[arch-commits] Commit in krb5/trunk (3 files)
Stéphane Gaudreault
stephane at archlinux.org
Wed Dec 7 21:28:37 UTC 2011
Date: Wednesday, December 7, 2011 @ 16:28:36
Author: stephane
Revision: 144604
upgpkg: krb5 1.9.2-2
Fix a null pointer dereference when processing TGS requests (CVE-2011-1530)
Added:
krb5/trunk/krb5-1.9.1-2011-007.patch
Modified:
krb5/trunk/PKGBUILD
Deleted:
krb5/trunk/krb5-1.9.1-2011-006.patch
---------------------------+
PKGBUILD | 15 ++++++--
krb5-1.9.1-2011-006.patch | 75 --------------------------------------------
krb5-1.9.1-2011-007.patch | 40 +++++++++++++++++++++++
3 files changed, 51 insertions(+), 79 deletions(-)
Modified: PKGBUILD
===================================================================
--- PKGBUILD 2011-12-07 21:23:41 UTC (rev 144603)
+++ PKGBUILD 2011-12-07 21:28:36 UTC (rev 144604)
@@ -3,7 +3,7 @@
pkgname=krb5
pkgver=1.9.2
-pkgrel=1
+pkgrel=2
pkgdesc="The Kerberos network authentication system"
arch=('i686' 'x86_64')
url="http://web.mit.edu/kerberos/"
@@ -18,12 +18,14 @@
krb5-kadmind
krb5-kdc
krb5-kpropd
- krb5-1.9.1-config-script.patch)
+ krb5-1.9.1-config-script.patch
+ krb5-1.9.1-2011-007.patch)
sha1sums=('aa06f778ee1f9791cd4c5cf4c9e9465769ffec92'
'2aa229369079ed1bbb201a1ef72c47bf143f4dbe'
'77d2312ecd8bf12a6e72cc8fd871a8ac93b23393'
'7f402078fa65bb9ff1beb6cbbbb017450df78560'
- '7342410760cf44bfa01bb99bb4c49e12496cb46f')
+ '7342410760cf44bfa01bb99bb4c49e12496cb46f'
+ 'ec917dd1d1c96fa331f512331d5aa37c2e9b9df7')
options=('!emptydirs')
build() {
@@ -37,10 +39,15 @@
# by libkrb5, unless do_deps is set to 1, which indicates that the caller
# wants the whole list.
#
- # Patch from upstream :
+ # Patch from upstream :
# http://anonsvn.mit.edu/viewvc/krb5/trunk/src/krb5-config.in?r1=23662&r2=25236
patch -Np2 -i ${srcdir}/krb5-1.9.1-config-script.patch
+ # Apply upstream patch to fix a null pointer dereference when processing TGS requests
+ # CVE-2011-1530
+ # see http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-007.txt
+ patch -Np2 -i ${srcdir}/krb5-1.9.1-2011-007.patch
+
# FS#25384
sed -i "/KRB5ROOT=/s/\/local//" util/ac_check_krb5.m4
Deleted: krb5-1.9.1-2011-006.patch
===================================================================
--- krb5-1.9.1-2011-006.patch 2011-12-07 21:23:41 UTC (rev 144603)
+++ krb5-1.9.1-2011-006.patch 2011-12-07 21:28:36 UTC (rev 144604)
@@ -1,75 +0,0 @@
-diff --git a/src/plugins/kdb/db2/lockout.c b/src/plugins/kdb/db2/lockout.c
-index b473611..50c60b7 100644
---- a/src/plugins/kdb/db2/lockout.c
-+++ b/src/plugins/kdb/db2/lockout.c
-@@ -169,6 +169,9 @@ krb5_db2_lockout_audit(krb5_context context,
- return 0;
- }
-
-+ if (entry == NULL)
-+ return 0;
-+
- if (!db_ctx->disable_lockout) {
- code = lookup_lockout_policy(context, entry, &max_fail,
- &failcnt_interval, &lockout_duration);
-@@ -176,6 +179,15 @@ krb5_db2_lockout_audit(krb5_context context,
- return code;
- }
-
-+ /*
-+ * Don't continue to modify the DB for an already locked account.
-+ * (In most cases, status will be KRB5KDC_ERR_CLIENT_REVOKED, and
-+ * this check is unneeded, but in rare cases, we can fail with an
-+ * integrity error or preauth failure before a policy check.)
