From fd62ae86e4d400ea84284e1f275a10078b52175e Mon Sep 17 00:00:00 2001 From: Tom Yu Date: Thu, 20 Oct 2011 19:27:38 +0000 Subject: [PATCH] pull up r25368 from trunk ------------------------------------------------------------------------ r25368 | tlyu | 2011-10-18 14:51:35 -0400 (Tue, 18 Oct 2011) | 8 lines ticket: 6981 subject: SA-2011-006 KDC denial of service [CVE-2011-1527 CVE-2011-1528 CVE-2011-1529] target_version: 1.10 tags: pullup Fix null pointer dereference and assertion failure conditions that could cause a denial of service. ticket: 6981 version_fixed: 1.10 status: resolved git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-10@25387 dc483132-0cff-0310-8789-dd5450dbe970 --- src/plugins/kdb/db2/lockout.c | 12 ++++++++++++ src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c | 1 + src/plugins/kdb/ldap/libkdb_ldap/lockout.c | 14 ++++++++++++-- 3 files changed, 25 insertions(+), 2 deletions(-) diff --git a/src/plugins/kdb/db2/lockout.c b/src/plugins/kdb/db2/lockout.c index da5e76192..ba542128b 100644 --- a/src/plugins/kdb/db2/lockout.c +++ b/src/plugins/kdb/db2/lockout.c @@ -165,6 +165,9 @@ krb5_db2_lockout_audit(krb5_context context, return 0; } + if (entry == NULL) + return 0; + if (!db_ctx->disable_lockout) { code = lookup_lockout_policy(context, entry, &max_fail, &failcnt_interval, &lockout_duration); @@ -172,6 +175,15 @@ krb5_db2_lockout_audit(krb5_context context, return code; } + /* + * Don't continue to modify the DB for an already locked account. + * (In most cases, status will be KRB5KDC_ERR_CLIENT_REVOKED, and + * this check is unneeded, but in rare cases, we can fail with an + * integrity error or preauth failure before a policy check.) + */ + if (locked_check_p(context, stamp, max_fail, lockout_duration, entry)) + return 0; + /* Only mark the authentication as successful if the entry * required preauthentication, otherwise we have no idea. */ if (status == 0 && (entry->attributes & KRB5_KDB_REQUIRES_PRE_AUTH)) { diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c index 0e78354fc..5546ba020 100644 --- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c +++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c @@ -104,6 +104,7 @@ krb5_ldap_get_principal(krb5_context context, krb5_const_principal searchfor, CHECK_LDAP_HANDLE(ldap_context); if (is_principal_in_realm(ldap_context, searchfor) != 0) { + st = KRB5_KDB_NOENTRY; krb5_set_error_message(context, st, _("Principal does not belong to realm")); goto cleanup; diff --git a/src/plugins/kdb/ldap/libkdb_ldap/lockout.c b/src/plugins/kdb/ldap/libkdb_ldap/lockout.c index 225f6873b..36505f832 100644 --- a/src/plugins/kdb/ldap/libkdb_ldap/lockout.c +++ b/src/plugins/kdb/ldap/libkdb_ldap/lockout.c @@ -161,6 +161,9 @@ krb5_ldap_lockout_audit(krb5_context context, return 0; } + if (entry == NULL) + return 0; + if (!ldap_context->disable_lockout) { code = lookup_lockout_policy(context, entry, &max_fail, &failcnt_interval, @@ -169,9 +172,16 @@ krb5_ldap_lockout_audit(krb5_context context, return code; } - entry->mask = 0; + /* + * Don't continue to modify the DB for an already locked account. + * (In most cases, status will be KRB5KDC_ERR_CLIENT_REVOKED, and + * this check is unneeded, but in rare cases, we can fail with an + * integrity error or preauth failure before a policy check.) + */ + if (locked_check_p(context, stamp, max_fail, lockout_duration, entry)) + return 0; - assert (!locked_check_p(context, stamp, max_fail, lockout_duration, entry)); + entry->mask = 0; /* Only mark the authentication as successful if the entry * required preauthentication, otherwise we have no idea. */ -- 2.26.2