| From: | tlyu@mit.edu |
| Subject: | git commit |
KDC TGS-REQ null deref [CVE-2013-1416]
By sending an unusual but valid TGS-REQ, an authenticated remote
attacker can cause the KDC process to crash by dereferencing a null
pointer.
prep_reprocess_req() can cause a null pointer dereference when
processing a service principal name. Code in this function can
inappropriately pass a null pointer to strlcpy(). Unmodified client
software can trivially trigger this vulnerability, but the attacker
must have already authenticated and received a valid Kerberos ticket.
The vulnerable code was introduced by the implementation of new
service principal realm referral functionality in krb5-1.7, but was
corrected as a side effect of the KDC refactoring in krb5-1.11.
CVSSv2 vector: AV:N/AC:L/Au:S/C:N/I:N/A:C/E:H/RL:O/RC:C
https://github.com/krb5/krb5/commit/8ee70ec63931d1e38567905387ab9b1d45734d81
Author: Tom Yu <tlyu@mit.edu>
Commit: 8ee70ec63931d1e38567905387ab9b1d45734d81
Branch: krb5-1.10
src/kdc/do_tgs_req.c | 6 ++++--
1 files changed, 4 insertions(+), 2 deletions(-)