Skip Menu |
 

History Show all quoted text — Show full headers
# Mon Mar 24 23:16:38 2008 tlyu (Taylor Yu) - Ticket created
From: tlyu@mit.edu
Subject: SVN Commit
Download (untitled) / with headers
text/plain 417B

r19913@cathode-dark-space: tlyu | 2007-09-04 14:52:56 -0400
ticket: new
subject: fix CVE-2007-3999 svc_auth_gss.c buffer overflow
target_version: 1.6.3
tags: pullup
component: krb5-libs

Make sure svcauth_gss_validate adequately checks oa->oa_length prior
to copying into rpcbuf.



Commit By: tlyu



Revision: 20289
Changed Files:
_U branches/krb5-1-5/
U branches/krb5-1-5/src/lib/rpc/svc_auth_gss.c
# Mon Mar 24 23:16:40 2008 tlyu (Taylor Yu) - Requestor tlyu (Taylor Yu) added
# Mon Mar 24 23:16:41 2008 tlyu (Taylor Yu) - Status changed from 'new' to 'resolved'
# Mon Mar 24 23:16:41 2008 tlyu (Taylor Yu) - Tags pullup added
# Mon Mar 24 23:16:42 2008 tlyu (Taylor Yu) - Target_Version 1.5.4 added
# Mon Mar 24 23:16:42 2008 tlyu (Taylor Yu) - Component krb5-libs added
# Mon Mar 24 23:17:50 2008 tlyu (Taylor Yu) - Target_Version 1.5.4 changed to 1.5.5
# Mon Mar 24 23:17:50 2008 tlyu (Taylor Yu) - Ticket 5928 RefersTo ticket 5706.
# Mon Mar 24 23:27:07 2008 tlyu (Taylor Yu) - Version_Fixed 1.5.5 added
# Mon Mar 24 23:27:07 2008 tlyu (Taylor Yu) - Correspondence added
From: tlyu@mit.edu
Subject: SVN Commit
Download (untitled) / with headers
text/plain 510B

pull up r19923 from trunk

r19923@cathode-dark-space: tlyu | 2007-09-05 15:53:33 -0400
ticket: 5706

Revise patch to avoid 32-byte overflow which remained after the
initial patch. Memory written to by the IXDR macro calls had not been
accounted for. Thanks to Kevin Coffman, Will Fiveash, and Nico
Williams for discovering this bug and assisting with patch
development.




Commit By: tlyu



Revision: 20290
Changed Files:
_U branches/krb5-1-5/
U branches/krb5-1-5/src/lib/rpc/svc_auth_gss.c
# Wed Dec 16 18:02:52 2015 tlyu (Taylor Yu) - CustomField pullup deleted