diff options
author | tonnerre <tonnerre> | 2008-06-07 23:58:11 +0000 |
---|---|---|
committer | tonnerre <tonnerre> | 2008-06-07 23:58:11 +0000 |
commit | 42d8787ec3927302c6a2e688a5a1fcbd3722f622 (patch) | |
tree | 45020b82d215b06a1598999dbcdc6b86be973918 /security | |
parent | b9ab415612a77ce56b570be7b42325038fa811ce (diff) | |
download | pkgsrc-42d8787ec3927302c6a2e688a5a1fcbd3722f622.tar.gz |
Add more patches, now for MITKRB5-SA-2007-006, MITKRB5-SA-2008-001 and
MITKRB5-SA-2008-002. Bump PKGREVISION now finally.
Diffstat (limited to 'security')
-rw-r--r-- | security/mit-krb5/Makefile | 4 | ||||
-rw-r--r-- | security/mit-krb5/distinfo | 9 | ||||
-rw-r--r-- | security/mit-krb5/patches/patch-at | 30 | ||||
-rw-r--r-- | security/mit-krb5/patches/patch-bh | 28 | ||||
-rw-r--r-- | security/mit-krb5/patches/patch-bi | 51 | ||||
-rw-r--r-- | security/mit-krb5/patches/patch-bj | 13 | ||||
-rw-r--r-- | security/mit-krb5/patches/patch-bk | 283 | ||||
-rw-r--r-- | security/mit-krb5/patches/patch-bl | 13 |
8 files changed, 421 insertions, 10 deletions
diff --git a/security/mit-krb5/Makefile b/security/mit-krb5/Makefile index 79c57e7f993..b44dd815e6b 100644 --- a/security/mit-krb5/Makefile +++ b/security/mit-krb5/Makefile @@ -1,8 +1,8 @@ -# $NetBSD: Makefile,v 1.42 2008/06/07 18:36:06 tonnerre Exp $ +# $NetBSD: Makefile,v 1.43 2008/06/07 23:58:11 tonnerre Exp $ DISTNAME= krb5-1.4.2 PKGNAME= mit-${DISTNAME:S/-signed$//} -PKGREVISION= 5 +PKGREVISION= 6 CATEGORIES= security MASTER_SITES= http://web.mit.edu/kerberos/dist/krb5/1.4/ DISTFILES= ${DISTNAME}-signed${EXTRACT_SUFX} diff --git a/security/mit-krb5/distinfo b/security/mit-krb5/distinfo index 713c57106b6..e2939cb3755 100644 --- a/security/mit-krb5/distinfo +++ b/security/mit-krb5/distinfo @@ -1,4 +1,4 @@ -$NetBSD: distinfo,v 1.19 2008/06/07 22:26:10 tonnerre Exp $ +$NetBSD: distinfo,v 1.20 2008/06/07 23:58:11 tonnerre Exp $ SHA1 (krb5-1.4.2-signed.tar) = bbc03bd319d539fb9523c2545d80ba0784522e88 RMD160 (krb5-1.4.2-signed.tar) = 44500f5fab8e5959cf43f17f5f52f68e2dc73a1f @@ -22,7 +22,7 @@ SHA1 (patch-ap) = c77a8f7bc35aa184e510bac576c12f55d5cfbf65 SHA1 (patch-aq) = 52429b712ca7a478caeb76fd165585c7aab7fa02 SHA1 (patch-ar) = 37807c14f03533aef8796ac90e5fac36ff98308a SHA1 (patch-as) = b155219fd512b59f698497af1bf6acf1ca4f4a34 -SHA1 (patch-at) = df0605b0f5fbaef6b7540f87079ae64b2acc464c +SHA1 (patch-at) = f5837580b496c454a35a3d8b955e5209074c267d SHA1 (patch-au) = 238f497afd9ad129babc0b6c727eb23e9915536c SHA1 (patch-av) = db0fce68f58307be4c359758f2c9b31d62ab8348 SHA1 (patch-aw) = 0e651b675d166e71f6543cbad8e29eece89d5b67 @@ -36,3 +36,8 @@ SHA1 (patch-bd) = 8cf0425d2fedea452f80fa599f3c4515e51d834c SHA1 (patch-be) = c4497d7b68cefd8109d615c2125d9dc7aa508e5d SHA1 (patch-bf) = 1e16b6cbe51a5aa07ac7c7c3c343e82bf16dcde6 SHA1 (patch-bg) = fa70e00a2eb283782c9960a2c74a879862b979c5 +SHA1 (patch-bh) = 761ca395732d3f3eac0bc1fdbec0ad65aeea8df0 +SHA1 (patch-bi) = ab91152460485ede492573ce379461e892196647 +SHA1 (patch-bj) = d0deae92b8b4d9ad671c98ccb3debd7a4216f646 +SHA1 (patch-bk) = 9bf37086a4e7661e8aacc2736d21f61db154263e +SHA1 (patch-bl) = d1239c8c8279680a97f7c555907ac1b4ccfca6b4 diff --git a/security/mit-krb5/patches/patch-at b/security/mit-krb5/patches/patch-at index 02e741fbcc8..a012b6a16d3 100644 --- a/security/mit-krb5/patches/patch-at +++ b/security/mit-krb5/patches/patch-at @@ -1,10 +1,28 @@ -$NetBSD: patch-at,v 1.1 2007/01/17 23:43:47 salo Exp $ - -Security fix for CVE-2006-6143. +$NetBSD: patch-at,v 1.2 2008/06/07 23:58:11 tonnerre Exp $ --- lib/rpc/svc.c.orig 2004-09-21 20:20:15.000000000 +0200 -+++ lib/rpc/svc.c 2007-01-17 21:58:10.000000000 +0100 -@@ -436,6 +436,8 @@ svc_getreqset(FDSET_TYPE *readfds) ++++ lib/rpc/svc.c +@@ -108,15 +108,17 @@ xprt_register(SVCXPRT *xprt) + if (sock < FD_SETSIZE) { + xports[sock] = xprt; + FD_SET(sock, &svc_fdset); ++ if (sock > svc_maxfd) ++ svc_maxfd = sock; + } + #else + if (sock < NOFILE) { + xports[sock] = xprt; + svc_fds |= (1 << sock); ++ if (sock > svc_maxfd) ++ svc_maxfd = sock; + } + #endif /* def FD_SETSIZE */ +- if (sock > svc_maxfd) +- svc_maxfd = sock; + } + + /* +@@ -436,6 +438,8 @@ svc_getreqset(FDSET_TYPE *readfds) #endif } @@ -13,7 +31,7 @@ Security fix for CVE-2006-6143. static void svc_do_xprt(SVCXPRT *xprt) { -@@ -517,6 +519,9 @@ svc_do_xprt(SVCXPRT *xprt) +@@ -517,6 +521,9 @@ svc_do_xprt(SVCXPRT *xprt) if ((stat = SVC_STAT(xprt)) == XPRT_DIED){ SVC_DESTROY(xprt); break; diff --git a/security/mit-krb5/patches/patch-bh b/security/mit-krb5/patches/patch-bh new file mode 100644 index 00000000000..5184077a57a --- /dev/null +++ b/security/mit-krb5/patches/patch-bh @@ -0,0 +1,28 @@ +$NetBSD: patch-bh,v 1.1 2008/06/07 23:58:11 tonnerre Exp $ + +--- lib/rpc/svc_auth_gss.c.orig 2004-09-17 23:52:11.000000000 +0200 ++++ lib/rpc/svc_auth_gss.c +@@ -355,6 +355,15 @@ svcauth_gss_validate(struct svc_req *rqs + memset(rpchdr, 0, sizeof(rpchdr)); + + /* XXX - Reconstruct RPC header for signing (from xdr_callmsg). */ ++ oa = &msg->rm_call.cb_cred; ++ if (oa->oa_length > MAX_AUTH_BYTES) ++ return (FALSE); ++ ++ /* 8 XDR units from the IXDR macro calls. */ ++ if (sizeof(rpchdr) < (8 * BYTES_PER_XDR_UNIT + ++ RNDUP(oa->oa_length))) ++ return (FALSE); ++ + buf = (int32_t *)(void *)rpchdr; + IXDR_PUT_LONG(buf, msg->rm_xid); + IXDR_PUT_ENUM(buf, msg->rm_direction); +@@ -362,7 +371,6 @@ svcauth_gss_validate(struct svc_req *rqs + IXDR_PUT_LONG(buf, msg->rm_call.cb_prog); + IXDR_PUT_LONG(buf, msg->rm_call.cb_vers); + IXDR_PUT_LONG(buf, msg->rm_call.cb_proc); +- oa = &msg->rm_call.cb_cred; + IXDR_PUT_ENUM(buf, oa->oa_flavor); + IXDR_PUT_LONG(buf, oa->oa_length); + if (oa->oa_length) { diff --git a/security/mit-krb5/patches/patch-bi b/security/mit-krb5/patches/patch-bi new file mode 100644 index 00000000000..bc1c2d9a6d9 --- /dev/null +++ b/security/mit-krb5/patches/patch-bi @@ -0,0 +1,51 @@ +$NetBSD: patch-bi,v 1.1 2008/06/07 23:58:11 tonnerre Exp $ + +--- lib/rpc/svc_tcp.c.orig 2004-09-21 