SA-2011-006 KDC denial of service [CVE-2011-1527 CVE-2011-1528 CVE-2011-1529]

Fix null pointer dereference and assertion failure conditions that
could cause a denial of service.

ticket: 6983
version_fixed: 1.8.4
status: resolved

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@25370 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/plugins/kdb/db2/lockout.c b/src/plugins/kdb/db2/lockout.c
index 498c0dea629768ab19b3ca7f70a9cff2b5ee28a0..5f973fb08ad1e1172866da946f2dc9aaed20a8ff 100644 (file)
--- a/src/plugins/kdb/db2/lockout.c
+++ b/src/plugins/kdb/db2/lockout.c
@@ -158,13 +158,23 @@ krb5_db2_lockout_audit(krb5_context context,
         return 0;
     }
 
+    if (entry == NULL)
+        return 0;
+
     code = lookup_lockout_policy(context, entry, &max_fail,
                                  &failcnt_interval,
                                  &lockout_duration);
     if (code != 0)
         return code;
 
-    assert (!locked_check_p(context, stamp, max_fail, lockout_duration, entry));
+    /*
+     * Don't continue to modify the DB for an already locked account.
+     * (In most cases, status will be KRB5KDC_ERR_CLIENT_REVOKED, and
+     * this check is unneeded, but in rare cases, we can fail with an
+     * integrity error or preauth failure before a policy check.)
+     */
+    if (locked_check_p(context, stamp, max_fail, lockout_duration, entry))
+        return 0;
 
     if (status == 0 && (entry->attributes & KRB5_KDB_REQUIRES_PRE_AUTH)) {
         /*

diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
index 626ed1f2ca960888bacee47ba52ab0bbb6e2ad67..68e8ec485279db67a2127c3714cb9e9a02f97586 100644 (file)
--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
+++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
@@ -131,6 +131,7 @@ krb5_ldap_get_principal(krb5_context context, krb5_const_principal searchfor,
     CHECK_LDAP_HANDLE(ldap_context);
 
     if (is_principal_in_realm(ldap_context, searchfor) != 0) {
+        st = KRB5_KDB_NOENTRY;
         *more = 0;
         krb5_set_error_message (context, st, "Principal does not belong to realm");
         goto cleanup;

diff --git a/src/plugins/kdb/ldap/libkdb_ldap/lockout.c b/src/plugins/kdb/ldap/libkdb_ldap/lockout.c
index 020c77a945ca38087a09b6cc312a24410ae04347..24b9493ba05f6435445f87c693726b0d37d108f5 100644 (file)
--- a/src/plugins/kdb/ldap/libkdb_ldap/lockout.c
+++ b/src/plugins/kdb/ldap/libkdb_ldap/lockout.c
@@ -150,15 +150,25 @@ krb5_ldap_lockout_audit(krb5_context context,
         return 0;
     }
 
+    if (entry == NULL)
+        return 0;
+
     code = lookup_lockout_policy(context, entry, &max_fail,
                                  &failcnt_interval,
                                  &lockout_duration);
     if (code != 0)
         return code;
 
-    entry->mask = 0;
+    /*
+     * Don't continue to modify the DB for an already locked account.
+     * (In most cases, status will be KRB5KDC_ERR_CLIENT_REVOKED, and
+     * this check is unneeded, but in rare cases, we can fail with an
+     * integrity error or preauth failure before a policy check.)
+     */
+    if (locked_check_p(context, stamp, max_fail, lockout_duration, entry))
+        return 0;
 
-    assert (!locked_check_p(context, stamp, max_fail, lockout_duration, entry));
+    entry->mask = 0;
 
     if (status == 0 && (entry->attributes & KRB5_KDB_REQUIRES_PRE_AUTH)) {
         /*