diff options
author | adam <adam@pkgsrc.org> | 2013-06-16 07:22:47 +0000 |
---|---|---|
committer | adam <adam@pkgsrc.org> | 2013-06-16 07:22:47 +0000 |
commit | 9c5a2715fbca9c5291a6f2316997cfc81847b4b2 (patch) | |
tree | d7fdd911224b2f39420d857cfeaa81f911c9e9bf /security/mit-krb5 | |
parent | 36f8e4c90d033f1f2bfd76b6cc264ab6f7128133 (diff) | |
download | pkgsrc-9c5a2715fbca9c5291a6f2316997cfc81847b4b2.tar.gz |
Changes 1.10.6:
Fix a UDP ping-pong vulnerability in the kpasswd (password changing) service. [CVE-2002-2443]
Improve interoperability with some Windows native PKINIT clients.
Diffstat (limited to 'security/mit-krb5')
-rw-r--r-- | security/mit-krb5/Makefile | 5 | ||||
-rw-r--r-- | security/mit-krb5/distinfo | 9 | ||||
-rw-r--r-- | security/mit-krb5/patches/patch-kadmin_server_schpw.c | 53 |
3 files changed, 6 insertions, 61 deletions
diff --git a/security/mit-krb5/Makefile b/security/mit-krb5/Makefile index 23ccad14331..b821175e4cc 100644 --- a/security/mit-krb5/Makefile +++ b/security/mit-krb5/Makefile @@ -1,7 +1,6 @@ -# $NetBSD: Makefile,v 1.71 2013/05/31 12:41:52 wiz Exp $ +# $NetBSD: Makefile,v 1.72 2013/06/16 07:22:47 adam Exp $ -DISTNAME= krb5-1.10.5 -PKGREVISION= 2 +DISTNAME= krb5-1.10.6 PKGNAME= mit-${DISTNAME} CATEGORIES= security MASTER_SITES= http://web.mit.edu/kerberos/dist/krb5/${PKGVERSION_NOREV:R}/ diff --git a/security/mit-krb5/distinfo b/security/mit-krb5/distinfo index 6a2fbe7bfcb..73c47788896 100644 --- a/security/mit-krb5/distinfo +++ b/security/mit-krb5/distinfo @@ -1,8 +1,8 @@ -$NetBSD: distinfo,v 1.43 2013/05/13 22:42:33 tez Exp $ +$NetBSD: distinfo,v 1.44 2013/06/16 07:22:47 adam Exp $ -SHA1 (krb5-1.10.5-signed.tar) = 5c94637ee2355dc0e032abadec4ad207d0f04022 -RMD160 (krb5-1.10.5-signed.tar) = 4800d2da6cf68dacf3e116a29f443010220f3237 -Size (krb5-1.10.5-signed.tar) = 11632640 bytes +SHA1 (krb5-1.10.6-signed.tar) = e998a54d9ddf64b13e839873c7e3c7a1077c4bac +RMD160 (krb5-1.10.6-signed.tar) = ac1fb2e4096f4e8c0010678c06fd551924dbae56 +Size (krb5-1.10.6-signed.tar) = 11632640 bytes SHA1 (patch-aa) = 941848a1773dfbe51dff3134d4b8504a850a958d SHA1 (patch-ad) = b56a7218007560470179dd811c84b8c690c966ac SHA1 (patch-ae) = c7395b9de5baf6612b8787fad55dbc051a680bfd @@ -19,6 +19,5 @@ SHA1 (patch-ci) = 4e310f0a4dfe27cf94d0e63d623590691b6c5970 SHA1 (patch-cj) = 78342f649f8e9d3a3b5a4f83e65b6c46f589586b SHA1 (patch-ck) = 37bfef80329f8ae0fb35c35e70032a0040ba5591 SHA1 (patch-kadmin_dbutil_dump.c) = 4b49c116dbed9e6be4a0bf0a731c3ae82808d82e -SHA1 (patch-kadmin_server_schpw.c) = 87d849b6dcc0ad22f377e18f57d0731e642943bc SHA1 (patch-lib_krb5_asn.1_asn1buf.h) = a1e46ca9256aea4facc1d41841b1707b044a69e7 SHA1 (patch-util_k5ev_verto-k5ev.c) = 79a2be64fa4f9b0dc3a333271e8a3ff7944e5c18 diff --git a/security/mit-krb5/patches/patch-kadmin_server_schpw.c b/security/mit-krb5/patches/patch-kadmin_server_schpw.c deleted file mode 100644 index de8180355bb..00000000000 --- a/security/mit-krb5/patches/patch-kadmin_server_schpw.c +++ /dev/null @@ -1,53 +0,0 @@ -$NetBSD: patch-kadmin_server_schpw.c,v 1.1 2013/05/13 22:42:34 tez Exp $ - -The kpasswd service provided by kadmind was vulnerable to a UDP -"ping-pong" attack [CVE-2002-2443]. Don't respond to packets unless -they pass some basic validation, and don't respond to our own error -packets. - -Some authors use CVE-1999-0103 to refer to the kpasswd UDP ping-pong -attack or UDP ping-pong attacks in general, but there is discussion -leading toward narrowing the definition of CVE-1999-0103 to the echo, -chargen, or other similar built-in inetd services. - -from https://github.com/krb5/krb5/commit/cf1a0c411b2668c57c41e9c4efd15ba17b6b322c - - ---- kadmin/server/schpw.c.orig 2013-05-13 22:31:47.496049500 +0000 -+++ kadmin/server/schpw.c -@@ -52,7 +52,7 @@ process_chpw_request(krb5_context contex - ret = KRB5KRB_AP_ERR_MODIFIED; - numresult = KRB5_KPASSWD_MALFORMED; - strlcpy(strresult, "Request was truncated", sizeof(strresult)); -- goto chpwfail; -+ goto bailout; - } - - ptr = req->data; -@@ -67,7 +67,7 @@ process_chpw_request(krb5_context contex - numresult = KRB5_KPASSWD_MALFORMED; - strlcpy(strresult, "Request length was inconsistent", - sizeof(strresult)); -- goto chpwfail; -+ goto bailout; - } - - /* verify version number */ -@@ -80,7 +80,7 @@ process_chpw_request(krb5_context contex - numresult = KRB5_KPASSWD_BAD_VERSION; - snprintf(strresult, sizeof(strresult), - "Request contained unknown protocol version number %d", vno); -- goto chpwfail; -+ goto bailout; - } - - /* read, check ap-req length */ -@@ -93,7 +93,7 @@ process_chpw_request(krb5_context contex - numresult = KRB5_KPASSWD_MALFORMED; - strlcpy(strresult, "Request was truncated in AP-REQ", - sizeof(strresult)); -- goto chpwfail; -+ goto bailout; - } - - /* verify ap_req */ |