Hello community, here is the log from the commit of package krb5 for openSUSE:11.4 checked in at Wed Oct 19 13:35:05 CEST 2011.
-------- --- old-versions/11.4/UPDATES/all/krb5/krb5-mini.changes 2011-04-14 11:11:44.000000000 +0200 +++ 11.4/krb5/krb5-mini.changes 2011-10-19 09:46:48.000000000 +0200 @@ -1,0 +2,7 @@ +Mon Oct 17 16:00:09 CEST 2011 - [email protected] + +- fix kdc remote denial of service + (MITKRB5-SA-2011-006, bnc#719393) + CVE-2011-1528, CVE-2011-1529 + +------------------------------------------------------------------- krb5.changes: same change calling whatdependson for 11.4-i586 New: ---- krb5-1.8-MITKRB5-SA-2011-006.dif ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ krb5-doc.spec ++++++ --- /var/tmp/diff_new_pack.nmPKgm/_old 2011-10-19 13:34:51.000000000 +0200 +++ /var/tmp/diff_new_pack.nmPKgm/_new 2011-10-19 13:34:51.000000000 +0200 @@ -21,7 +21,7 @@ Name: krb5-doc BuildRequires: ghostscript-library latex2html texlive Version: 1.8.3 -Release: 5.<RELEASE2> +Release: 5.<RELEASE3> %define srcRoot krb5-1.8.3 Summary: MIT Kerberos5 Implementation--Documentation License: MIT License (or similar) ++++++ krb5-mini.spec ++++++ --- /var/tmp/diff_new_pack.nmPKgm/_old 2011-10-19 13:34:51.000000000 +0200 +++ /var/tmp/diff_new_pack.nmPKgm/_new 2011-10-19 13:34:51.000000000 +0200 @@ -28,7 +28,7 @@ BuildRequires: bison libcom_err-devel ncurses-devel BuildRequires: keyutils keyutils-devel Version: 1.8.3 -Release: 5.<RELEASE2> +Release: 5.<RELEASE3> %if ! 0%{?build_mini} BuildRequires: libopenssl-devel openldap2-devel # bug437293 @@ -61,6 +61,7 @@ Patch15: krb5-1.8-MITKRB5-SA-2011-002.dif Patch16: krb5-1.8-MITKRB5-SA-2011-003.dif Patch17: krb5-1.8-MITKRB5-SA-2011-004.dif +Patch18: krb5-1.8-MITKRB5-SA-2011-006.dif BuildRoot: %{_tmppath}/%{name}-%{version}-build PreReq: mktemp, grep, /bin/touch, coreutils PreReq: %insserv_prereq %fillup_prereq @@ -214,6 +215,7 @@ %patch15 -p0 %patch16 -p1 %patch17 -p1 +%patch18 -p1 # Rename the man pages so that they'll get generated correctly. pushd src cat %{SOURCE10} | while read manpage ; do ++++++ krb5.spec ++++++ --- /var/tmp/diff_new_pack.nmPKgm/_old 2011-10-19 13:34:51.000000000 +0200 +++ /var/tmp/diff_new_pack.nmPKgm/_new 2011-10-19 13:34:51.000000000 +0200 @@ -28,7 +28,7 @@ BuildRequires: bison libcom_err-devel ncurses-devel BuildRequires: keyutils keyutils-devel Version: 1.8.3 -Release: 16.<RELEASE17> +Release: 16.<RELEASE19> %if ! 0%{?build_mini} BuildRequires: libopenssl-devel openldap2-devel # bug437293 @@ -61,6 +61,7 @@ Patch15: krb5-1.8-MITKRB5-SA-2011-002.dif Patch16: krb5-1.8-MITKRB5-SA-2011-003.dif Patch17: krb5-1.8-MITKRB5-SA-2011-004.dif +Patch18: krb5-1.8-MITKRB5-SA-2011-006.dif BuildRoot: %{_tmppath}/%{name}-%{version}-build PreReq: mktemp, grep, /bin/touch, coreutils PreReq: %insserv_prereq %fillup_prereq @@ -214,6 +215,7 @@ %patch15 -p0 %patch16 -p1 %patch17 -p1 +%patch18 -p1 # Rename the man pages so that they'll get generated correctly. pushd src cat %{SOURCE10} | while read manpage ; do ++++++ krb5-1.8-MITKRB5-SA-2011-006.dif ++++++ diff --git a/src/plugins/kdb/db2/lockout.c b/src/plugins/kdb/db2/lockout.c index 498c0de..5f973fb 100644 --- a/src/plugins/kdb/db2/lockout.c +++ b/src/plugins/kdb/db2/lockout.c @@ -158,13 +158,23 @@ krb5_db2_lockout_audit(krb5_context context, return 0; } + if (entry == NULL) + return 0; + code = lookup_lockout_policy(context, entry, &max_fail, &failcnt_interval, &lockout_duration); if (code != 0) return code; - assert (!locked_check_p(context, stamp, max_fail, lockout_duration, entry)); + /* + * Don't continue to modify the DB for an already locked account. + * (In most cases, status will be KRB5KDC_ERR_CLIENT_REVOKED, and + * this check is unneeded, but in rare cases, we can fail with an + * integrity error or preauth failure before a policy check.) + */ + if (locked_check_p(context, stamp, max_fail, lockout_duration, entry)) + return 0; if (status == 0 && (entry->attributes & KRB5_KDB_REQUIRES_PRE_AUTH)) { /* diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c index 626ed1f..68e8ec4 100644 --- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c +++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c @@ -131,6 +131,7 @@ krb5_ldap_get_principal(krb5_context context, krb5_const_principal searchfor, CHECK_LDAP_HANDLE(ldap_context); if (is_principal_in_realm(ldap_context, searchfor) != 0) { + st = KRB5_KDB_NOENTRY; *more = 0; krb5_set_error_message (context, st, "Principal does not belong to realm"); goto cleanup; diff --git a/src/plugins/kdb/ldap/libkdb_ldap/lockout.c b/src/plugins/kdb/ldap/libkdb_ldap/lockout.c index 020c77a..24b9493 100644 --- a/src/plugins/kdb/ldap/libkdb_ldap/lockout.c +++ b/src/plugins/kdb/ldap/libkdb_ldap/lockout.c @@ -150,15 +150,25 @@ krb5_ldap_lockout_audit(krb5_context context, return 0; } + if (entry == NULL) + return 0; + code = lookup_lockout_policy(context, entry, &max_fail, &failcnt_interval, &lockout_duration); if (code != 0) return code; - entry->mask = 0; + /* + * Don't continue to modify the DB for an already locked account. + * (In most cases, status will be KRB5KDC_ERR_CLIENT_REVOKED, and + * this check is unneeded, but in rare cases, we can fail with an + * integrity error or preauth failure before a policy check.) + */ + if (locked_check_p(context, stamp, max_fail, lockout_duration, entry)) + return 0; - assert (!locked_check_p(context, stamp, max_fail, lockout_duration, entry)); + entry->mask = 0; if (status == 0 && (entry->attributes & KRB5_KDB_REQUIRES_PRE_AUTH)) { /* continue with "q"... Remember to have fun... -- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
