summaryrefslogtreecommitdiff
path: root/security
diff options
context:
space:
mode:
Diffstat (limited to 'security')
-rw-r--r--security/mit-krb5/Makefile4
-rw-r--r--security/mit-krb5/distinfo5
-rw-r--r--security/mit-krb5/patches/patch-2015-001-patch-r110312
-rw-r--r--security/mit-krb5/patches/patch-CVE-2014-535329
-rw-r--r--security/mit-krb5/patches/patch-CVE-2014-535553
5 files changed, 400 insertions, 3 deletions
diff --git a/security/mit-krb5/Makefile b/security/mit-krb5/Makefile
index 61a45bb4e12..8d9230ef6dd 100644
--- a/security/mit-krb5/Makefile
+++ b/security/mit-krb5/Makefile
@@ -1,8 +1,8 @@
-# $NetBSD: Makefile,v 1.77 2014/11/25 23:40:49 tez Exp $
+# $NetBSD: Makefile,v 1.78 2015/02/25 22:28:58 tez Exp $
DISTNAME= krb5-1.10.7
PKGNAME= mit-${DISTNAME}
-PKGREVISION= 4
+PKGREVISION= 5
CATEGORIES= security
MASTER_SITES= http://web.mit.edu/kerberos/dist/krb5/${PKGVERSION_NOREV:R}/
EXTRACT_SUFX= .tar
diff --git a/security/mit-krb5/distinfo b/security/mit-krb5/distinfo
index abeb8602a2c..e930913c19c 100644
--- a/security/mit-krb5/distinfo
+++ b/security/mit-krb5/distinfo
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.49 2014/11/25 23:40:49 tez Exp $
+$NetBSD: distinfo,v 1.50 2015/02/25 22:28:58 tez Exp $
SHA1 (2014-001-patch.txt) = 919402bf3b7c289e847e9adc03a7c30f26966769
RMD160 (2014-001-patch.txt) = a39c8e12e79ab273d562b04c1e7811c414dd70e8
@@ -6,10 +6,13 @@ Size (2014-001-patch.txt) = 592 bytes
SHA1 (krb5-1.10.7-signed.tar) = 982087d617d0b038676bbe8030047421683d508b
RMD160 (krb5-1.10.7-signed.tar) = 16e3a2cdeb410d84d055431679eb81851ae685e9
Size (krb5-1.10.7-signed.tar) = 11632640 bytes
+SHA1 (patch-2015-001-patch-r110) = 17343091958096cfb45caae490018e60c79430cf
SHA1 (patch-CVE-2014-4341) = 97b316fb3c5dfc626827a13baa5dcf623d67da3c
SHA1 (patch-CVE-2014-4343) = e7d4604d81671f71c9cd9461b65a9e87b5982baa
SHA1 (patch-CVE-2014-4344) = b7ae530beaffcf1c095e6f94bdf608b7a140b064
SHA1 (patch-CVE-2014-5351) = 2948e2a9f7adb97b8cb70bb8f0043c45e5822465
+SHA1 (patch-CVE-2014-5353) = 93217bb5f249b153b8dcb0be07a565ee8cca879a
+SHA1 (patch-CVE-2014-5355) = de4f540d079b88fcf2e0ecdc504d977d47d628ab
SHA1 (patch-aa) = 941848a1773dfbe51dff3134d4b8504a850a958d
SHA1 (patch-ad) = b56a7218007560470179dd811c84b8c690c966ac
SHA1 (patch-ae) = c7395b9de5baf6612b8787fad55dbc051a680bfd
diff --git a/security/mit-krb5/patches/patch-2015-001-patch-r110 b/security/mit-krb5/patches/patch-2015-001-patch-r110
new file mode 100644
index 00000000000..072f58df850
--- /dev/null
+++ b/security/mit-krb5/patches/patch-2015-001-patch-r110
@@ -0,0 +1,312 @@
