RT RT/krbdev.mit.edu: Ticket #6862 KDC denial of service attacks [MITKRB5-SA-2011-002 CVE-2011-0281 CVE-2011-0282] Signed in as guest.
[Logout]

[Home] [Search] [Configuration]

[Display] [History] [Basics] [Dates] [People] [Links] [Jumbo]

 
 

 The Basics  
Id
6862
Status
resolved
Worked
0 min
Priority
0/0
Queue
krb5
 

 Keyword Selections  
Component
Tags
Version_reported
Version_Fixed
  • 1.8.4
Target_Version
 

 Relationships  
Depends on:
Depended on by:
Parents:
Children:

Refers to:
  • 6860: (tlyu) KDC denial of service attacks [MITKRB5-SA-2011-002 CVE-2011-0281 CVE-2011-0282 CVE-2011-0283] [resolved]
Referred to by:
 
 Dates  
Created: Wed Feb 9 16:03:50 2011
Starts: Not set
Started: Wed Feb 9 16:03:50 2011
Last Contact: Not set
Due: Not set
Updated: Wed Feb 9 17:24:29 2011 by tlyu
 

 People  
Owner
 tlyu
Requestors
 tlyu@mit.edu
Cc
 
AdminCc
 
 

 More about Taylor Yu  
Comments about this user:
No comment entered about this user
This user's 25 highest priority tickets:
 

History   Display mode: [Brief headers] [Full headers]
      Wed Feb  9 16:03:50 2011  tlyu - Ticket created    
     
From: tlyu@mit.edu
Subject: SVN Commit


pull up r24622 from trunk, minus the fix for CVE-2011-0283, which is
only applicable to krb5-1.9 and later.

 ------------------------------------------------------------------------
 r24622 | tlyu | 2011-02-09 15:25:08 -0500 (Wed, 09 Feb 2011) | 10 lines

 ticket: 6860
 subject: KDC denial of service attacks [MITKRB5-SA-2011-002 CVE-2011-0281 CVE-2011-
0282 CVE-2011-0283]
 tags: pullup
 target_version: 1.9.1

 [CVE-2011-0281 CVE-2011-0282] Fix some LDAP back end principal name
 handling that could cause the KDC to hang or crash.

 [CVE-2011-0283] Fix a KDC null pointer dereference introduced in krb5-1.9.

https://github.com/krb5/krb5/commit/76d7f2223230a9ead7c8cc50816138a8abc73820
Commit By: tlyu
Revision: 24626
Changed Files:
U   branches/krb5-1-8/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.h
U   branches/krb5-1-8/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap_conn.c
U   branches/krb5-1-8/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c
U   branches/krb5-1-8/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c


Download (untitled) 1015b
      Wed Feb  9 16:03:50 2011  tlyu - Requestor tlyu@mit.edu added    
      Wed Feb  9 16:03:50 2011  tlyu - Status changed from new to resolved    
      Wed Feb  9 16:03:50 2011  tlyu - Version_Fixed 1.8.4 added    
      Wed Feb  9 17:24:29 2011  tlyu - Ticket 6862 RefersTo ticket 6860.