Ticket History #8383: Fix LDAP null deref on empty arg [CVE-2016-3119]

# Fri Mar 18 16:38:36 2016 ghudson@mit.edu (Greg Hudson) - Ticket created

From:	ghudson@mit.edu
Subject:	git commit

Download (untitled) / with headers
text/plain 869B

Fix LDAP null deref on empty arg [CVE-2016-3119]

In the LDAP KDB module's process_db_args(), strtok_r() may return NULL
if there is an empty string in the db_args array. Check for this case
and avoid dereferencing a null pointer.

CVE-2016-3119:

In MIT krb5 1.6 and later, an authenticated attacker with permission
to modify a principal entry can cause kadmind to dereference a null
pointer by supplying an empty DB argument to the modify_principal
command, if kadmind is configured to use the LDAP KDB module.

CVSSv2 Vector: AV:N/AC:H/Au:S/C:N/I:N/A:C/E:H/RL:OF/RC:ND

https://github.com/krb5/krb5/commit/08c642c09c38a9c6454ab43a9b53b2a89b9eef99
Author: Greg Hudson <ghudson@mit.edu>
Commit: 08c642c09c38a9c6454ab43a9b53b2a89b9eef99
Branch: master
src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)

# Fri Mar 18 16:38:36 2016 ghudson@mit.edu (Greg Hudson) - Requestor ghudson@mit.edu (Greg Hudson) added

# Fri Mar 18 16:38:36 2016 ghudson@mit.edu (Greg Hudson) - Status changed from 'new' to 'review'

# Fri Mar 18 16:38:36 2016 ghudson@mit.edu (Greg Hudson) - Tags pullup added

# Fri Mar 18 16:38:36 2016 ghudson@mit.edu (Greg Hudson) - Target_Version 1.13-next added

# Wed Mar 30 18:24:25 2016 tlyu (Taylor Yu) - Target_Version 1.14-next added

# Tue Apr 05 23:02:57 2016 tlyu (Taylor Yu) - Version_Fixed 1.14.2 added

# Tue Apr 05 23:02:57 2016 tlyu (Taylor Yu) - Correspondence added

From:	tlyu@mit.edu
Subject:	git commit

Download (untitled) / with headers
text/plain 975B

Fix LDAP null deref on empty arg [CVE-2016-3119]

In the LDAP KDB module's process_db_args(), strtok_r() may return NULL
if there is an empty string in the db_args array. Check for this case
and avoid dereferencing a null pointer.

CVE-2016-3119:

In MIT krb5 1.6 and later, an authenticated attacker with permission
to modify a principal entry can cause kadmind to dereference a null
pointer by supplying an empty DB argument to the modify_principal
command, if kadmind is configured to use the LDAP KDB module.

CVSSv2 Vector: AV:N/AC:H/Au:S/C:N/I:N/A:C/E:H/RL:OF/RC:ND

(cherry picked from commit 08c642c09c38a9c6454ab43a9b53b2a89b9eef99)

https://github.com/krb5/krb5/commit/b5abd8c4872d7a024d49439342a6643f774afb1c
Author: Greg Hudson <ghudson@mit.edu>
Committer: Tom Yu <tlyu@mit.edu>
Commit: b5abd8c4872d7a024d49439342a6643f774afb1c
Branch: krb5-1.14
src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)

# Wed Apr 06 14:07:12 2016 tlyu (Taylor Yu) - Status changed from 'review' to 'resolved'

# Wed Apr 06 14:07:12 2016 tlyu (Taylor Yu) - Version_Fixed 1.13.5 added

# Wed Apr 06 14:07:12 2016 tlyu (Taylor Yu) - CustomField pullup deleted

# Wed Apr 06 14:07:12 2016 tlyu (Taylor Yu) - Correspondence added

From:	tlyu@mit.edu
Subject:	git commit

Download (untitled) / with headers
text/plain 975B

Fix LDAP null deref on empty arg [CVE-2016-3119]

In the LDAP KDB module's process_db_args(), strtok_r() may return NULL
if there is an empty string in the db_args array. Check for this case
and avoid dereferencing a null pointer.

CVE-2016-3119:

In MIT krb5 1.6 and later, an authenticated attacker with permission
to modify a principal entry can cause kadmind to dereference a null
pointer by supplying an empty DB argument to the modify_principal
command, if kadmind is configured to use the LDAP KDB module.

CVSSv2 Vector: AV:N/AC:H/Au:S/C:N/I:N/A:C/E:H/RL:OF/RC:ND

(cherry picked from commit 08c642c09c38a9c6454ab43a9b53b2a89b9eef99)

https://github.com/krb5/krb5/commit/e4c219e8d0208fb6b3ee9037d3dc2ef1a3003c56
Author: Greg Hudson <ghudson@mit.edu>
Committer: Tom Yu <tlyu@mit.edu>
Commit: e4c219e8d0208fb6b3ee9037d3dc2ef1a3003c56
Branch: krb5-1.13
src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)