diff options
| author | Tom Yu <tlyu@mit.edu> | 2011-12-05 21:38:44 +0000 |
|---|---|---|
| committer | Tom Yu <tlyu@mit.edu> | 2011-12-05 21:38:44 +0000 |
| commit | 2b90ddc305e4fde5e6d296a4495227eaa4ad79d5 (patch) | |
| tree | e485b72c8ca9da9c4f6ffed611c175405f98e06f | |
| parent | 83042b749fbda10b1386395c84c559f00a66f1f9 (diff) | |
| download | krb5-2b90ddc305e4fde5e6d296a4495227eaa4ad79d5.zip krb5-2b90ddc305e4fde5e6d296a4495227eaa4ad79d5.tar.gz krb5-2b90ddc305e4fde5e6d296a4495227eaa4ad79d5.tar.bz2 | |
pull up r25480 from trunk, minus a non-applying manpage patch
------------------------------------------------------------------------
r25480 | ghudson | 2011-11-20 00:19:45 -0500 (Sun, 20 Nov 2011) | 13 lines
ticket: 7021
subject: Fix failure interval of 0 in LDAP lockout code
target_version: 1.10
tags: pullup
A failure count interval of 0 caused krb5_ldap_lockout_check_policy to
pass the lockout check (but didn't cause a reset of the failure count
in krb5_ldap_lockout_audit). It should be treated as forever, as in
the DB2 back end.
This bug is the previously unknown cause of the assertion failure
fixed in CVE-2011-1528.
ticket: 7040
version_fixed: 1.9.3
status: resolved
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-9@25513 dc483132-0cff-0310-8789-dd5450dbe970
| -rw-r--r-- | src/plugins/kdb/ldap/libkdb_ldap/lockout.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/plugins/kdb/ldap/libkdb_ldap/lockout.c b/src/plugins/kdb/ldap/libkdb_ldap/lockout.c index fd164dd..401cc43 100644 --- a/src/plugins/kdb/ldap/libkdb_ldap/lockout.c +++ b/src/plugins/kdb/ldap/libkdb_ldap/lockout.c @@ -131,7 +131,7 @@ krb5_ldap_lockout_check_policy(krb5_context context, code = lookup_lockout_policy(context, entry, &max_fail, &failcnt_interval, &lockout_duration); - if (code != 0 || failcnt_interval == 0) + if (code != 0) return code; if (locked_check_p(context, stamp, max_fail, lockout_duration, entry)) |