Search
SailfishOS Open Build Service
>
Projects
>
home:kontio
:
nfs
>
krb5
> krb5-1.7.1-CVE-2010-1323.patch
Log In
Username
Password
Cancel
Overview
Repositories
Revisions
Requests
Users
Advanced
Attributes
Meta
File krb5-1.7.1-CVE-2010-1323.patch of Package krb5
Index: krb5-1.7/src/plugins/preauth/pkinit/pkinit_srv.c =================================================================== --- krb5-1.7/src/plugins/preauth/pkinit/pkinit_srv.c (revision 24455) +++ krb5-1.7/src/plugins/preauth/pkinit/pkinit_srv.c (working copy) @@ -664,8 +664,7 @@ krb5_reply_key_pack *key_pack = NULL; krb5_reply_key_pack_draft9 *key_pack9 = NULL; krb5_data *encoded_key_pack = NULL; - unsigned int num_types; - krb5_cksumtype *cksum_types = NULL; + krb5_cksumtype cksum_type; pkinit_kdc_context plgctx; pkinit_kdc_req_context reqctx; @@ -851,14 +850,24 @@ retval = ENOMEM; goto cleanup; } - /* retrieve checksums for a given enctype of the reply key */ - retval = krb5_c_keyed_checksum_types(context, - encrypting_key->enctype, &num_types, &cksum_types); - if (retval) - goto cleanup; + switch (encrypting_key->enctype) { + case ENCTYPE_DES_CBC_MD4: + cksum_type = CKSUMTYPE_RSA_MD4_DES; + break; + case ENCTYPE_DES_CBC_MD5: + case ENCTYPE_DES_CBC_CRC: + cksum_type = CKSUMTYPE_RSA_MD5_DES; + break; + default: + retval = krb5int_c_mandatory_cksumtype(context, + encrypting_key->enctype, + &cksum_type); + if (retval) + goto cleanup; + break; + } - /* pick the first of acceptable enctypes for the checksum */ - retval = krb5_c_make_checksum(context, cksum_types[0], + retval = krb5_c_make_checksum(context, cksum_type, encrypting_key, KRB5_KEYUSAGE_TGS_REQ_AUTH_CKSUM, req_pkt, &key_pack->asChecksum); if (retval) { @@ -1006,8 +1015,6 @@ free(dh_pubkey); if (server_key != NULL) free(server_key); - if (cksum_types != NULL) - free(cksum_types); switch ((int)padata->pa_type) { case KRB5_PADATA_PK_AS_REQ: Index: krb5-1.7/src/lib/crypto/keyed_checksum_types.c =================================================================== --- krb5-1.7/src/lib/crypto/keyed_checksum_types.c (revision 24455) +++ krb5-1.7/src/lib/crypto/keyed_checksum_types.c (working copy) @@ -51,6 +51,16 @@ { unsigned int i, c; + if (enctype == ENCTYPE_ARCFOUR_HMAC || + enctype == ENCTYPE_ARCFOUR_HMAC_EXP) { + *count = 2; + if ((*cksumtypes = malloc(2*sizeof(krb5_cksumtype))) == NULL) + return(ENOMEM); + (*cksumtypes)[0] = CKSUMTYPE_HMAC_MD5_ARCFOUR; + (*cksumtypes)[1] = CKSUMTYPE_MD5_HMAC_ARCFOUR; + return(0); + } + c = 0; for (i=0; i<krb5_cksumtypes_length; i++) { if ((krb5_cksumtypes_list[i].keyhash && Index: krb5-1.7/src/lib/crypto/dk/derive.c =================================================================== --- krb5-1.7/src/lib/crypto/dk/derive.c (revision 24455) +++ krb5-1.7/src/lib/crypto/dk/derive.c (working copy) @@ -40,6 +40,8 @@ keybytes = enc->keybytes; keylength = enc->keylength; + if (blocksize == 1) + return(KRB5_BAD_ENCTYPE); if ((inkey->length != keylength) || (outkey->length != keylength)) return(KRB5_CRYPTO_INTERNAL); Index: krb5-1.7/src/lib/gssapi/krb5/util_crypt.c =================================================================== --- krb5-1.7/src/lib/gssapi/krb5/util_crypt.c (revision 24455) +++ krb5-1.7/src/lib/gssapi/krb5/util_crypt.c (working copy) @@ -109,10 +109,22 @@ if (code != 0) return code; - code = (*kaccess.krb5int_c_mandatory_cksumtype)(context, subkey->enctype, - cksumtype); - if (code != 0) - return code; + switch (subkey->enctype) { + case ENCTYPE_DES_CBC_MD4: + *cksumtype = CKSUMTYPE_RSA_MD4_DES; + break; + case ENCTYPE_DES_CBC_MD5: + case ENCTYPE_DES_CBC_CRC: + *cksumtype = CKSUMTYPE_RSA_MD5_DES; + break; + default: + code = (*kaccess.krb5int_c_mandatory_cksumtype)(context, + subkey->enctype, + cksumtype); + if (code != 0) + return code; + break; + } switch (subkey->enctype) { case ENCTYPE_DES_CBC_MD5: Index: krb5-1.7/src/lib/krb5/krb/pac.c =================================================================== --- krb5-1.7/src/lib/krb5/krb/pac.c (revision 24455) +++ krb5-1.7/src/lib/krb5/krb/pac.c (working copy) @@ -524,6 +524,8 @@ checksum.checksum_type = load_32_le(p); checksum.length = checksum_data.length - PAC_SIGNATURE_DATA_LENGTH; checksum.contents = p + PAC_SIGNATURE_DATA_LENGTH; + if (!krb5_c_is_keyed_cksum(checksum.checksum_type)) + return KRB5KRB_AP_ERR_INAPP_CKSUM; pac_data.length = pac->data.length; pac_data.data = malloc(pac->data.length); Index: krb5-1.7/src/lib/krb5/krb/preauth2.c =================================================================== --- krb5-1.7/src/lib/krb5/krb/preauth2.c (revision 24455) +++ krb5-1.7/src/lib/krb5/krb/preauth2.c (working copy) @@ -1579,7 +1579,9 @@ cksum = sc2->sam_cksum; - while (*cksum) { + for (; *cksum; cksum++) { + if (!krb5_c_is_keyed_cksum((*cksum)->checksum_type)) + continue; /* Check this cksum */ retval = krb5_c_verify_checksum(context, as_key, KRB5_KEYUSAGE_PA_SAM_CHALLENGE_CKSUM, @@ -1593,7 +1595,6 @@ } if (valid_cksum) break; - cksum++; } if (!valid_cksum) { Index: krb5-1.7/src/lib/krb5/krb/mk_safe.c =================================================================== --- krb5-1.7/src/lib/krb5/krb/mk_safe.c (revision 24455) +++ krb5-1.7/src/lib/krb5/krb/mk_safe.c (working copy) @@ -213,10 +213,29 @@ for (i = 0; i < nsumtypes; i++) if (auth_context->safe_cksumtype == sumtypes[i]) break; - if (i == nsumtypes) - i = 0; - sumtype = sumtypes[i]; krb5_free_cksumtypes (context, sumtypes); + if (i < nsumtypes) + sumtype = auth_context->safe_cksumtype; + else { + switch (keyblock->enctype) { + case ENCTYPE_DES_CBC_MD4: + sumtype = CKSUMTYPE_RSA_MD4_DES; + break; + case ENCTYPE_DES_CBC_MD5: + case ENCTYPE_DES_CBC_CRC: + sumtype = CKSUMTYPE_RSA_MD5_DES; + break; + default: + retval = krb5int_c_mandatory_cksumtype(context, + keyblock->enctype, + &sumtype); + if (retval) { + CLEANUP_DONE(); + goto error; + } + break; + } + } } if ((retval = krb5_mk_safe_basic(context, userdata, keyblock, &replaydata, plocal_fulladdr, premote_fulladdr,
