RT RT/krbdev.mit.edu: Ticket #7600 KDC TGS-REQ null deref [CVE-2013-1416] Signed in as guest.
[Logout]

[Home] [Search] [Configuration]

[Display] [History] [Basics] [Dates] [People] [Links] [Jumbo]

 
 

 The Basics  
Id
7600
Status
resolved
Worked
0 min
Priority
0/0
Queue
krb5
 

 Keyword Selections  
Component
Version_reported
Version_Fixed
  • 1.10.5
Target_Version
Tags
 

 Relationships  
Depends on:
Depended on by:
Parents:
Children:

Refers to:
Referred to by:
  • 7622: (tlyu) KDC TGS-REQ null deref [CVE-2013-1416] [resolved]
 
 Dates  
Created: Fri Apr 5 14:21:59 2013
Starts: Not set
Started: Fri Apr 5 14:22:00 2013
Last Contact: Not set
Due: Not set
Updated: Fri Apr 5 14:22:00 2013 by tlyu
 

 People  
Owner
 tlyu
Requestors
 tlyu@mit.edu
Cc
 
AdminCc
 
 

 More about Tom Yu  
Comments about this user:
No comment entered about this user
This user's 25 highest priority tickets:
 

History   Display mode: [Brief headers] [Full headers]
      Fri Apr  5 14:21:59 2013  tlyu - Ticket created    
     
From: tlyu@mit.edu
Subject: git commit


KDC TGS-REQ null deref [CVE-2013-1416]

By sending an unusual but valid TGS-REQ, an authenticated remote
attacker can cause the KDC process to crash by dereferencing a null
pointer.

prep_reprocess_req() can cause a null pointer dereference when
processing a service principal name.  Code in this function can
inappropriately pass a null pointer to strlcpy().  Unmodified client
software can trivially trigger this vulnerability, but the attacker
must have already authenticated and received a valid Kerberos ticket.

The vulnerable code was introduced by the implementation of new
service principal realm referral functionality in krb5-1.7, but was
corrected as a side effect of the KDC refactoring in krb5-1.11.

CVSSv2 vector: AV:N/AC:L/Au:S/C:N/I:N/A:C/E:H/RL:O/RC:C

https://github.com/krb5/krb5/commit/8ee70ec63931d1e38567905387ab9b1d45734d81
Author: Tom Yu <tlyu@mit.edu>
Commit: 8ee70ec63931d1e38567905387ab9b1d45734d81
Branch: krb5-1.10
 src/kdc/do_tgs_req.c |    6 ++++--
 1 files changed, 4 insertions(+), 2 deletions(-)


Download (untitled) 1k
      Fri Apr  5 14:22:00 2013  tlyu - Requestor tlyu@mit.edu added    
      Fri Apr  5 14:22:00 2013  tlyu - Status changed from new to resolved    
      Fri Apr  5 14:22:00 2013  tlyu - Version_Fixed 1.10.5 added