[arch-commits] Commit in krb5/trunk (PKGBUILD krb5-1.9.1-2011-006.patch)
Stéphane Gaudreault
stephane at archlinux.org
Wed Oct 19 02:08:03 UTC 2011
Date: Tuesday, October 18, 2011 @ 22:08:02
Author: stephane
Revision: 140773
upgpkg: krb5 1.9.1-5
Fix KDC denial of service vulnerabilities
Added:
krb5/trunk/krb5-1.9.1-2011-006.patch
Modified:
krb5/trunk/PKGBUILD
---------------------------+
PKGBUILD | 12 +++++--
krb5-1.9.1-2011-006.patch | 75 ++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 84 insertions(+), 3 deletions(-)
Modified: PKGBUILD
===================================================================
--- PKGBUILD 2011-10-19 01:14:39 UTC (rev 140772)
+++ PKGBUILD 2011-10-19 02:08:02 UTC (rev 140773)
@@ -3,7 +3,7 @@
pkgname=krb5
pkgver=1.9.1
-pkgrel=4
+pkgrel=5
pkgdesc="The Kerberos network authentication system"
arch=('i686' 'x86_64')
url="http://web.mit.edu/kerberos/"
@@ -18,12 +18,14 @@
krb5-kadmind
krb5-kdc
krb5-1.9.1-config-script.patch
- krb5-1.9.1-canonicalize-fallback.patch)
+ krb5-1.9.1-canonicalize-fallback.patch
+ krb5-1.9.1-2011-006.patch)
sha1sums=('e23a1795a237521493da9cf3443ac8b98a90c066'
'2aa229369079ed1bbb201a1ef72c47bf143f4dbe'
'77d2312ecd8bf12a6e72cc8fd871a8ac93b23393'
'7342410760cf44bfa01bb99bb4c49e12496cb46f'
- '238c268fa6cb42fc7324ab54db9abda5cd77f833')
+ '238c268fa6cb42fc7324ab54db9abda5cd77f833'
+ '0b0016b0e341dcf720f67925b0d451b328e02583')
options=('!emptydirs')
build() {
@@ -47,6 +49,10 @@
# FS#25384
sed -i "/KRB5ROOT=/s/\/local//" util/ac_check_krb5.m4
+ # KDC denial of service vulnerabilities
+ # http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-006.txt
+ patch -Np2 -i ${srcdir}/krb5-1.9.1-2011-006.patch
+
export CFLAGS+=" -fPIC -fno-strict-aliasing -fstack-protector-all"
export CPPFLAGS+=" -I/usr/include/et"
./configure --prefix=/usr \
Added: krb5-1.9.1-2011-006.patch
===================================================================
--- krb5-1.9.1-2011-006.patch (rev 0)
+++ krb5-1.9.1-2011-006.patch 2011-10-19 02:08:02 UTC (rev 140773)
@@ -0,0 +1,75 @@
+diff --git a/src/plugins/kdb/db2/lockout.c b/src/plugins/kdb/db2/lockout.c
+index b473611..50c60b7 100644
+--- a/src/plugins/kdb/db2/lockout.c
++++ b/src/plugins/kdb/db2/lockout.c
+@@ -169,6 +169,9 @@ krb5_db2_lockout_audit(krb5_context context,
+ return 0;
+ }
+
++ if (entry == NULL)
++ return 0;
++
+ if (!db_ctx->disable_lockout) {
+ code = lookup_lockout_policy(context, entry, &max_fail,
+ &failcnt_interval, &lockout_duration);
+@@ -176,6 +179,15 @@ krb5_db2_lockout_audit(krb5_context context,
+ return code;
+ }
+
++ /*
++ * Don't continue to modify the DB for an already locked account.
++ * (In most cases, status will be KRB5KDC_ERR_CLIENT_REVOKED, and
++ * this check is unneeded, but in rare cases, we can fail with an
++ * integrity error or preauth failure before a policy check.)
++ */
++ if (locked_check_p(context, stamp, max_fail, lockout_duration, entry))
++ return 0;
++
+ /* Only mark the authentication as successful if the entry
+ * required preauthentication, otherwise we have no idea. */
+ if (status == 0 && (entry->attributes & KRB5_KDB_REQUIRES_PRE_AUTH)) {
+diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
+index 552e39a..c2f44ab 100644
+--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
++++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
+@@ -105,6 +105,7 @@ krb5_ldap_get_principal(krb5_context context, krb5_const_principal searchfor,
+ CHECK_LDAP_HANDLE(ldap_context);
+
+ if (is_principal_in_realm(ldap_context, searchfor) != 0) {
++ st = KRB5_KDB_NOENTRY;
+ krb5_set_error_message (context, st, "Principal does not belong to realm");
+ goto cleanup;
+ }
+diff --git a/src/plugins/kdb/ldap/libkdb_ldap/lockout.c b/src/plugins/kdb/ldap/libkdb_ldap/lockout.c
+index a218dc7..fd164dd 100644
+--- a/src/plugins/kdb/ldap/libkdb_ldap/lockout.c
++++ b/src/plugins/kdb/ldap/libkdb_ldap/lockout.c
+@@ -165,6 +165,9 @@ krb5_ldap_lockout_audit(krb5_context context,
+ return 0;
+ }
+
++ if (entry == NULL)
++ return 0;
++
+ if (!ldap_context->disable_lockout) {
+ code = lookup_lockout_policy(context, entry, &max_fail,
+ &failcnt_interval,
+@@ -173,9 +176,16 @@ krb5_ldap_lockout_audit(krb5_context context,
+ return code;
+ }
+
+- entry->mask = 0;
++ /*
++ * Don't continue to modify the DB for an already locked account.
++ * (In most cases, status will be KRB5KDC_ERR_CLIENT_REVOKED, and
++ * this check is unneeded, but in rare cases, we can fail with an
++ * integrity error or preauth failure before a policy check.)
++ */
++ if (locked_check_p(context, stamp, max_fail, lockout_duration, entry))
++ return 0;
+
+- assert (!locked_check_p(context, stamp, max_fail, lockout_duration, entry));
++ entry->mask = 0;
+
+ /* Only mark the authentication as successful if the entry
+ * required preauthentication, otherwise we have no idea. */
More information about the arch-commits
mailing list