20:20:16.000000000 +0200 ++++ lib/rpc/svc_tcp.c +@@ -52,6 +52,14 @@ static char sccsid[] = "@(#)svc_tcp.c 1. + extern errno; + */ + ++#ifndef FD_SETSIZE ++#ifdef NBBY ++#define NOFILE (sizeof(int) * NBBY) ++#else ++#define NOFILE (sizeof(int) * 8) ++#endif ++#endif ++ + /* + * Ops vector for TCP/IP based rpc service handle + */ +@@ -211,6 +219,20 @@ makefd_xprt( + { + register SVCXPRT *xprt; + register struct tcp_conn *cd; ++ ++#ifdef FD_SETSIZE ++ if (fd >= FD_SETSIZE) { ++ (void) fprintf(stderr, "svc_tcp: makefd_xprt: fd too high\n"); ++ xprt = NULL; ++ goto done; ++ } ++#else ++ if (fd >= NOFILE) { ++ (void) fprintf(stderr, "svc_tcp: makefd_xprt: fd too high\n"); ++ xprt = NULL; ++ goto done; ++ } ++#endif + + xprt = (SVCXPRT *)mem_alloc(sizeof(SVCXPRT)); + if (xprt == (SVCXPRT *)NULL) { +@@ -267,6 +289,10 @@ rendezvous_request( + * make a new transporter (re-uses xprt) + */ + xprt = makefd_xprt(sock, r->sendsize, r->recvsize); ++ if (xprt == NULL) { ++ close(sock); ++ return (FALSE); ++ } + xprt->xp_raddr = addr; + xprt->xp_addrlen = len; + xprt->xp_laddr = laddr; diff --git a/security/mit-krb5/patches/patch-bj b/security/mit-krb5/patches/patch-bj new file mode 100644 index 00000000000..f9f90dea606 --- /dev/null +++ b/security/mit-krb5/patches/patch-bj @@ -0,0 +1,13 @@ +$NetBSD: patch-bj,v 1.1 2008/06/07 23:58:11 tonnerre Exp $ + +--- kdc/dispatch.c.orig 2002-09-11 05:59:26.000000000 +0200 ++++ kdc/dispatch.c +@@ -108,7 +108,7 @@ dispatch(krb5_data *pkt, const krb5_full + retval = KRB5KRB_AP_ERR_MSG_TYPE; + #ifndef NOCACHE + /* put the response into the lookaside buffer */ +- if (!retval) ++ if (!retval && *response != NULL) + kdc_insert_lookaside(pkt, from, *response); + #endif + diff --git a/security/mit-krb5/patches/patch-bk b/security/mit-krb5/patches/patch-bk new file mode 100644 index 00000000000..29e7feef1c9 --- /dev/null +++ b/security/mit-krb5/patches/patch-bk @@ -0,0 +1,283 @@ +$NetBSD: patch-bk,v 1.1 2008/06/07 23:58:11 tonnerre Exp $ + +--- kdc/kerberos_v4.c.orig 2004-07-24 02:40:18.000000000 +0200 ++++ kdc/kerberos_v4.c +@@ -86,11 +86,6 @@ extern int krbONE; + #define MSB_FIRST 0 /* 68000, IBM RT/PC */ + #define LSB_FIRST 1 /* Vax, PC8086 */ + +-int f; +- +-/* XXX several files in libkdb know about this */ +-char *progname; +- + #ifndef BACKWARD_COMPAT + static Key_schedule master_key_schedule; + static C_Block master_key; +@@ -142,10 +137,8 @@ static void hang(void); + #include "com_err.h" + #include "extern.h" /* to pick up master_princ */ + +-static krb5_data *response; +- +-void kerberos_v4 (struct sockaddr_in *, KTEXT); +-void kerb_err_reply (struct sockaddr_in *, KTEXT, long, char *); ++static krb5_data *kerberos_v4 (struct sockaddr_in *, KTEXT); ++static krb5_data *kerb_err_reply (struct sockaddr_in *, KTEXT, long, char *); + static int set_tgtkey (char *, krb5_kvno, krb5_boolean); + + /* Attributes converted from V5 to V4 - internal representation */ +@@ -261,12 +254,12 @@ process_v4(const krb5_data *pkt, const