Skip Menu |
 

From: tlyu@mit.edu
Subject: git commit
Download (untitled) / with headers
text/plain 1.8KiB

Fix LDAP misused policy name crash [CVE-2014-5353]

In krb5_ldap_get_password_policy_from_dn, if LDAP_SEARCH returns
successfully with no results, return KRB5_KDB_NOENTRY instead of
returning success with a zeroed-out policy object. This fixes a null
dereference when an admin attempts to use an LDAP ticket policy name
as a password policy name.

CVE-2014-5353:

In MIT krb5, when kadmind is configured to use LDAP for the KDC
database, an authenticated remote attacker can cause a NULL dereference
by attempting to use a named ticket policy object as a password policy
for a principal. The attacker needs to be authenticated as a user who
has the elevated privilege for setting password policy by adding or
modifying principals.

Queries to LDAP scoped to the krbPwdPolicy object class will correctly
not return entries of other classes, such as ticket policy objects, but
may return success with no returned elements if an object with the
requested DN exists in a different object class. In this case, the
routine to retrieve a password policy returned success with a password
policy object that consisted entirely of zeroed memory. In particular,
accesses to the policy name will dereference a NULL pointer. KDC
operation does not access the policy name field, but most kadmin
operations involving the principal with incorrect password policy
will trigger the crash.

Thanks to Patrik Kis for reporting this problem.

CVSSv2 Vector: AV:N/AC:M/Au:S/C:N/I:N/A:C/E:H/RL:OF/RC:C

[kaduk@mit.edu: CVE description and CVSS score]

(cherry picked from commit d1f707024f1d0af6e54a18885322d70fa15ec4d3)

https://github.com/krb5/krb5/commit/0a97ce4411b34e871ae503b78eedf61db27180ea
Author: Greg Hudson <ghudson@mit.edu>
Committer: Tom Yu <tlyu@mit.edu>
Commit: 0a97ce4411b34e871ae503b78eedf61db27180ea
Branch: krb5-1.12
src/plugins/kdb/ldap/libkdb_ldap/ldap_pwd_policy.c | 7 ++++---
1 files changed, 4 insertions(+), 3 deletions(-)
From: tlyu@mit.edu
Subject: git commit

Add tests for LDAP ticket/policy name misuse

(cherry picked from commit e8df0458673071e56346730fa843c83aca88631f)

https://github.com/krb5/krb5/commit/1d7c0f44dcfe4a87f82e53dd604f13c72f9f4aad
Author: Greg Hudson <ghudson@mit.edu>
Committer: Tom Yu <tlyu@mit.edu>
Commit: 1d7c0f44dcfe4a87f82e53dd604f13c72f9f4aad
Branch: krb5-1.12
src/tests/t_kdb.py | 21 +++++++++++++++++++++
1 files changed, 21 insertions(+), 0 deletions(-)