projects / krb5.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 176d6c5) | patch
(krb5-1.5.x) fix MITKRB5-SA-2007-004 [CVE-2007-2442/VU#356961, CVE-2007-2443/VU#365313]
authorTom Yu <tlyu@mit.edu>
Fri, 6 Jul 2007 19:29:03 +0000 (19:29 +0000)
committerTom Yu <tlyu@mit.edu>
Fri, 6 Jul 2007 19:29:03 +0000 (19:29 +0000)
commitdb63f78232526dda43abf22defd8daac46f66037
tree34872a4ade14d5e2f9281dedcd741e6708a9f7b2tree | snapshot
parent176d6c57c2785ae931aaf99d43ce3510a651d9c4commit | diff
(krb5-1.5.x) fix MITKRB5-SA-2007-004 [CVE-2007-2442/VU#356961, CVE-2007-2443/VU#365313]

pull up r19636 for 1.5-branch

 r19636@cathode-dark-space:  tlyu | 2007-06-26 14:08:20 -0400
 ticket: new
 target_version: 1.6.2
 tags: pullup
 subject: fix MITKRB5-SA-2007-004 [CVE-2007-2442/VU#356961, CVE-2007-2443/VU#365313]

 CVE-2007-2442/VU#356961: The RPC library can free an uninitialized
 pointer.  This may lead to execution of arbitrary code.

 CVE-2007-2443/VU#365313: The RPC library can write past the end of a
 stack buffer.  This may (but is unlikely to) lead to execution of
 arbitrary code.

ticket: new
version_fixed: 1.5.4

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-5@19682 dc483132-0cff-0310-8789-dd5450dbe970
src/lib/rpc/svc_auth_gssapi.c diff | blob | history
src/lib/rpc/svc_auth_unix.c diff | blob | history
MIT implementation of the Kerberos network authentication protocol. This repo may be rebased, so don't base your work on it. Use git://github.com/krb5/krb5 instead.