+$NetBSD: patch-2015-001-patch-r110,v 1.1 2015/02/25 22:28:58 tez Exp $
+
+Patch for MITKRB5-SA-2015-001.txt backported
+based on http://web.mit.edu/kerberos/advisories/2015-001-patch-r111.txt
+Fixes:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5352
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9421
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9422
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9423
+
+
+--- ./kadmin/server/kadm_rpc_svc.c.orig 2015-02-25 19:03:47.134238800 +0000
++++ ./kadmin/server/kadm_rpc_svc.c
+@@ -4,7 +4,7 @@
+ *
+ */
+
+-#include <k5-platform.h>
++#include <k5-int.h>
+ #include <gssrpc/rpc.h>
+ #include <gssapi/gssapi_krb5.h> /* for gss_nt_krb5_name */
+ #include <syslog.h>
+@@ -301,14 +301,8 @@ check_rpcsec_auth(struct svc_req *rqstp)
+ c1 = krb5_princ_component(kctx, princ, 0);
+ c2 = krb5_princ_component(kctx, princ, 1);
+ realm = krb5_princ_realm(kctx, princ);
+- if (strncmp(handle->params.realm, realm->data, realm->length) == 0
+- && strncmp("kadmin", c1->data, c1->length) == 0) {
+-
+- if (strncmp("history", c2->data, c2->length) == 0)
+- goto fail_princ;
+- else
+- success = 1;
+- }
++ success = data_eq_string(*realm, handle->params.realm) &&
++ data_eq_string(*c1, "kadmin") && !data_eq_string(*c2, "history");
+
+ fail_princ:
+ if (!success) {
+
+--- ./lib/gssapi/krb5/context_time.c.orig 2015-02-25 19:49:12.558472400 +0000
++++ ./lib/gssapi/krb5/context_time.c
+@@ -40,7 +40,7 @@ krb5_gss_context_time(minor_status, cont
+
+ ctx = (krb5_gss_ctx_id_rec *) context_handle;
+
+- if (! ctx->established) {
++ if (ctx->terminated || !ctx->established) {
+ *minor_status = KG_CTX_INCOMPLETE;
+ return(GSS_S_NO_CONTEXT);
+ }
+
+--- ./lib/gssapi/krb5/export_sec_context.c.orig 2015-02-25 20:12:11.511021400 +0000
++++ ./lib/gssapi/krb5/export_sec_context.c
+@@ -45,6 +45,11 @@ krb5_gss_export_sec_context(minor_status
+ *minor_status = 0;
+
+ ctx = (krb5_gss_ctx_id_t) *context_handle;
++ if (ctx->terminated) {
++ *minor_status = KG_CTX_INCOMPLETE;
++ return (GSS_S_NO_CONTEXT);
++ }
++
+ context = ctx->k5_context;
+ kret = krb5_gss_ser_init(context);
+ if (kret)
+
+--- ./lib/gssapi/krb5/gssapiP_krb5.h.orig 2015-02-25 20:13:50.580912000 +0000
++++ ./lib/gssapi/krb5/gssapiP_krb5.h
+@@ -202,6 +202,7 @@ typedef struct _krb5_gss_ctx_id_rec {
+ unsigned int big_endian : 1;
+ unsigned int have_acceptor_subkey : 1;
+ unsigned int seed_init : 1; /* XXX tested but never actually set */
++ unsigned int terminated : 1;
+ OM_uint32 gss_flags;
+ unsigned char seed[16];
+ krb5_gss_name_t here;
+
+--- ./lib/gssapi/krb5/gssapi_krb5.c.orig 2015-02-25 20:15:28.221874100 +0000
