From 8d6a83d1163fafb8e9308313c83ce0472864abbb Mon Sep 17 00:00:00 2001 From: Tom Yu Date: Tue, 6 Dec 2011 20:42:46 +0000 Subject: [PATCH] SA-2011-007 KDC null pointer deref in TGS handling [CVE-2011-1530] Fix a null pointer dereference condition that could cause a denial of service. ticket: 7042 target_version: 1.10 tags: pullup git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25525 dc483132-0cff-0310-8789-dd5450dbe970 --- src/kdc/Makefile.in | 1 + src/kdc/do_tgs_req.c | 3 ++- src/kdc/t_emptytgt.py | 8 ++++++++ 3 files changed, 11 insertions(+), 1 deletion(-) create mode 100644 src/kdc/t_emptytgt.py diff --git a/src/kdc/Makefile.in b/src/kdc/Makefile.in index 118f8f780..8994a6a76 100644 --- a/src/kdc/Makefile.in +++ b/src/kdc/Makefile.in @@ -71,6 +71,7 @@ check-unix:: rtest check-pytests:: $(RUNPYTEST) $(srcdir)/t_workers.py $(PYTESTFLAGS) + $(RUNPYTEST) $(srcdir)/t_emptytgt.py $(PYTESTFLAGS) install:: $(INSTALL_PROGRAM) krb5kdc ${DESTDIR}$(SERVER_BINDIR)/krb5kdc diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c index 0f001d67c..56d9869c1 100644 --- a/src/kdc/do_tgs_req.c +++ b/src/kdc/do_tgs_req.c @@ -238,7 +238,8 @@ tgt_again: if (!tgs_1 || !data_eq(*server_1, *tgs_1)) { errcode = find_alternate_tgs(request, &server); firstpass = 0; - goto tgt_again; + if (errcode == 0) + goto tgt_again; } } status = "UNKNOWN_SERVER"; diff --git a/src/kdc/t_emptytgt.py b/src/kdc/t_emptytgt.py new file mode 100644 index 000000000..1760bcd5a --- /dev/null +++ b/src/kdc/t_emptytgt.py @@ -0,0 +1,8 @@ +#!/usr/bin/python +from k5test import * + +realm = K5Realm(start_kadmind=False, create_host=False) +output = realm.run_as_client([kvno, 'krbtgt/'], expected_code=1) +if 'not found in Kerberos database' not in output: + fail('TGT lookup for empty realm failed in unexpected way') +success('Empty tgt lookup.') -- 2.26.2