Skip Menu |
 

To: krb5-bugs@MIT.EDU
Subject: double-free in gss_krb5int_make_seal_token_v3() [CVE-2007-5971]
From: Tom Yu <tlyu@MIT.EDU>
Date: Wed, 12 Dec 2007 13:39:39 -0500
Download (untitled) / with headers
text/plain 1.1KiB
This is one of the Venustech AD-LAB alleged vulnerabilities.

CVE-2007-5971
http://bugs.gentoo.org/show_bug.cgi?id=199212

This bug is a double-free condition which is not a practical
vulnerability due to the extreme difficulty of exploitation. If
krb5_c_make_checksum() (in src/lib/gssapi/krb5/k5sealv3.c) fails,
"outbuf" may be freed twice.

244 err = krb5_c_make_checksum(context, ctx->cksumtype, key,
245 key_usage, &plain, &sum);
246 zap(plain.data, plain.length);
247 free(plain.data);
248 plain.data = 0;
249 if (err) {
250 zap(outbuf,bufsize);
251 free(outbuf);
252 goto error;
253 }
...
290 error:
291 free(outbuf);
292 token->value = NULL;
293 token->length = 0;
294 return err;
295 }

krb5_c_make_checksum() only fails if malloc() fails to allocate a very
small amount of memory. To exploit this vulnerability, an attacker
would need to force a malloc() failure at exactly the point where
krb5_c_make_checksum is called.
From: tlyu@mit.edu
Subject: SVN Commit

fix CVE-2007-5971: free of non-heap pointer in gss_indicate_mechs()

Commit By: tlyu



Revision: 20178
Changed Files:
_U trunk/
U trunk/src/lib/gssapi/mechglue/g_initialize.c
actually belongs to #5854: freeing non-heap in gss_indicate_mechs() [CVE-2007-5901]

[tlyu - Thu Dec 13 23:38:35 2007]:

Show quoted text
>
> fix CVE-2007-5971: free of non-heap pointer in gss_indicate_mechs()
>
> Commit By: tlyu
>
>
>
> Revision: 20178
> Changed Files:
> _U trunk/
> U trunk/src/lib/gssapi/mechglue/g_initialize.c
From: tlyu@mit.edu
Subject: SVN Commit

fix CVE-2007-5971: double-free in gss_krb5int_make_seal_token_v3()

Commit By: tlyu



Revision: 20180
Changed Files:
_U trunk/
U trunk/src/lib/gssapi/krb5/k5sealv3.c
From: tlyu@mit.edu
Subject: SVN Commit

pull up r20180 from trunk

r20180@cathode-dark-space: tlyu | 2007-12-14 00:01:07 -0500
ticket: 5856
target_version: 1.6.4
tags: pullup

fix CVE-2007-5971: double-free in gss_krb5int_make_seal_token_v3()



Commit By: tlyu



Revision: 20186
Changed Files:
_U branches/krb5-1-6/
U branches/krb5-1-6/src/lib/gssapi/krb5/k5sealv3.c