RT RT/krbdev.mit.edu: Ticket #8617 PKINIT matching can crash for certs with long issuer and subject Signed in as guest.
[Logout]

[Home] [Search] [Configuration]

[Display] [History] [Basics] [Dates] [People] [Links] [Jumbo]

 
 

 The Basics  
Id
8617
Status
resolved
Worked
0 min
Priority
0/0
Queue
krb5
 

 Keyword Selections  
Component
Tags
Version_reported
Version_Fixed
  • 1.15.3
  • 1.14.7
  • 1.16
Target_Version
  • 1.14-next
  • 1.15-next
  • 1.16
 

 Relationships  
Depends on:
Depended on by:
Parents:
Children:

Refers to:
Referred to by:
 
 Dates  
Created: Tue Oct 24 18:45:39 2017
Starts: Not set
Started: Thu Oct 26 15:54:38 2017
Last Contact: Fri Oct 27 00:50:32 2017
Due: Not set
Updated: Mon Nov 27 11:19:15 2017 by ghudson
 

 People  
Owner
 ghudson
Requestors
 kraynopp@gmail.com
Cc
 
AdminCc
 
 

 More about Павел Крайнов  
Comments about this user:
No comment entered about this user
This user's 25 highest priority tickets:
 

History   Display mode: [Brief headers] [Full headers]
      Tue Oct 24 18:45:39 2017  kraynopp@gmail.com - Ticket created    
     
From: Павел Крайнов <kraynopp@gmail.com>
Date: Thu, 12 Oct 2017 21:00:17 +0300
Subject: Bug in PKINIT
To: krb5-bugs@mit.edu

 

     
 Hi,

In file \src\plugins\preauth\pkinit\pkinit_crypto_openssl.h I have found
constant:

#define DN_BUF_LEN  256

So, the size of DN is limited by 256 bytes. It is very small and can be
easily overflowed, especially if DN contains utf8-encoded CN/O/OU.
In this case PKINIT failed with error 'stack smashing detected'.

Please, consider to increase DN_BUF_LEN or use dynamic memory allocation
for DN buffer.

Download (untitled) 408b
     
 
Download (untitled) 827b
      Thu Oct 26 15:54:38 2017  ghudson - Given to ghudson    
      Thu Oct 26 15:54:38 2017  ghudson - Target_Version 1.16 added    
      Thu Oct 26 15:54:38 2017  ghudson - Target_Version 1.15-next added    
      Thu Oct 26 15:54:38 2017  ghudson - Target_Version 1.14-next added    
      Thu Oct 26 15:54:38 2017  ghudson - Status changed from new to resolved    
      Thu Oct 26 15:54:38 2017  ghudson - Tags pullup added    
      Thu Oct 26 15:54:38 2017  ghudson - Correspondence added    
     
From: ghudson@mit.edu
Subject: git commit


Fix PKINIT cert matching data construction

Rewrite X509_NAME_oneline_ex() and its call sites to use dynamic
allocation and to perform proper error checking.

https://github.com/krb5/krb5/commit/fbb687db1088ddd894d975996e5f6a4252b9a2b4
Author: Greg Hudson <ghudson@mit.edu>
Commit: fbb687db1088ddd894d975996e5f6a4252b9a2b4
Branch: master
 src/plugins/preauth/pkinit/pkinit_crypto_openssl.c |   67 +++++++------------
 1 files changed, 25 insertions(+), 42 deletions(-)


Download (untitled) 470b
      Fri Oct 27 00:50:04 2017  ghudson - Version_Fixed 1.15.3 added    
      Fri Oct 27 00:50:04 2017  ghudson - Correspondence added    
     
From: ghudson@mit.edu
Subject: git commit


Fix PKINIT cert matching data construction

Rewrite X509_NAME_oneline_ex() and its call sites to use dynamic
allocation and to perform proper error checking.

(cherry picked from commit fbb687db1088ddd894d975996e5f6a4252b9a2b4)

https://github.com/krb5/krb5/commit/f36ae41714f669e971e9334fe471f8a924386cc6
Author: Greg Hudson <ghudson@mit.edu>
Commit: f36ae41714f669e971e9334fe471f8a924386cc6
Branch: krb5-1.15
 src/plugins/preauth/pkinit/pkinit_crypto_openssl.c |   69 ++++++++------------
 1 files changed, 27 insertions(+), 42 deletions(-)


Download (untitled) 544b
      Fri Oct 27 00:50:32 2017  ghudson - Version_Fixed 1.14.7 added    
      Fri Oct 27 00:50:32 2017  ghudson - Correspondence added    
     
From: ghudson@mit.edu
Subject: git commit


Fix PKINIT cert matching data construction

Rewrite X509_NAME_oneline_ex() and its call sites to use dynamic
allocation and to perform proper error checking.

(cherry picked from commit fbb687db1088ddd894d975996e5f6a4252b9a2b4)

https://github.com/krb5/krb5/commit/5bae4fe119e22accab3d9045a9524530995596e9
Author: Greg Hudson <ghudson@mit.edu>
Commit: 5bae4fe119e22accab3d9045a9524530995596e9
Branch: krb5-1.14
 src/plugins/preauth/pkinit/pkinit_crypto_openssl.c |   69 ++++++++------------
 1 files changed, 27 insertions(+), 42 deletions(-)


Download (untitled) 544b
      Fri Oct 27 01:10:08 2017  ghudson - Keyword pullup deleted    
      Fri Oct 27 01:10:08 2017  ghudson - Version_Fixed 1.16 added    
      Mon Nov 27 11:19:15 2017  ghudson - Subject changed from Bug in PKINIT to PKINIT matching can crash for certs with long issuer and subject