| 1 |
mueli 09/04/08 14:29:08 |
| 2 |
|
| 3 |
Added: CVE-2009-0844+CVE-2009-0847.patch |
| 4 |
CVE-2009-0846.patch |
| 5 |
Log: |
| 6 |
added mit-krb5-1.6.3-r6 - see bug #263398 |
| 7 |
(Portage version: 2.1.6.8/cvs/Linux x86_64) |
| 8 |
|
| 9 |
Revision Changes Path |
| 10 |
1.1 app-crypt/mit-krb5/files/CVE-2009-0844+CVE-2009-0847.patch |
| 11 |
|
| 12 |
file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/app-crypt/mit-krb5/files/CVE-2009-0844+CVE-2009-0847.patch?rev=1.1&view=markup |
| 13 |
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/app-crypt/mit-krb5/files/CVE-2009-0844+CVE-2009-0847.patch?rev=1.1&content-type=text/plain |
| 14 |
|
| 15 |
Index: CVE-2009-0844+CVE-2009-0847.patch |
| 16 |
=================================================================== |
| 17 |
Index: krb5-1.6.3/src/lib/gssapi/spnego/spnego_mech.c |
| 18 |
=================================================================== |
| 19 |
--- krb5-1.6.3.orig/src/lib/gssapi/spnego/spnego_mech.c |
| 20 |
+++ krb5-1.6.3/src/lib/gssapi/spnego/spnego_mech.c |
| 21 |
@@ -1815,7 +1815,8 @@ get_input_token(unsigned char **buff_in, |
| 22 |
return (NULL); |
| 23 |
|
| 24 |
input_token->length = gssint_get_der_length(buff_in, buff_length, &bytes); |
| 25 |
- if ((int)input_token->length == -1) { |
| 26 |
+ if ((int)input_token->length == -1 || |
| 27 |
+ input_token->length > buff_length) { |
| 28 |
free(input_token); |
| 29 |
return (NULL); |
| 30 |
} |
| 31 |
Index: krb5-1.6.3/src/lib/krb5/asn.1/asn1buf.c |
| 32 |
=================================================================== |
| 33 |
--- krb5-1.6.3.orig/src/lib/krb5/asn.1/asn1buf.c |
| 34 |
+++ krb5-1.6.3/src/lib/krb5/asn.1/asn1buf.c |
| 35 |
@@ -78,11 +78,11 @@ asn1_error_code asn1buf_wrap_data(asn1bu |
| 36 |
|
| 37 |
asn1_error_code asn1buf_imbed(asn1buf *subbuf, const asn1buf *buf, const unsigned int length, const int indef) |
| 38 |
{ |
| 39 |
+ if (buf->next > buf->bound + 1) return ASN1_OVERRUN; |
| 40 |
subbuf->base = subbuf->next = buf->next; |
| 41 |
if (!indef) { |
| 42 |
+ if (length > (size_t)(buf->bound + 1 - buf->next)) return ASN1_OVERRUN; |
| 43 |
subbuf->bound = subbuf->base + length - 1; |
| 44 |
- if (subbuf->bound > buf->bound) |
| 45 |
- return ASN1_OVERRUN; |
| 46 |
} else /* constructed indefinite */ |
| 47 |
subbuf->bound = buf->bound; |
| 48 |
return 0; |
| 49 |
@@ -200,6 +200,7 @@ asn1_error_code asn1buf_remove_octetstri |
| 50 |
{ |
| 51 |
int i; |
| 52 |
|
| 53 |
+ if (buf->next > buf->bound + 1) return ASN1_OVERRUN; |
| 54 |
if (len > buf->bound + 1 - buf->next) return ASN1_OVERRUN; |
| 55 |
if (len == 0) { |
| 56 |
*s = 0; |
| 57 |
@@ -218,6 +219,7 @@ asn1_error_code asn1buf_remove_charstrin |