-+ */
-+ if (locked_check_p(context, stamp, max_fail, lockout_duration, entry))
-+ return 0;
-+
- /* Only mark the authentication as successful if the entry
- * required preauthentication, otherwise we have no idea. */
- if (status == 0 && (entry->attributes & KRB5_KDB_REQUIRES_PRE_AUTH)) {
-diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
-index 552e39a..c2f44ab 100644
---- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
-+++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
-@@ -105,6 +105,7 @@ krb5_ldap_get_principal(krb5_context context, krb5_const_principal searchfor,
- CHECK_LDAP_HANDLE(ldap_context);
-
- if (is_principal_in_realm(ldap_context, searchfor) != 0) {
-+ st = KRB5_KDB_NOENTRY;
- krb5_set_error_message (context, st, "Principal does not belong to realm");
- goto cleanup;
- }
-diff --git a/src/plugins/kdb/ldap/libkdb_ldap/lockout.c b/src/plugins/kdb/ldap/libkdb_ldap/lockout.c
-index a218dc7..fd164dd 100644
---- a/src/plugins/kdb/ldap/libkdb_ldap/lockout.c
-+++ b/src/plugins/kdb/ldap/libkdb_ldap/lockout.c
-@@ -165,6 +165,9 @@ krb5_ldap_lockout_audit(krb5_context context,
- return 0;
- }
-
-+ if (entry == NULL)
-+ return 0;
-+
- if (!ldap_context->disable_lockout) {
- code = lookup_lockout_policy(context, entry, &max_fail,
- &failcnt_interval,
-@@ -173,9 +176,16 @@ krb5_ldap_lockout_audit(krb5_context context,
- return code;
- }
-
-- entry->mask = 0;
-+ /*
-+ * Don't continue to modify the DB for an already locked account.
-+ * (In most cases, status will be KRB5KDC_ERR_CLIENT_REVOKED, and
-+ * this check is unneeded, but in rare cases, we can fail with an
-+ * integrity error or preauth failure before a policy check.)
-+ */
-+ if (locked_check_p(context, stamp, max_fail, lockout_duration, entry))
-+ return 0;
-
-- assert (!locked_check_p(context, stamp, max_fail, lockout_duration, entry));
-+ entry->mask = 0;
-
- /* Only mark the authentication as successful if the entry
- * required preauthentication, otherwise we have no idea. */
Added: krb5-1.9.1-2011-007.patch
===================================================================
--- krb5-1.9.1-2011-007.patch (rev 0)
+++ krb5-1.9.1-2011-007.patch 2011-12-07 21:28:36 UTC (rev 144604)
@@ -0,0 +1,40 @@
+diff --git a/src/kdc/Makefile.in b/src/kdc/Makefile.in
+index f46cad3..102fbaa 100644
+--- a/src/kdc/Makefile.in
++++ b/src/kdc/Makefile.in
+@@ -67,6 +67,7 @@ check-unix:: rtest
+
+ check-pytests::
+ $(RUNPYTEST) $(srcdir)/t_workers.py $(PYTESTFLAGS)
++ $(RUNPYTEST) $(srcdir)/t_emptytgt.py $(PYTESTFLAGS)
+
+ install::
+ $(INSTALL_PROGRAM) krb5kdc ${DESTDIR}$(SERVER_BINDIR)/krb5kdc
+diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c
+index c169c54..840a2ef 100644
+--- a/src/kdc/do_tgs_req.c
++++ b/src/kdc/do_tgs_req.c
+@@ -243,7 +243,8 @@ tgt_again:
+ if (!tgs_1 || !data_eq(*server_1, *tgs_1)) {
+ errcode = find_alternate_tgs(request, &server);
+ firstpass = 0;
+- goto tgt_again;
++ if (errcode == 0)
++ goto tgt_again;
+ }
+ }
+ status = "UNKNOWN_SERVER";
+diff --git a/src/kdc/t_emptytgt.py b/src/kdc/t_emptytgt.py
+new file mode 100644
+index 0000000..1760bcd
+--- /dev/null
++++ b/src/kdc/t_emptytgt.py
+@@ -0,0 +1,8 @@
++#!/usr/bin/python
++from k5test import *
++
++realm = K5Realm(start_kadmind=False, create_host=False)
++output = realm.run_as_client([kvno, 'krbtgt/'], expected_code=1)
++if 'not found in Kerberos database' not in output:
++ fail('TGT lookup for empty realm failed in unexpected way')
++success('Empty tgt lookup.')
More information about the arch-commits
mailing list