diff options
| author | Tom Yu <tlyu@mit.edu> | 2011-12-06 20:59:16 +0000 |
|---|---|---|
| committer | Tom Yu <tlyu@mit.edu> | 2011-12-06 20:59:16 +0000 |
| commit | 2ff0f083b4df22dc0b05e66ee0cd1bcbe2c9f5a0 (patch) | |
| tree | 395ca27dfde608e59240debad0d7691f96b78ac1 | |
| parent | 2b90ddc305e4fde5e6d296a4495227eaa4ad79d5 (diff) | |
| download | krb5-2ff0f083b4df22dc0b05e66ee0cd1bcbe2c9f5a0.zip krb5-2ff0f083b4df22dc0b05e66ee0cd1bcbe2c9f5a0.tar.gz krb5-2ff0f083b4df22dc0b05e66ee0cd1bcbe2c9f5a0.tar.bz2 | |
SA-2011-007 KDC null pointer deref in TGS handling [CVE-2011-1530]
pull up r25525 from trunk
------------------------------------------------------------------------
r25525 | tlyu | 2011-12-06 15:42:46 -0500 (Tue, 06 Dec 2011) | 8 lines
ticket: 7042
subject: SA-2011-007 KDC null pointer deref in TGS handling [CVE-2011-1530]
target_version: 1.10
tags: pullup
Fix a null pointer dereference condition that could cause a denial of
service.
ticket: 7043
version_fixed: 1.9.3
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-9@25527 dc483132-0cff-0310-8789-dd5450dbe970
| -rw-r--r-- | src/kdc/Makefile.in | 1 | ||||
| -rw-r--r-- | src/kdc/do_tgs_req.c | 3 | ||||
| -rw-r--r-- | src/kdc/t_emptytgt.py | 8 |
3 files changed, 11 insertions, 1 deletions
diff --git a/src/kdc/Makefile.in b/src/kdc/Makefile.in index f46cad3..102fbaa 100644 --- a/src/kdc/Makefile.in +++ b/src/kdc/Makefile.in @@ -67,6 +67,7 @@ check-unix:: rtest check-pytests:: $(RUNPYTEST) $(srcdir)/t_workers.py $(PYTESTFLAGS) + $(RUNPYTEST) $(srcdir)/t_emptytgt.py $(PYTESTFLAGS) install:: $(INSTALL_PROGRAM) krb5kdc ${DESTDIR}$(SERVER_BINDIR)/krb5kdc diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c index c169c54..840a2ef 100644 --- a/src/kdc/do_tgs_req.c +++ b/src/kdc/do_tgs_req.c @@ -243,7 +243,8 @@ tgt_again: if (!tgs_1 || !data_eq(*server_1, *tgs_1)) { errcode = find_alternate_tgs(request, &server); firstpass = 0; - goto tgt_again; + if (errcode == 0) + goto tgt_again; } } status = "UNKNOWN_SERVER"; diff --git a/src/kdc/t_emptytgt.py b/src/kdc/t_emptytgt.py new file mode 100644 index 0000000..1760bcd --- /dev/null +++ b/src/kdc/t_emptytgt.py @@ -0,0 +1,8 @@ +#!/usr/bin/python +from k5test import * + +realm = K5Realm(start_kadmind=False, create_host=False) +output = realm.run_as_client([kvno, 'krbtgt/'], expected_code=1) +if 'not found in Kerberos database' not in output: + fail('TGT lookup for empty realm failed in unexpected way') +success('Empty tgt lookup.') |