| 58 |
{ |
| 59 |
int i; |
| 60 |
|
| 61 |
+ if (buf->next > buf->bound + 1) return ASN1_OVERRUN; |
| 62 |
if (len > buf->bound + 1 - buf->next) return ASN1_OVERRUN; |
| 63 |
if (len == 0) { |
| 64 |
*s = 0; |
| 65 |
|
| 66 |
|
| 67 |
|
| 68 |
1.1 app-crypt/mit-krb5/files/CVE-2009-0846.patch |
| 69 |
|
| 70 |
file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/app-crypt/mit-krb5/files/CVE-2009-0846.patch?rev=1.1&view=markup |
| 71 |
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/app-crypt/mit-krb5/files/CVE-2009-0846.patch?rev=1.1&content-type=text/plain |
| 72 |
|
| 73 |
Index: CVE-2009-0846.patch |
| 74 |
=================================================================== |
| 75 |
diff --git a/src/lib/krb5/asn.1/asn1_decode.c |
| 76 |
b/src/lib/krb5/asn.1/asn1_decode.c |
| 77 |
index aa4be32..5f7461d 100644 |
| 78 |
--- a/src/lib/krb5/asn.1/asn1_decode.c |
| 79 |
+++ b/src/lib/krb5/asn.1/asn1_decode.c |
| 80 |
@@ -231,6 +231,7 @@ asn1_error_code asn1_decode_generaltime(asn1buf *buf, time_t *val) |
| 81 |
|
| 82 |
if(length != 15) return ASN1_BAD_LENGTH; |
| 83 |
retval = asn1buf_remove_charstring(buf,15,&s); |
| 84 |
+ if (retval) return retval; |
| 85 |
/* Time encoding: YYYYMMDDhhmmssZ */ |
| 86 |
if(s[14] != 'Z') { |
| 87 |
free(s); |
| 88 |
diff --git a/src/tests/asn.1/krb5_decode_test.c |
| 89 |
b/src/tests/asn.1/krb5_decode_test.c |
| 90 |
index 0ff9343..1c427d1 100644 |
| 91 |
--- a/src/tests/asn.1/krb5_decode_test.c |
| 92 |
+++ b/src/tests/asn.1/krb5_decode_test.c |
| 93 |
@@ -485,5 +485,21 @@ int main(argc, argv) |
| 94 |
ktest_destroy_keyblock(&(ref.subkey)); |
| 95 |
ref.seq_number = 0; |
| 96 |
decode_run("ap_rep_enc_part","(optionals NULL)","7B 1C 30 1A A0 11 18 0F 31 39 39 34 30 36 31 30 30 36 30 33 31 37 5A A1 05 02 03 01 E2 40",decode_krb5_ap_rep_enc_part,ktest_equal_ap_rep_enc_part,krb5_free_ap_rep_enc_part); |
| 97 |
+ |
| 98 |
+ retval = krb5_data_hex_parse(&code, "7B 06 30 04 A0 11 18 0F 31 39 39 34 30 36 31 30 30 36 30 33 31 37 5A A1 05 02 03 01 E2 40"); |
| 99 |
+ if (retval) { |
| 100 |
+ com_err("krb5_decode_test", retval, "while parsing"); |
| 101 |
+ exit(1); |
| 102 |
+ } |
| 103 |
+ retval = decode_krb5_ap_rep_enc_part(&code, &var); |
| 104 |
+ if (retval != ASN1_OVERRUN) { |
| 105 |
+ printf("ERROR: "); |
| 106 |
+ } else { |
| 107 |
+ printf("OK: "); |
| 108 |
+ } |
| 109 |
+ printf("ap_rep_enc_part(optionals NULL + expect ASN1_OVERRUN for inconsistent length of timestamp)\n"); |
| 110 |
+ krb5_free_data_contents(test_context, &code); |
| 111 |
+ krb5_free_ap_rep_enc_part(test_context, var); |
| 112 |
+ |
| 113 |
ktest_empty_ap_rep_enc_part(&ref); |
| 114 |
} |
Archives