k + (void) klog(L_KRB_PERR, "V4 request too long."); + return KRB5KRB_ERR_FIELD_TOOLONG; + } ++ memset( &v4_pkt, 0, sizeof(v4_pkt)); + v4_pkt.length = pkt->length; + v4_pkt.mbz = 0; + memcpy( v4_pkt.dat, pkt->data, pkt->length); + +- kerberos_v4( &client_sockaddr, &v4_pkt); +- *resp = response; ++ *resp = kerberos_v4( &client_sockaddr, &v4_pkt); + return(retval); + } + +@@ -299,19 +292,20 @@ char * v4_klog( int type, const char *fo + } + + static +-int krb4_sendto(int s, const char *msg, int len, int flags, +- const struct sockaddr *to, int to_len) ++krb5_data *make_response(const char *msg, int len) + { ++ krb5_data *response; ++ + if ( !(response = (krb5_data *) malloc( sizeof *response))) { +- return ENOMEM; ++ return 0; + } + if ( !(response->data = (char *) malloc( len))) { + krb5_free_data(kdc_context, response); +- return ENOMEM; ++ return 0; + } + response->length = len; + memcpy( response->data, msg, len); +- return( 0); ++ return response; + } + static void + hang(void) +@@ -590,7 +584,7 @@ static void str_length_check(char *str, + *cp = 0; + } + +-void ++static krb5_data * + kerberos_v4(struct sockaddr_in *client, KTEXT pkt) + { + static KTEXT_ST rpkt_st; +@@ -603,7 +597,7 @@ kerberos_v4(struct sockaddr_in *client, + KTEXT auth = &auth_st; + AUTH_DAT ad_st; + AUTH_DAT *ad = &ad_st; +- ++ krb5_data *response = 0; + + static struct in_addr client_host; + static int msg_byte_order; +@@ -641,8 +635,7 @@ kerberos_v4(struct sockaddr_in *client, + inet_ntoa(client_host)); + /* send an error reply */ + req_name_ptr = req_inst_ptr = req_realm_ptr = ""; +- kerb_err_reply(client, pkt, KERB_ERR_PKT_VER, lt); +- return; ++ return kerb_err_reply(client, pkt, KERB_ERR_PKT_VER, lt); + } + + /* check packet version */ +@@ -652,8 +645,7 @@ kerberos_v4(struct sockaddr_in *client, + KRB_PROT_VERSION, req_version, 0); + /* send an error reply */ + req_name_ptr = req_inst_ptr = req_realm_ptr = ""; +- kerb_err_reply(client, pkt, KERB_ERR_PKT_VER, lt); +- return; ++ return kerb_err_reply(client, pkt, KERB_ERR_PKT_VER, lt); + } + msg_byte_order = req_msg_type & 1; + +@@ -711,10 +703,10 @@ kerberos_v4(struct sockaddr_in *client, + + if ((i = check_princ(req_name_ptr, req_inst_ptr, 0, + &a_name_data, &k5key, 0, &ck5life))) { +- kerb_err_reply(client, pkt, i, "check_princ failed"); ++ response = kerb_err_reply(client, pkt, i, "check_princ failed"); + a_name_data.key_low = a_name_data.key_high = 0; + krb5_free_keyblock_contents(kdc_context, &k5key); +- return; ++ return response; + } + /* don't use k5key for client */ + krb5_free_keyblock_contents(kdc_context, &k5key); +@@ -726,11 +718,11 @@ kerberos_v4(struct sockaddr_in *client, + /* this does all the checking */ + if ((i = check_princ(service, instance, lifetime, + &s_name_data, &k5key, 1, &sk5life))) { +- kerb_err_reply(client, pkt, i, "check_princ failed"); ++ response = kerb_err_reply(client, pkt, i, "check_princ failed"); + a_name_data.key_high = a_name_data.key_low = 