[krb5/f14] - apply upstream patch to fix a null pointer dereference with the LDAP kdb backend (CVE-2011-1527, #

[Nalin Dahyabhai]

commit e970ce3316de2d62f5245a90896c068a1de63c37
Author: Nalin Dahyabhai <nalin at dahyabhai.net>
Date:   Tue Oct 18 14:25:54 2011 -0400

    - apply upstream patch to fix a null pointer dereference with the LDAP kdb backend (CVE-2011-1527, #744125), an assertion failure with multiple kdb backends (CVE-2011-1528), and a null pointer dereference with multiple kdb backends (CVE-2011-1529) (#737711)

 krb5-1.8-MITKRB5-SA-2011-006.patch |   73 ++++++++++++++++++++++++++++++++++++
 krb5.spec                          |   10 ++++-
 2 files changed, 82 insertions(+), 1 deletions(-)
---
diff --git a/krb5-1.8-MITKRB5-SA-2011-006.patch b/krb5-1.8-MITKRB5-SA-2011-006.patch
new file mode 100644
index 0000000..2da0e14
--- /dev/null
+++ b/krb5-1.8-MITKRB5-SA-2011-006.patch
@@ -0,0 +1,73 @@
+diff --git a/src/plugins/kdb/db2/lockout.c b/src/plugins/kdb/db2/lockout.c
+index 498c0de..5f973fb 100644
+--- a/src/plugins/kdb/db2/lockout.c
++++ b/src/plugins/kdb/db2/lockout.c
+@@ -158,13 +158,23 @@ krb5_db2_lockout_audit(krb5_context context,
+         return 0;
+     }
+ 
++    if (entry == NULL)
++        return 0;
++
+     code = lookup_lockout_policy(context, entry, &max_fail,
+                                  &failcnt_interval,
+                                  &lockout_duration);
+     if (code != 0)
+         return code;
+ 
+-    assert (!locked_check_p(context, stamp, max_fail, lockout_duration, entry));
++    /*
++     * Don't continue to modify the DB for an already locked account.
++     * (In most cases, status will be KRB5KDC_ERR_CLIENT_REVOKED, and
++     * this check is unneeded, but in rare cases, we can fail with an
++     * integrity error or preauth failure before a policy check.)
++     */
++    if (locked_check_p(context, stamp, max_fail, lockout_duration, entry))
++        return 0;
+ 
+     if (status == 0 && (entry->attributes & KRB5_KDB_REQUIRES_PRE_AUTH)) {
+         /*
+diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
+index 626ed1f..68e8ec4 100644
+--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
++++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
+@@ -131,6 +131,7 @@ krb5_ldap_get_principal(krb5_context context, krb5_const_principal searchfor,
+     CHECK_LDAP_HANDLE(ldap_context);
+ 
+     if (is_principal_in_realm(ldap_context, searchfor) != 0) {
++        st = KRB5_KDB_NOENTRY;
+         *more = 0;
+         krb5_set_error_message (context, st, "Principal does not belong to realm");
+         goto cleanup;
+diff --git a/src/plugins/kdb/ldap/libkdb_ldap/lockout.c b/src/plugins/kdb/ldap/libkdb_ldap/lockout.c
+index 020c77a..24b9493 100644
+--- a/src/plugins/kdb/ldap/libkdb_ldap/lockout.c
++++ b/src/plugins/kdb/ldap/libkdb_ldap/lockout.c
+@@ -150,15 +150,25 @@ krb5_ldap_lockout_audit(krb5_context context,
+         return 0;
+     }
+ 
++    if (entry == NULL)
++        return 0;
++
+     code = lookup_lockout_policy(context, entry, &max_fail,
+                                  &failcnt_interval,
+                                  &lockout_duration);
+     if (code != 0)
+         return code;
+ 
+-    entry->mask = 0;
++    /*
++     * Don't continue to modify the DB for an already locked account.
++     * (In most cases, status will be KRB5KDC_ERR_CLIENT_REVOKED, and
++     * this check is unneeded, but in rare cases, we can fail with an
++     * integrity error or preauth failure before a policy check.)
++     */
++    if (locked_check_p(context, stamp, max_fail, lockout_duration, entry))
++        return 0;
+ 
+-    assert (!locked_check_p(context, stamp, max_fail, lockout_duration, entry));
++    entry->mask = 0;
+ 
+     if (status == 0 && (entry->attributes & KRB5_KDB_REQUIRES_PRE_AUTH)) {
+         /*
diff --git a/krb5.spec b/krb5.spec
index ec526c4..968c2cf 100644
--- a/krb5.spec
+++ b/krb5.spec
@@ -5,7 +5,7 @@
 Summary: The Kerberos network authentication system
 Name: krb5
 Version: 1.8.4
-Release: 2%{?dist}
+Release: 3%{?dist}
 # Maybe we should explode from the now-available-to-everybody tarball instead?
 # http://web.mit.edu/kerberos/dist/krb5/1.8/krb5-1.8.4-signed.tar
 Source0: krb5-%{version}.tar.gz
@@ -53,6 +53,7 @@ Patch77: krb5-trunk-signed.patch
 Patch78: krb5-trunk-k5login.patch
 Patch85: krb5-1.9-paren.patch
 Patch87: krb5-klist_s.patch
+Patch88: krb5-1.8-MITKRB5-SA-2011-006.patch
 
 License: MIT
 URL: http://web.mit.edu/kerberos/www/
@@ -196,6 +197,7 @@ ln -s NOTICE LICENSE
 %patch78 -p1 -b .k5login
 %patch85 -p1 -b .paren
 %patch87 -p1 -b .klist_s
+%patch88 -p1 -b .2011-006
 gzip doc/*.ps
 
 sed -i -e '1s!\[twoside\]!!;s!%\(\\usepackage{hyperref}\)!\1!' doc/api/library.tex
@@ -639,6 +641,12 @@ exit 0
 %{_sbindir}/uuserver
 
 %changelog
+* Tue Oct 18 2011 Nalin Dahyabhai <nalin at redhat.com> 1.8.4-3
+- apply upstream patch to fix a null pointer dereference with the LDAP kdb
+  backend (CVE-2011-1527, #744125), an assertion failure with multiple kdb
+  backends (CVE-2011-1528), and a null pointer dereference with multiple kdb
+  backends (CVE-2011-1529) (#737711)
+
 * Fri Jun 24 2011 Nalin Dahyabhai <nalin at redhat.com> 1.8.4-2
 - incorporate a fix to teach the file labeling patch about when replay caches
   are expunged (#576093)