++++ ./lib/gssapi/krb5/gssapi_krb5.c
+@@ -369,7 +369,7 @@ krb5_gss_inquire_sec_context_by_oid (OM_
+
+ ctx = (krb5_gss_ctx_id_rec *) context_handle;
+
+- if (!ctx->established)
++ if (ctx->terminated || !ctx->established)
+ return GSS_S_NO_CONTEXT;
+
+ for (i = 0; i < sizeof(krb5_gss_inquire_sec_context_by_oid_ops)/
+
+--- ./lib/gssapi/krb5/inq_context.c.orig 2015-02-25 20:17:05.258340000 +0000
++++ ./lib/gssapi/krb5/inq_context.c
+@@ -105,7 +105,7 @@ krb5_gss_inquire_context(minor_status, c
+
+ ctx = (krb5_gss_ctx_id_rec *) context_handle;
+
+- if (! ctx->established) {
++ if (ctx->terminated || !ctx->established) {
+ *minor_status = KG_CTX_INCOMPLETE;
+ return(GSS_S_NO_CONTEXT);
+ }
+
+--- ./lib/gssapi/krb5/k5seal.c.orig 2015-02-25 20:18:07.402899400 +0000
++++ ./lib/gssapi/krb5/k5seal.c
+@@ -347,7 +347,7 @@ kg_seal(minor_status, context_handle, co
+
+ ctx = (krb5_gss_ctx_id_rec *) context_handle;
+
+- if (! ctx->established) {
++ if (ctx->terminated || !ctx->established) {
+ *minor_status = KG_CTX_INCOMPLETE;
+ return(GSS_S_NO_CONTEXT);
+ }
+
+--- ./lib/gssapi/krb5/k5sealiov.c.orig 2015-02-25 20:19:26.092234800 +0000
++++ ./lib/gssapi/krb5/k5sealiov.c
+@@ -285,7 +285,7 @@ kg_seal_iov(OM_uint32 *minor_status,
+ }
+
+ ctx = (krb5_gss_ctx_id_rec *)context_handle;
+- if (!ctx->established) {
++ if (ctx->terminated || !ctx->established) {
+ *minor_status = KG_CTX_INCOMPLETE;
+ return GSS_S_NO_CONTEXT;
+ }
+
+--- ./lib/gssapi/krb5/k5unseal.c.orig 2013-11-06 20:52:23.000000000 +0000
++++ ./lib/gssapi/krb5/k5unseal.c
+@@ -487,7 +487,7 @@ kg_unseal(minor_status, context_handle,
+
+ ctx = (krb5_gss_ctx_id_rec *) context_handle;
+
+- if (! ctx->established) {
++ if (ctx->terminated || !ctx->established) {
+ *minor_status = KG_CTX_INCOMPLETE;
+ return(GSS_S_NO_CONTEXT);
+ }
+
+--- ./lib/gssapi/krb5/k5unsealiov.c.orig 2013-11-06 20:52:23.000000000 +0000
++++ ./lib/gssapi/krb5/k5unsealiov.c
+@@ -628,7 +628,7 @@ kg_unseal_iov(OM_uint32 *minor_status,
+ OM_uint32 code;
+
+ ctx = (krb5_gss_ctx_id_rec *)context_handle;
+- if (!ctx->established) {
++ if (ctx->terminated || !ctx->established) {
+ *minor_status = KG_CTX_INCOMPLETE;
+ return GSS_S_NO_CONTEXT;
+ }
+
+--- ./lib/gssapi/krb5/lucid_context.c.orig 2015-02-25 20:27:11.529478500 +0000
++++ ./lib/gssapi/krb5/lucid_context.c
+@@ -75,6 +75,11 @@ gss_krb5int_export_lucid_sec_context(
+ *minor_status = 0;
+ *data_set = GSS_C_NO_BUFFER_SET;
+
++ if (ctx->terminated || !ctx->established) {
++ *minor_status = KG_CTX_INCOMPLETE;
++ return GSS_S_NO_CONTEXT;
++ }
++
+ retval = generic_gss_oid_decompose(minor_status,