0; + s_name_data.key_high = s_name_data.key_low = 0; + krb5_free_keyblock_contents(kdc_context, &k5key); +- return; ++ return response; + } + /* Bound requested lifetime with service and user */ + v4req_end = krb_life_to_time(kerb_time.tv_sec, req_life); +@@ -801,8 +793,7 @@ kerberos_v4(struct sockaddr_in *client, + rpkt = create_auth_reply(req_name_ptr, req_inst_ptr, + req_realm_ptr, req_time_ws, 0, a_name_data.exp_date, + a_name_data.key_version, ciph); +- krb4_sendto(f, (char *) rpkt->dat, rpkt->length, 0, +- (struct sockaddr *) client, S_AD_SZ); ++ response = make_response((char *) rpkt->dat, rpkt->length); + memset(&a_name_data, 0, sizeof(a_name_data)); + memset(&s_name_data, 0, sizeof(s_name_data)); + break; +@@ -828,9 +819,8 @@ kerberos_v4(struct sockaddr_in *client, + lt = klog(L_KRB_PERR, + "APPL request with realm length too long from %s", + inet_ntoa(client_host)); +- kerb_err_reply(client, pkt, RD_AP_INCON, +- "realm length too long"); +- return; ++ return kerb_err_reply(client, pkt, RD_AP_INCON, ++ "realm length too long"); + } + + auth->length += (int) *(pkt->dat + auth->length) + +@@ -839,9 +829,8 @@ kerberos_v4(struct sockaddr_in *client, + lt = klog(L_KRB_PERR, + "APPL request with funky tkt or req_id length from %s", + inet_ntoa(client_host)); +- kerb_err_reply(client, pkt, RD_AP_INCON, +- "funky tkt or req_id length"); +- return; ++ return kerb_err_reply(client, pkt, RD_AP_INCON, ++ "funky tkt or req_id length"); + } + + memcpy(auth->dat, pkt->dat, auth->length); +@@ -852,18 +841,16 @@ kerberos_v4(struct sockaddr_in *client, + if ((!allow_v4_crossrealm)&&strcmp(tktrlm, local_realm) != 0) { + lt = klog(L_ERR_UNK, + "Cross realm ticket from %s denied by policy,", tktrlm); +- kerb_err_reply(client, pkt, +- KERB_ERR_PRINCIPAL_UNKNOWN, lt); +- return; ++ return kerb_err_reply(client, pkt, ++ KERB_ERR_PRINCIPAL_UNKNOWN, lt); + } + if (set_tgtkey(tktrlm, kvno, 0)) { +- lt = klog(L_ERR_UNK, ++ lt = klog(L_ERR_UNK, + "FAILED set_tgtkey realm %s, kvno %d. Host: %s ", + tktrlm, kvno, inet_ntoa(client_host)); + /* no better error code */ +- kerb_err_reply(client, pkt, +- KERB_ERR_PRINCIPAL_UNKNOWN, lt); +- return; ++ return kerb_err_reply(client, pkt, ++ KERB_ERR_PRINCIPAL_UNKNOWN, lt); + } + kerno = krb_rd_req(auth, "krbtgt", tktrlm, client_host.s_addr, + ad, 0); +@@ -873,9 +860,8 @@ kerberos_v4(struct sockaddr_in *client, + "FAILED 3des set_tgtkey realm %s, kvno %d. Host: %s ", + tktrlm, kvno, inet_ntoa(client_host)); + /* no better error code */ +- kerb_err_reply(client, pkt, +- KERB_ERR_PRINCIPAL_UNKNOWN, lt); +- return; ++ return kerb_err_reply(client, pkt, ++ KERB_ERR_PRINCIPAL_UNKNOWN, lt); + } + kerno = krb_rd_req(auth, "krbtgt", tktrlm, client_host.s_addr, + ad, 0); +@@ -885,8 +871,7 @@ kerberos_v4(struct sockaddr_in *client, + klog(L_ERR_UNK, "FAILED krb_rd_req from %s: %s", + inet_ntoa(client_host), krb_get_err_text(kerno)); + req_name_ptr = req_inst_ptr = req_realm_ptr = ""; +- kerb_err_reply(client, pkt, kerno, "krb_rd_req