From: | tlyu@mit.edu |
Subject: | SVN Commit |
Fix KDC heap corruption vuln [CVE-2012-1015]
Fix KDC heap corruption vulnerability [MITKRB5-SA-2012-001
CVE-2012-1015]. The cleanup code in
kdc_handle_protected_negotiation() in kdc_util.c could free an
uninitialized pointer in some error conditions involving "similar"
enctypes and a failure in krb5_c_make_checksum().
Additionally, adjust the handling of "similar" enctypes to avoid
advertising enctypes that could lead to inadvertent triggering of this
vulnerability (possibly in unpatched KDCs).
Note that CVE-2012-1014 (also described in MITKRB5-SA-2012-001) only
applies to the krb5-1.10 branch and doesn't affect the master branch
or releases prior to krb5-1.10.
https://github.com/krb5/krb5/commit/3551501359c6d2396fa4779d378ae165f5b37242
Author: Tom Yu <tlyu@mit.edu>
Commit: 3551501359c6d2396fa4779d378ae165f5b37242
Branch: master
src/kdc/kdc_preauth.c | 3 ++-
src/kdc/kdc_util.c | 1 +
src/lib/kdb/kdb_default.c | 3 +++
3 files changed, 6 insertions(+), 1 deletions(-)