+ GSS_KRB5_EXPORT_LUCID_SEC_CONTEXT_OID,
+ GSS_KRB5_EXPORT_LUCID_SEC_CONTEXT_OID_LENGTH,
+
+--- ./lib/gssapi/krb5/prf.c.orig 2015-02-25 20:28:38.970661400 +0000
++++ ./lib/gssapi/krb5/prf.c
+@@ -60,6 +60,10 @@ krb5_gss_pseudo_random(OM_uint32 *minor_
+ ns.data = NULL;
+
+ ctx = (krb5_gss_ctx_id_t)context;
++ if (ctx->terminated || !ctx->established) {
++ *minor_status = KG_CTX_INCOMPLETE;
++ return GSS_S_NO_CONTEXT;
++ }
+
+ switch (prf_key) {
+ case GSS_C_PRF_KEY_FULL:
+
+--- ./lib/gssapi/krb5/process_context_token.c.orig 2015-02-25 20:29:45.187213100 +0000
++++ ./lib/gssapi/krb5/process_context_token.c
+@@ -39,11 +39,18 @@ krb5_gss_process_context_token(minor_sta
+
+ ctx = (krb5_gss_ctx_id_t) context_handle;
+
+- if (! ctx->established) {
++ if (ctx->terminated || !ctx->established) {
+ *minor_status = KG_CTX_INCOMPLETE;
+ return(GSS_S_NO_CONTEXT);
+ }
+
++ /* We only support context deletion tokens for now, and RFC 4121 does not
++ * define a context deletion token. */
++ if (ctx->proto) {
++ *minor_status = 0;
++ return(GSS_S_DEFECTIVE_TOKEN);
++ }
++
+ /* "unseal" the token */
+
+ if (GSS_ERROR(majerr = kg_unseal(minor_status, context_handle,
+@@ -52,8 +59,8 @@ krb5_gss_process_context_token(minor_sta
+ KG_TOK_DEL_CTX)))
+ return(majerr);
+
+- /* that's it. delete the context */
+-
+- return(krb5_gss_delete_sec_context(minor_status, &context_handle,
+- GSS_C_NO_BUFFER));
++ /* Mark the context as terminated, but do not delete it (as that would
++ * leave the caller with a dangling context handle). */
++ ctx->terminated = 1;
++ return(GSS_S_COMPLETE);
+ }
+
+--- ./lib/gssapi/krb5/wrap_size_limit.c.orig 2015-02-25 20:32:00.325325300 +0000
++++ ./lib/gssapi/krb5/wrap_size_limit.c
+@@ -95,7 +95,7 @@ krb5_gss_wrap_size_limit(minor_status, c
+ }
+
+ ctx = (krb5_gss_ctx_id_rec *) context_handle;
+- if (! ctx->established) {
++ if (ctx->terminated || !ctx->established) {
+ *minor_status = KG_CTX_INCOMPLETE;
+ return(GSS_S_NO_CONTEXT);
+ }
+
+--- ./lib/kadm5/kadm_rpc_xdr.c.orig 2015-02-25 20:48:14.376390200 +0000
++++ ./lib/kadm5/kadm_rpc_xdr.c
+@@ -320,6 +320,7 @@ bool_t xdr_krb5_tl_data(XDR *xdrs, krb5_
+ free(tl);
+ tl = tl2;
+ }
++ *tl_data_head = NULL;
+ break;
+
+ case XDR_ENCODE:
+@@ -1067,6 +1068,7 @@ xdr_krb5_principal(XDR *xdrs, krb5_princ
+ case XDR_FREE:
+ if(*objp != NULL)
+ krb5_free_principal(context, *objp);
++ *objp = NULL;
+ break;
+ }
+ return TRUE;
+
+--- ./lib/rpc/auth_gssapi_misc.c.orig 2015-02-25 20:51:31.250618000 +0000
++++ ./lib/rpc/auth_gssapi_misc.c
+@@ -321,7 +321,6 @@ bool_t auth_gssapi_unwrap_data(
