Changes 1.10.6:

Fix a UDP ping-pong vulnerability in the kpasswd (password changing) service. [CVE-2002-2443]
Improve interoperability with some Windows native PKINIT clients.

3 files changed, 6 insertions, 61 deletions

diff --git a/security/mit-krb5/Makefile b/security/mit-krb5/Makefile
index 23ccad14331..b821175e4cc 100644
--- a/security/mit-krb5/Makefile
+++ b/security/mit-krb5/Makefile
@@ -1,7 +1,6 @@
-# $NetBSD: Makefile,v 1.71 2013/05/31 12:41:52 wiz Exp $
+# $NetBSD: Makefile,v 1.72 2013/06/16 07:22:47 adam Exp $
 
-DISTNAME=	krb5-1.10.5
-PKGREVISION=	2
+DISTNAME=	krb5-1.10.6
 PKGNAME=	mit-${DISTNAME}
 CATEGORIES=	security
 MASTER_SITES=	http://web.mit.edu/kerberos/dist/krb5/${PKGVERSION_NOREV:R}/
diff --git a/security/mit-krb5/distinfo b/security/mit-krb5/distinfo
index 6a2fbe7bfcb..73c47788896 100644
--- a/security/mit-krb5/distinfo
+++ b/security/mit-krb5/distinfo
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.43 2013/05/13 22:42:33 tez Exp $
+$NetBSD: distinfo,v 1.44 2013/06/16 07:22:47 adam Exp $
 
-SHA1 (krb5-1.10.5-signed.tar) = 5c94637ee2355dc0e032abadec4ad207d0f04022
-RMD160 (krb5-1.10.5-signed.tar) = 4800d2da6cf68dacf3e116a29f443010220f3237
-Size (krb5-1.10.5-signed.tar) = 11632640 bytes
+SHA1 (krb5-1.10.6-signed.tar) = e998a54d9ddf64b13e839873c7e3c7a1077c4bac
+RMD160 (krb5-1.10.6-signed.tar) = ac1fb2e4096f4e8c0010678c06fd551924dbae56
+Size (krb5-1.10.6-signed.tar) = 11632640 bytes
 SHA1 (patch-aa) = 941848a1773dfbe51dff3134d4b8504a850a958d
 SHA1 (patch-ad) = b56a7218007560470179dd811c84b8c690c966ac
 SHA1 (patch-ae) = c7395b9de5baf6612b8787fad55dbc051a680bfd
@@ -19,6 +19,5 @@ SHA1 (patch-ci) = 4e310f0a4dfe27cf94d0e63d623590691b6c5970
 SHA1 (patch-cj) = 78342f649f8e9d3a3b5a4f83e65b6c46f589586b
 SHA1 (patch-ck) = 37bfef80329f8ae0fb35c35e70032a0040ba5591
 SHA1 (patch-kadmin_dbutil_dump.c) = 4b49c116dbed9e6be4a0bf0a731c3ae82808d82e
-SHA1 (patch-kadmin_server_schpw.c) = 87d849b6dcc0ad22f377e18f57d0731e642943bc
 SHA1 (patch-lib_krb5_asn.1_asn1buf.h) = a1e46ca9256aea4facc1d41841b1707b044a69e7
 SHA1 (patch-util_k5ev_verto-k5ev.c) = 79a2be64fa4f9b0dc3a333271e8a3ff7944e5c18
diff --git a/security/mit-krb5/patches/patch-kadmin_server_schpw.c b/security/mit-krb5/patches/patch-kadmin_server_schpw.c
deleted file mode 100644
index de8180355bb..00000000000
--- a/security/mit-krb5/patches/patch-kadmin_server_schpw.c
+++ /dev/null
@@ -1,53 +0,0 @@
-$NetBSD: patch-kadmin_server_schpw.c,v 1.1 2013/05/13 22:42:34 tez Exp $
-
-The kpasswd service provided by kadmind was vulnerable to a UDP
-"ping-pong" attack [CVE-2002-2443].  Don't respond to packets unless
-they pass some basic validation, and don't respond to our own error
-packets.
-
-Some authors use CVE-1999-0103 to refer to the kpasswd UDP ping-pong
-attack or UDP ping-pong attacks in general, but there is discussion
-leading toward narrowing the definition of CVE-1999-0103 to the echo,
-chargen, or other similar built-in inetd services.
-
-from https://github.com/krb5/krb5/commit/cf1a0c411b2668c57c41e9c4efd15ba17b6b322c
-
-
---- kadmin/server/schpw.c.orig	2013-05-13 22:31:47.496049500 +0000
-+++ kadmin/server/schpw.c
-@@ -52,7 +52,7 @@ process_chpw_request(krb5_context contex
-         ret = KRB5KRB_AP_ERR_MODIFIED;
-         numresult = KRB5_KPASSWD_MALFORMED;
-         strlcpy(strresult, "Request was truncated", sizeof(strresult));
--        goto chpwfail;
-+        goto bailout;
-     }
- 
-     ptr = req->data;
-@@ -67,7 +67,7 @@ process_chpw_request(krb5_context contex
-         numresult = KRB5_KPASSWD_MALFORMED;
-         strlcpy(strresult, "Request length was inconsistent",
-                 sizeof(strresult));
--        goto chpwfail;
-+        goto bailout;
-     }
- 
-     /* verify version number */
-@@ -80,7 +80,7 @@ process_chpw_request(krb5_context contex
-         numresult = KRB5_KPASSWD_BAD_VERSION;
-         snprintf(strresult, sizeof(strresult),
-                  "Request contained unknown protocol version number %d", vno);
--        goto chpwfail;
-+        goto bailout;
-     }
- 
-     /* read, check ap-req length */
-@@ -93,7 +93,7 @@ process_chpw_request(krb5_context contex
-         numresult = KRB5_KPASSWD_MALFORMED;
-         strlcpy(strresult, "Request was truncated in AP-REQ",
-                 sizeof(strresult));
--        goto chpwfail;
-+        goto bailout;
-     }
- 
-     /* verify ap_req */