[krb5/f15] - apply upstream patch to fix a null pointer dereference with the LDAP kdb backend (CVE-2011-1527, #
Nalin Dahyabhai
nalin at fedoraproject.org
Tue Oct 18 18:26:05 UTC 2011
commit 478adc77631fcf094016e07cc8e9a4dee0c7c158
Author: Nalin Dahyabhai <nalin at dahyabhai.net>
Date: Tue Oct 18 14:25:26 2011 -0400
- apply upstream patch to fix a null pointer dereference with the LDAP kdb backend (CVE-2011-1527, #744125), an assertion failure with multiple kdb backends (CVE-2011-1528), and a null pointer dereference with multiple kdb backends (CVE-2011-1529) (#737711)
krb5-1.9-MITKRB5-SA-2011-006.patch | 75 ++++++++++++++++++++++++++++++++++++
krb5.spec | 10 ++++-
2 files changed, 84 insertions(+), 1 deletions(-)
---
diff --git a/krb5-1.9-MITKRB5-SA-2011-006.patch b/krb5-1.9-MITKRB5-SA-2011-006.patch
new file mode 100644
index 0000000..05a22ca
--- /dev/null
+++ b/krb5-1.9-MITKRB5-SA-2011-006.patch
@@ -0,0 +1,75 @@
+diff --git a/src/plugins/kdb/db2/lockout.c b/src/plugins/kdb/db2/lockout.c
+index b473611..50c60b7 100644
+--- a/src/plugins/kdb/db2/lockout.c
++++ b/src/plugins/kdb/db2/lockout.c
+@@ -169,6 +169,9 @@ krb5_db2_lockout_audit(krb5_context context,
+ return 0;
+ }
+
++ if (entry == NULL)
++ return 0;
++
+ if (!db_ctx->disable_lockout) {
+ code = lookup_lockout_policy(context, entry, &max_fail,
+ &failcnt_interval, &lockout_duration);
+@@ -176,6 +179,15 @@ krb5_db2_lockout_audit(krb5_context context,
+ return code;
+ }
+
++ /*
++ * Don't continue to modify the DB for an already locked account.
++ * (In most cases, status will be KRB5KDC_ERR_CLIENT_REVOKED, and
++ * this check is unneeded, but in rare cases, we can fail with an
++ * integrity error or preauth failure before a policy check.)
++ */
++ if (locked_check_p(context, stamp, max_fail, lockout_duration, entry))
++ return 0;
++
+ /* Only mark the authentication as successful if the entry
+ * required preauthentication, otherwise we have no idea. */
+ if (status == 0 && (entry->attributes & KRB5_KDB_REQUIRES_PRE_AUTH)) {
+diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
+index 552e39a..c2f44ab 100644
+--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
++++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
+@@ -105,6 +105,7 @@ krb5_ldap_get_principal(krb5_context context, krb5_const_principal searchfor,
+ CHECK_LDAP_HANDLE(ldap_context);
+
+ if (is_principal_in_realm(ldap_context, searchfor) != 0) {
++ st = KRB5_KDB_NOENTRY;
+ krb5_set_error_message (context, st, "Principal does not belong to realm");
+ goto cleanup;
+ }
+diff --git a/src/plugins/kdb/ldap/libkdb_ldap/lockout.c b/src/plugins/kdb/ldap/libkdb_ldap/lockout.c
+index a218dc7..fd164dd 100644
+--- a/src/plugins/kdb/ldap/libkdb_ldap/lockout.c
++++ b/src/plugins/kdb/ldap/libkdb_ldap/lockout.c
+@@ -165,6 +165,9 @@ krb5_ldap_lockout_audit(krb5_context context,
+ return 0;
+ }
+
++ if (entry == NULL)
++ return 0;
++
+ if (!ldap_context->disable_lockout) {
+ code = lookup_lockout_policy(context, entry, &max_fail,
+ &failcnt_interval,
+@@ -173,9 +176,16 @@ krb5_ldap_lockout_audit(krb5_context context,
+ return code;
+ }
+
+- entry->mask = 0;
++ /*
++ * Don't continue to modify the DB for an already locked account.
++ * (In most cases, status will be KRB5KDC_ERR_CLIENT_REVOKED, and
++ * this check is unneeded, but in rare cases, we can fail with an
++ * integrity error or preauth failure before a policy check.)
++ */
++ if (locked_check_p(context, stamp, max_fail, lockout_duration, entry))
++ return 0;
+
+- assert (!locked_check_p(context, stamp, max_fail, lockout_duration, entry));
++ entry->mask = 0;
+
+ /* Only mark the authentication as successful if the entry
+ * required preauthentication, otherwise we have no idea. */
diff --git a/krb5.spec b/krb5.spec
index abff584..a83391b 100644
--- a/krb5.spec
+++ b/krb5.spec
@@ -6,7 +6,7 @@
Summary: The Kerberos network authentication system
Name: krb5
Version: 1.9.1
-Release: 13%{?dist}
+Release: 14%{?dist}
# Maybe we should explode from the now-available-to-everybody tarball instead?
# http://web.mit.edu/kerberos/dist/krb5/1.9/krb5-1.9.1-signed.tar
Source0: krb5-%{version}.tar.gz
@@ -63,6 +63,7 @@ Patch86: krb5-1.9-debuginfo.patch
Patch87: krb5-1.9.1-sendto_poll2.patch
Patch88: krb5-1.9-crossrealm.patch
Patch89: krb5-1.9.1-sendto_poll3.patch
+Patch90: krb5-1.9-MITKRB5-SA-2011-006.patch
License: MIT
URL: http://web.mit.edu/kerberos/www/
@@ -219,6 +220,7 @@ ln -s NOTICE LICENSE
%patch87 -p1 -b .sendto_poll2
%patch88 -p1 -b .crossrealm
%patch89 -p1 -b .sendto_poll3
+%patch90 -p1 -b .2011-006
gzip doc/*.ps
sed -i -e '1s!\[twoside\]!!;s!%\(\\usepackage{hyperref}\)!\1!' doc/api/library.tex
@@ -680,6 +682,12 @@ exit 0
%{_sbindir}/uuserver
%changelog
+* Tue Oct 18 2011 Nalin Dahyabhai <nalin at redhat.com> 1.9.1-14
+- apply upstream patch to fix a null pointer dereference with the LDAP kdb
+ backend (CVE-2011-1527, #744125), an assertion failure with multiple kdb
+ backends (CVE-2011-1528), and a null pointer dereference with multiple kdb
+ backends (CVE-2011-1529) (#737711)
+
* Tue Oct 12 2011 Nalin Dahyabhai <nalin at redhat.com> 1.9.1-13
- handle a harder-to-trigger assertion failure that starts cropping up when we
exit the transmit loop on time (#739853)
More information about the scm-commits
mailing list