+ if (! (*xdr_func)(&temp_xdrs, xdr_ptr)) {
+ PRINTF(("gssapi_unwrap_data: deserializing arguments failed\n"));
+ gss_release_buffer(minor, &out_buf);
+- xdr_free(xdr_func, xdr_ptr);
+ XDR_DESTROY(&temp_xdrs);
+ return FALSE;
+ }
+
+--- ./lib/rpc/svc_auth_gss.c.orig 2015-02-25 20:52:40.715734700 +0000
++++ ./lib/rpc/svc_auth_gss.c
+@@ -68,16 +68,6 @@ extern const gss_OID_desc * const gss_me
+
+ extern SVCAUTH svc_auth_none;
+
+-/*
+- * from mit-krb5-1.2.1 mechglue/mglueP.h:
+- * Array of context IDs typed by mechanism OID
+- */
+-typedef struct gss_union_ctx_id_t {
+- gss_OID mech_type;
+- gss_ctx_id_t internal_ctx_id;
+-} gss_union_ctx_id_desc, *gss_union_ctx_id_t;
+-
+-
+ static auth_gssapi_log_badauth_func log_badauth = NULL;
+ static caddr_t log_badauth_data = NULL;
+ static auth_gssapi_log_badverf_func log_badverf = NULL;
+@@ -235,16 +225,8 @@ svcauth_gss_accept_sec_context(struct sv
+ gd->ctx = GSS_C_NO_CONTEXT;
+ goto errout;
+ }
+- /*
+- * ANDROS: krb5 mechglue returns ctx of size 8 - two pointers,
+- * one to the mechanism oid, one to the internal_ctx_id
+- */
+- if ((gr->gr_ctx.value = mem_alloc(sizeof(gss_union_ctx_id_desc))) == NULL) {
+- fprintf(stderr, "svcauth_gss_accept_context: out of memory\n");
+- goto errout;
+- }
+- memcpy(gr->gr_ctx.value, gd->ctx, sizeof(gss_union_ctx_id_desc));
+- gr->gr_ctx.length = sizeof(gss_union_ctx_id_desc);
++ gr->gr_ctx.value = "xxxx";
++ gr->gr_ctx.length = 4;
+
+ /* gr->gr_win = 0x00000005; ANDROS: for debugging linux kernel version... */
+ gr->gr_win = sizeof(gd->seqmask) * 8;
+@@ -516,8 +498,6 @@ gssrpc__svcauth_gss(struct svc_req *rqst
+
+ if (!svcauth_gss_nextverf(rqst, htonl(gr.gr_win))) {
+ gss_release_buffer(&min_stat, &gr.gr_token);
+- mem_free(gr.gr_ctx.value,
+- sizeof(gss_union_ctx_id_desc));
+ ret_freegc (AUTH_FAILED);
+ }
+ *no_dispatch = TRUE;
+@@ -527,7 +507,6 @@ gssrpc__svcauth_gss(struct svc_req *rqst
+
+ gss_release_buffer(&min_stat, &gr.gr_token);
+ gss_release_buffer(&min_stat, &gd->checksum);
+- mem_free(gr.gr_ctx.value, sizeof(gss_union_ctx_id_desc));
+ if (!call_stat)
+ ret_freegc (AUTH_FAILED);
+
diff --git a/security/mit-krb5/patches/patch-CVE-2014-5353 b/security/mit-krb5/patches/patch-CVE-2014-5353
new file mode 100644
index 00000000000..52d8e266697
--- /dev/null
+++ b/security/mit-krb5/patches/patch-CVE-2014-5353
@@ -0,0 +1,29 @@
+$NetBSD: patch-CVE-2014-5353,v 1.1 2015/02/25 22:28:58 tez Exp $
+
+Fix for CVE-2014-5353 from:
+https://github.com/krb5/krb5/commit/5fbb56c4624df9e6b0d0a80f46e5ad37eb79c6c0
+
+
+--- plugins/kdb/ldap/libkdb_ldap/ldap_pwd_policy.c.orig 2015-02-25 18:57:47.261119800 +0000
