RT RT/krbdev.mit.edu: Ticket #6900 kadmind frees invalid pointer [MITKRB5-SA-2011-004 CVE-2011-0285] Signed in as guest.
[Logout]

[Home] [Search] [Configuration]

[Display] [History] [Basics] [Dates] [People] [Links] [Jumbo]

 
 

 The Basics  
Id
6900
Status
resolved
Worked
0 min
Priority
0/0
Queue
krb5
 

 Keyword Selections  
Component
Tags
Version_reported
Version_Fixed
  • 1.8.4
Target_Version
 

 Relationships  
Depends on:
Depended on by:
Parents:
Children:

Refers to:
Referred to by:
 
 Dates  
Created: Thu Apr 14 18:04:15 2011
Starts: Not set
Started: Thu Apr 14 18:04:16 2011
Last Contact: Not set
Due: Not set
Updated: Thu Apr 14 18:04:16 2011 by tlyu
 

 People  
Owner
 tlyu
Requestors
 tlyu@mit.edu
Cc
 
AdminCc
 
 

 More about Taylor Yu  
Comments about this user:
No comment entered about this user
This user's 25 highest priority tickets:
 

History   Display mode: [Brief headers] [Full headers]
      Thu Apr 14 18:04:15 2011  tlyu - Ticket created    
     
From: tlyu@mit.edu
Subject: SVN Commit


back-port r24878 for 1.8-branch

 ------------------------------------------------------------------------
 r24878 | tlyu | 2011-04-13 14:43:37 -0400 (Wed, 13 Apr 2011) | 11 lines

 ticket: 6899
 tags: pullup
 target_version: 1.9.1

 Fix the sole case in process_chpw_request() where a return could occur
 without allocating the data pointer in the response.  This prevents a
 later free() of an invalid pointer in kill_tcp_or_rpc_connection().

 Also initialize rep->data to NULL in process_chpw_request() and clean
 up *response in dispatch() as an additional precaution.

https://github.com/krb5/krb5/commit/9f0293a1794038489d4764f1b526a9b01e5f8a2a
Commit By: tlyu
Revision: 24880
Changed Files:
U   branches/krb5-1-8/src/kadmin/server/network.c
U   branches/krb5-1-8/src/kadmin/server/schpw.c


Download (untitled) 798b
      Thu Apr 14 18:04:16 2011  tlyu - Requestor tlyu@mit.edu added    
      Thu Apr 14 18:04:16 2011  tlyu - Status changed from new to resolved    
      Thu Apr 14 18:04:16 2011  tlyu - Version_Fixed 1.8.4 added