RT RT/krbdev.mit.edu: Ticket #6899 kadmind frees invalid pointer [MITKRB5-SA-2011-004 CVE-2011-0285] Signed in as guest.
[Logout]

[Home] [Search] [Configuration]

[Display] [History] [Basics] [Dates] [People] [Links] [Jumbo]

 
 

 The Basics  
Id
6899
Status
resolved
Worked
0 min
Priority
0/0
Queue
krb5
 

 Keyword Selections  
Component
Version_reported
Version_Fixed
  • 1.9.1
Target_Version
  • 1.9.1
Tags
  • pullup
 

 Relationships  
Depends on:
Depended on by:
Parents:
Children:

Refers to:
Referred to by:
 
 Dates  
Created: Fri Apr 8 08:36:31 2011
Starts: Not set
Started: Wed Apr 13 14:43:38 2011
Last Contact: Wed Apr 13 18:45:09 2011
Due: Not set
Updated: Wed Apr 13 18:46:58 2011 by tlyu
 

 People  
Owner
 tlyu
Requestors
 hartmans@debian.org
Cc
 
AdminCc
 
 

 More about Sam Hartman  
Comments about this user:
No comment entered about this user
This user's 25 highest priority tickets:
 

History   Display mode: [Brief headers] [Full headers]
      Fri Apr  8 08:36:32 2011  hartmans@debian.org - Ticket created    
     
From: Sam Hartman <hartmans@debian.org>
To: krb5-bugs@mit.edu
Subject: [Felipe Ortega] Bug#621726: krb5-admin-server: kadmind dies after nmap -sV
Date: Fri, 08 Apr 2011 08:36:22 -0400

 

     
Who needs a complicated DOS?
Confirmed against 1.9 with the current round of CVEs patched.



Download (untitled) 93b
     
 
Download (untitled) 23.3k
      Fri Apr  8 09:47:15 2011  tlyu - Correspondence added    
     
To: rt@krbdev.MIT.EDU
Subject: Re: [krbdev.mit.edu #6899] [Felipe Ortega] Bug#621726: krb5-admin-server: kadmind dies after nmap -sV
From: Tom Yu <tlyu@MIT.EDU>
Date: Fri, 08 Apr 2011 09:47:13 -0400
RT-Send-Cc: 

Any way we can get a more detailed backtrace, preferably including
debugging information / line numbers?


Download (untitled) 105b
      Fri Apr  8 16:26:12 2011  tlyu - Correspondence added    
     
To: rt@krbdev.MIT.EDU
Subject: Re: [krbdev.mit.edu #6899] [Felipe Ortega] Bug#621726: krb5-admin-server: kadmind dies after nmap -sV
From: Tom Yu <tlyu@MIT.EDU>
Date: Fri, 08 Apr 2011 16:26:06 -0400
RT-Send-Cc: 

Also, I can't seem to reproduce this problem against trunk; will try
with 1.8 branch next.


Download (untitled) 91b
      Sun Apr 10 14:22:47 2011  hartmans@debian.org - Correspondence added    
     
From: Sam Hartman <hartmans@debian.org>
To: rt@krbdev.mit.edu
Subject: Re: [krbdev.mit.edu #6899] [Felipe Ortega] Bug#621726: krb5-admin-server: kadmind dies after nmap -sV
Date: Sun, 10 Apr 2011 14:22:42 -0400
RT-Send-Cc: 

>>>>> "Tom" == Tom Yu via RT <rt-comment@krbdev.mit.edu> writes:

    Tom> Also, I can't seem to reproduce this problem against trunk;
    Tom> will try with 1.8 branch next.

I can definitely reproduce against 1.9.
Dies in krb5_free_data with a segv.
I don't have any changes to libgssrpc, kadmind  or the network server
code.
I don't have full symbols available.


Download (untitled) 365b
      Sun Apr 10 15:02:07 2011  tlyu - Correspondence added    
     
To: rt@krbdev.MIT.EDU
Subject: Re: [krbdev.mit.edu #6899] [Felipe Ortega] Bug#621726: krb5-admin-server: kadmind dies after nmap -sV
From: Tom Yu <tlyu@MIT.EDU>
Date: Sun, 10 Apr 2011 15:02:05 -0400
RT-Send-Cc: 

"Sam Hartman via RT" <rt-comment@krbdev.mit.edu> writes:

>>>>>> "Tom" == Tom Yu via RT <rt-comment@krbdev.mit.edu> writes:
>
>     Tom> Also, I can't seem to reproduce this problem against trunk;
>     Tom> will try with 1.8 branch next.
>
> I can definitely reproduce against 1.9.
> Dies in krb5_free_data with a segv.
> I don't have any changes to libgssrpc, kadmind  or the network server
> code.
> I don't have full symbols available.

I have a candidate bug location, and it involves the kpasswd
component, not the kadmin protocol itself.  Patches coming soon.


Download (untitled) 567b
      Wed Apr 13 14:43:38 2011  tlyu - Given to tlyu    
      Wed Apr 13 14:43:38 2011  tlyu - Target_Version 1.9.1 added    
      Wed Apr 13 14:43:38 2011  tlyu - Status changed from new to review    
      Wed Apr 13 14:43:38 2011  tlyu - Tags pullup added    
      Wed Apr 13 14:43:38 2011  tlyu - Correspondence added    
     
From: tlyu@mit.edu
Subject: SVN Commit


Fix the sole case in process_chpw_request() where a return could occur
without allocating the data pointer in the response.  This prevents a
later free() of an invalid pointer in kill_tcp_or_rpc_connection().

Also initialize rep->data to NULL in process_chpw_request() and clean
up *response in dispatch() as an additional precaution.

http://src.mit.edu/fisheye/changelog/krb5/?cs=24878
Commit By: tlyu
Revision: 24878
Changed Files:
U   trunk/src/kadmin/server/schpw.c


Download (untitled) 473b
      Wed Apr 13 18:45:09 2011  tlyu - Status changed from review to resolved    
      Wed Apr 13 18:45:09 2011  tlyu - Version_Fixed 1.9.1 added    
      Wed Apr 13 18:45:09 2011  tlyu - Correspondence added    
     
From: tlyu@mit.edu
Subject: SVN Commit


pull up r24878 from trunk

 ------------------------------------------------------------------------
 r24878 | tlyu | 2011-04-13 14:43:37 -0400 (Wed, 13 Apr 2011) | 11 lines

 ticket: 6899
 tags: pullup
 target_version: 1.9.1

 Fix the sole case in process_chpw_request() where a return could occur
 without allocating the data pointer in the response.  This prevents a
 later free() of an invalid pointer in kill_tcp_or_rpc_connection().

 Also initialize rep->data to NULL in process_chpw_request() and clean
 up *response in dispatch() as an additional precaution.

http://src.mit.edu/fisheye/changelog/krb5/?cs=24879
Commit By: tlyu
Revision: 24879
Changed Files:
U   branches/krb5-1-9/src/kadmin/server/schpw.c


Download (untitled) 717b
      Wed Apr 13 18:46:58 2011  tlyu - Subject changed from [Felipe Ortega] Bug#621726: krb5-admin-server: kadmind dies after nmap -sV to kadmind frees invalid pointer [MITKRB5-SA-2011-004 CVE-2011-0285]