SA-2011-007 KDC null pointer deref in TGS handling [CVE-2011-1530]
authorTom Yu <tlyu@mit.edu>
Tue, 6 Dec 2011 20:42:46 +0000 (20:42 +0000)
committerTom Yu <tlyu@mit.edu>
Tue, 6 Dec 2011 20:42:46 +0000 (20:42 +0000)
Fix a null pointer dereference condition that could cause a denial of
service.

ticket: 7042
target_version: 1.10
tags: pullup

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25525 dc483132-0cff-0310-8789-dd5450dbe970

src/kdc/Makefile.in
src/kdc/do_tgs_req.c
src/kdc/t_emptytgt.py [new file with mode: 0644]

index 118f8f78033c8738797298286a655ea3cd2c251a..8994a6a7676e48e5dcfcddb0667a79bf66385db0 100644 (file)
@@ -71,6 +71,7 @@ check-unix:: rtest
 
 check-pytests::
        $(RUNPYTEST) $(srcdir)/t_workers.py $(PYTESTFLAGS)
+       $(RUNPYTEST) $(srcdir)/t_emptytgt.py $(PYTESTFLAGS)
 
 install::
        $(INSTALL_PROGRAM) krb5kdc ${DESTDIR}$(SERVER_BINDIR)/krb5kdc
index 0f001d67c328cacc27fff8aeb85d85aec1608f91..56d9869c160d9608497640855b86b3a886c0be50 100644 (file)
@@ -238,7 +238,8 @@ tgt_again:
                     if (!tgs_1 || !data_eq(*server_1, *tgs_1)) {
                         errcode = find_alternate_tgs(request, &server);
                         firstpass = 0;
-                        goto tgt_again;
+                        if (errcode == 0)
+                            goto tgt_again;
                     }
                 }
                 status = "UNKNOWN_SERVER";
diff --git a/src/kdc/t_emptytgt.py b/src/kdc/t_emptytgt.py
new file mode 100644 (file)
index 0000000..1760bcd
--- /dev/null
@@ -0,0 +1,8 @@
+#!/usr/bin/python
+from k5test import *
+
+realm = K5Realm(start_kadmind=False, create_host=False)
+output = realm.run_as_client([kvno, 'krbtgt/'], expected_code=1)
+if 'not found in Kerberos database' not in output:
+    fail('TGT lookup for empty realm failed in unexpected way')
+success('Empty tgt lookup.')