Ticket History #8458: Fix S4U2Self KDC crash when anon is restricted [CVE-2016-3120]

# Tue Jul 19 14:36:38 2016 ghudson@mit.edu (Greg Hudson) - Ticket created

From:	ghudson@mit.edu
Subject:	git commit

Download (untitled) / with headers
text/plain 780B

Fix S4U2Self KDC crash when anon is restricted

In validate_as_request(), when enforcing restrict_anonymous_to_tgt,
use client.princ instead of request->client; the latter is NULL when
validating S4U2Self requests.

CVE-2016-3120:

In MIT krb5 1.9 and later, an authenticated attacker can cause krb5kdc
to dereference a null pointer if the restrict_anonymous_to_tgt option
is set to true, by making an S4U2Self request.

CVSSv2 Vector: AV:N/AC:H/Au:S/C:N/I:N/A:C/E:H/RL:OF/RC:C

https://github.com/krb5/krb5/commit/93b4a6306a0026cf1cc31ac4bd8a49ba5d034ba7
Author: Greg Hudson <ghudson@mit.edu>
Commit: 93b4a6306a0026cf1cc31ac4bd8a49ba5d034ba7
Branch: master
src/kdc/kdc_util.c | 2 +-
src/tests/t_pkinit.py | 5 +++++
2 files changed, 6 insertions(+), 1 deletions(-)

# Tue Jul 19 14:36:38 2016 ghudson@mit.edu (Greg Hudson) - Status changed from 'new' to 'review'

# Tue Jul 19 14:36:38 2016 ghudson@mit.edu (Greg Hudson) - Target_Version 1.14-next added

# Tue Jul 19 14:36:38 2016 ghudson@mit.edu (Greg Hudson) - Target_Version 1.13-next added

# Tue Jul 19 14:36:38 2016 ghudson@mit.edu (Greg Hudson) - Requestor ghudson@mit.edu (Greg Hudson) added

# Tue Jul 19 15:03:15 2016 tlyu (Taylor Yu) - Comments added

Download (untitled) / with headers
text/plain 30B

Reported by Diogenes S. Jesus.

# Tue Jul 19 18:01:53 2016 tlyu (Taylor Yu) - Tags pullup added

# Tue Jul 19 18:45:45 2016 tlyu (Taylor Yu) - Version_Fixed 1.14.3 added

# Tue Jul 19 18:45:45 2016 tlyu (Taylor Yu) - Correspondence added

From:	tlyu@mit.edu
Subject:	git commit

Download (untitled) / with headers
text/plain 886B

Fix S4U2Self KDC crash when anon is restricted

In validate_as_request(), when enforcing restrict_anonymous_to_tgt,
use client.princ instead of request->client; the latter is NULL when
validating S4U2Self requests.

CVE-2016-3120:

In MIT krb5 1.9 and later, an authenticated attacker can cause krb5kdc
to dereference a null pointer if the restrict_anonymous_to_tgt option
is set to true, by making an S4U2Self request.

CVSSv2 Vector: AV:N/AC:H/Au:S/C:N/I:N/A:C/E:H/RL:OF/RC:C

(cherry picked from commit 93b4a6306a0026cf1cc31ac4bd8a49ba5d034ba7)

https://github.com/krb5/krb5/commit/85c3046d42eeb821967ad5625fcb08e8c6177b1a
Author: Greg Hudson <ghudson@mit.edu>
Committer: Tom Yu <tlyu@mit.edu>
Commit: 85c3046d42eeb821967ad5625fcb08e8c6177b1a
Branch: krb5-1.14
src/kdc/kdc_util.c | 2 +-
src/tests/t_pkinit.py | 5 +++++
2 files changed, 6 insertions(+), 1 deletions(-)

# Tue Jul 19 21:30:24 2016 tlyu (Taylor Yu) - Subject changed from 'Fix S4U2Self KDC crash when anon is restricted' to 'Fix S4U2Self KDC crash when anon is restricted [CVE-2016-3120]'

# Fri Jul 22 16:04:15 2016 tlyu (Taylor Yu) - Version_Fixed 1.13.6 added

# Fri Jul 22 16:04:15 2016 tlyu (Taylor Yu) - Correspondence added

From:	tlyu@mit.edu
Subject:	git commit

Download (untitled) / with headers
text/plain 915B

Fix S4U2Self KDC crash when anon is restricted

In validate_as_request(), when enforcing restrict_anonymous_to_tgt,
use client.princ instead of request->client; the latter is NULL when
validating S4U2Self requests.

CVE-2016-3120:

In MIT krb5 1.9 and later, an authenticated attacker can cause krb5kdc
to dereference a null pointer if the restrict_anonymous_to_tgt option
is set to true, by making an S4U2Self request.

CVSSv2 Vector: AV:N/AC:H/Au:S/C:N/I:N/A:C/E:H/RL:OF/RC:C

(cherry picked from commit 93b4a6306a0026cf1cc31ac4bd8a49ba5d034ba7)
[tlyu@mit.edu: removed test case depending on absent functionality]

https://github.com/krb5/krb5/commit/cce19103f7673edb54b1b8e5fa0a516bd009d2c3
Author: Greg Hudson <ghudson@mit.edu>
Committer: Tom Yu <tlyu@mit.edu>
Commit: cce19103f7673edb54b1b8e5fa0a516bd009d2c3
Branch: krb5-1.13
src/kdc/kdc_util.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)

# Fri Jul 22 16:04:53 2016 tlyu (Taylor Yu) - Status changed from 'review' to 'resolved'

# Fri Jul 22 16:04:53 2016 tlyu (Taylor Yu) - CustomField pullup deleted