failed"); +- return; ++ return kerb_err_reply(client, pkt, kerno, "krb_rd_req failed"); + } + ptr = (char *) pkt->dat + auth->length; + +@@ -908,22 +893,20 @@ kerberos_v4(struct sockaddr_in *client, + req_realm_ptr = ad->prealm; + + if (strcmp(ad->prealm, tktrlm)) { +- kerb_err_reply(client, pkt, KERB_ERR_PRINCIPAL_UNKNOWN, +- "Can't hop realms"); +- return; ++ return kerb_err_reply(client, pkt, KERB_ERR_PRINCIPAL_UNKNOWN, ++ "Can't hop realms"); + } + if (!strcmp(service, "changepw")) { +- kerb_err_reply(client, pkt, KERB_ERR_PRINCIPAL_UNKNOWN, +- "Can't authorize password changed based on TGT"); +- return; ++ return kerb_err_reply(client, pkt, KERB_ERR_PRINCIPAL_UNKNOWN, ++ "Can't authorize password changed based on TGT"); + } + kerno = check_princ(service, instance, req_life, + &s_name_data, &k5key, 1, &sk5life); + if (kerno) { +- kerb_err_reply(client, pkt, kerno, "check_princ failed"); ++ response = kerb_err_reply(client, pkt, kerno, "check_princ failed"); + s_name_data.key_high = s_name_data.key_low = 0; + krb5_free_keyblock_contents(kdc_context, &k5key); +- return; ++ return response; + } + /* Bound requested lifetime with service and user */ + v4endtime = krb_life_to_time((KRB4_32)ad->time_sec, ad->life); +@@ -979,8 +962,7 @@ kerberos_v4(struct sockaddr_in *client, + rpkt = create_auth_reply(ad->pname, ad->pinst, + ad->prealm, time_ws, + 0, 0, 0, ciph); +- krb4_sendto(f, (char *) rpkt->dat, rpkt->length, 0, +- (struct sockaddr *) client, S_AD_SZ); ++ response = make_response((char *) rpkt->dat, rpkt->length); + memset(&s_name_data, 0, sizeof(s_name_data)); + break; + } +@@ -1005,6 +987,8 @@ kerberos_v4(struct sockaddr_in *client, + break; + } + } ++ ++ return response; + } + + +@@ -1014,7 +998,7 @@ kerberos_v4(struct sockaddr_in *client, + * client. + */ + +-void ++static krb5_data * + kerb_err_reply(struct sockaddr_in *client, KTEXT pkt, long int err, char *string) + { + static KTEXT_ST e_pkt_st; +@@ -1025,9 +1009,7 @@ kerb_err_reply(struct sockaddr_in *clien + strncat(e_msg, string, sizeof(e_msg) - 1 - 19); + cr_err_reply(e_pkt, req_name_ptr, req_inst_ptr, req_realm_ptr, + req_time_ws, err, e_msg); +- krb4_sendto(f, (char *) e_pkt->dat, e_pkt->length, 0, +- (struct sockaddr *) client, S_AD_SZ); +- ++ return make_response((char *) e_pkt->dat, e_pkt->length); + } + + static int diff --git a/security/mit-krb5/patches/patch-bl b/security/mit-krb5/patches/patch-bl new file mode 100644 index 00000000000..18f6fd9d84c --- /dev/null +++ b/security/mit-krb5/patches/patch-bl @@ -0,0 +1,13 @@ +$NetBSD: patch-bl,v 1.1 2008/06/07 23:58:11 tonnerre Exp $ + +--- kdc/network.c.orig 2005-07-12 22:59:51.000000000 +0200 ++++ kdc/network.c +@@ -748,6 +748,8 @@ static void process_packet(struct connec + com_err(prog, retval, "while dispatching (udp)"); + return; + } ++ if (response == NULL) ++ return; + cc = sendto(port_fd, response->data, (socklen_t) response->length, 0, + (struct sockaddr *)&saddr, saddr_len); + if (cc == -1) { |