is, I believe, supposed to not warn only if in_tkt_service is
"kadmin/changepw". However, if in_tkt_service is NULL, the first part
of the && fails and the entire && fails.
>How-To-Repeat:
Set a principal (or password, depending on what your kdc sets the
key expiration field to) to expire in a few hours. Try to login
via login.krb5 or equivalent. Note that no warning is issued.
>Fix:
The correct test is "no in_tkt_service provided or in_tkt_service
is not kadmin/changepw":
diff -ur krb5-1.2.3/src/lib/krb5/krb/gic_pwd.c krb5/lib/krb5/krb/gic_pwd.c
--- krb5-1.2.3/src/lib/krb5/krb/gic_pwd.c Wed Jan 9 17:27:57 2002
+++ krb5/lib/krb5/krb/gic_pwd.c Fri Dec 21 13:54:00 2001
@@ -304,11 +304,11 @@
with timezones, etc. */
if (prompter &&
- (in_tkt_service &&
+ (!in_tkt_service ||
(strcmp(in_tkt_service, "kadmin/changepw") != 0)) &&
((ret = krb5_timeofday(context, &now)) == 0) &&
as_reply->enc_part2->key_exp &&
((hours = ((as_reply->enc_part2->key_exp-now)/(60*60))) <= 7*24) &&
(hours >= 0)) {
if (hours < 1)
sprintf(banner,
>Audit-Trail:
>Unformatted:
_______________________________________________
krb5-bugs mailing list
krb5-bugs@mit.edu
http://mailman.mit.edu/mailman/listinfo/krb5-bugs
