diff options
author | Greg Hudson <ghudson@mit.edu> | 2014-12-29 13:27:42 -0500 |
---|---|---|
committer | Tom Yu <tlyu@mit.edu> | 2015-02-04 15:36:23 -0500 |
commit | 2bc4bb02a70d7537baf1c3f6ebc126ded42ea133 (patch) | |
tree | 46e8cb587e470ddb833e5e14703810853701e351 | |
parent | d89dde02db71ba3ff0377e12e485f47537d43798 (diff) | |
download | krb5-2bc4bb02a70d7537baf1c3f6ebc126ded42ea133.zip krb5-2bc4bb02a70d7537baf1c3f6ebc126ded42ea133.tar.gz krb5-2bc4bb02a70d7537baf1c3f6ebc126ded42ea133.tar.bz2 |
Fix kadmind server validation [CVE-2014-9422]
[MITKRB5-SA-2015-001] In kadmind's check_rpcsec_auth(), use
data_eq_string() instead of strncmp() to check components of the
server principal, so that we don't erroneously match left substrings
of "kadmin", "history", or the realm.
(cherry picked from commit 6609658db0799053fbef0d7d0aa2f1fd68ef32d8)
ticket: 8057
version_fixed: 1.13.1
status: resolved
-rw-r--r-- | src/kadmin/server/kadm_rpc_svc.c | 12 |
1 files changed, 3 insertions, 9 deletions
diff --git a/src/kadmin/server/kadm_rpc_svc.c b/src/kadmin/server/kadm_rpc_svc.c index 3837931..f4d2a7c 100644 --- a/src/kadmin/server/kadm_rpc_svc.c +++ b/src/kadmin/server/kadm_rpc_svc.c @@ -4,7 +4,7 @@ * */ -#include <k5-platform.h> +#include <k5-int.h> #include <gssrpc/rpc.h> #include <gssapi/gssapi_krb5.h> /* for gss_nt_krb5_name */ #include <syslog.h> @@ -296,14 +296,8 @@ check_rpcsec_auth(struct svc_req *rqstp) c1 = krb5_princ_component(kctx, princ, 0); c2 = krb5_princ_component(kctx, princ, 1); realm = krb5_princ_realm(kctx, princ); - if (strncmp(handle->params.realm, realm->data, realm->length) == 0 - && strncmp("kadmin", c1->data, c1->length) == 0) { - - if (strncmp("history", c2->data, c2->length) == 0) - goto fail_princ; - else - success = 1; - } + success = data_eq_string(*realm, handle->params.realm) && + data_eq_string(*c1, "kadmin") && !data_eq_string(*c2, "history"); fail_princ: if (!success) { |