++++ plugins/kdb/ldap/libkdb_ldap/ldap_pwd_policy.c
+@@ -261,9 +261,9 @@ krb5_ldap_get_password_policy_from_dn(kr
+ #endif /**************** END IFDEF'ed OUT *******************************/
+
+ ent=ldap_first_entry(ld, result);
+- if (ent != NULL) {
+- if ((st = populate_policy(context, ld, ent, pol_name, *policy)) != 0)
+- goto cleanup;
++ if (ent == NULL) {
++ st = KRB5_KDB_NOENTRY;
++ goto cleanup;
+ #if 0 /************** Begin IFDEF'ed OUT *******************************/
+ krb5_ldap_get_value(ld, ent, "krbmaxpwdlife", &((*policy)->pw_max_life));
+ krb5_ldap_get_value(ld, ent, "krbminpwdlife", &((*policy)->pw_min_life));
+@@ -279,6 +279,7 @@ krb5_ldap_get_password_policy_from_dn(kr
+ ld);
+ #endif /**************** END IFDEF'ed OUT *******************************/
+ }
++ st = populate_policy(context, ld, ent, pol_name, *policy);
+
+ cleanup:
+ ldap_msgfree(result);
diff --git a/security/mit-krb5/patches/patch-CVE-2014-5355 b/security/mit-krb5/patches/patch-CVE-2014-5355
new file mode 100644
index 00000000000..b4bb8c4cb81
--- /dev/null
+++ b/security/mit-krb5/patches/patch-CVE-2014-5355
@@ -0,0 +1,53 @@
+$NetBSD: patch-CVE-2014-5355,v 1.1 2015/02/25 22:28:58 tez Exp $
+
+Patch for CVE-2014-5355 from:
+https://github.com/krb5/krb5/commit/102bb6ebf20f9174130c85c3b052ae104e5073ec
+
+
+--- ./appl/user_user/server.c.orig 2015-02-25 21:22:16.608302700 +0000
++++ ./appl/user_user/server.c
+@@ -113,8 +113,10 @@ int main(argc, argv)
+ }
+ #endif
+
++ /* principal name must be sent null-terminated. */
+ retval = krb5_read_message(context, (krb5_pointer) &sock, &pname_data);
+- if (retval) {
++ if (retval || pname_data.length == 0 ||
++ pname_data.data[pname_data.length - 1] != '\0') {
+ com_err ("uu-server", retval, "reading pname");
+ return 2;
+ }
+
+--- ./lib/krb5/krb/recvauth.c.orig 2015-02-25 21:24:52.754211700 +0000
++++ ./lib/krb5/krb/recvauth.c
+@@ -59,6 +59,7 @@ recvauth_common(krb5_context context,
+ krb5_rcache rcache = 0;
+ krb5_octet response;
+ krb5_data null_server;
++ krb5_data d;
+ int need_error_free = 0;
+ int local_rcache = 0, local_authcon = 0;
+
+@@ -77,7 +78,8 @@ recvauth_common(krb5_context context,
+ */
+ if ((retval = krb5_read_message(context, fd, &inbuf)))
+ return(retval);
+- if (strcmp(inbuf.data, sendauth_version)) {
++ d = make_data((char *)sendauth_version, strlen(sendauth_version) + 1);
++ if (!data_eq(inbuf, d)) {
+ problem = KRB5_SENDAUTH_BADAUTHVERS;
+ response = 1;
+ }
+@@ -93,8 +95,9 @@ recvauth_common(krb5_context context,
+ */
+ if ((retval = krb5_read_message(context, fd, &inbuf)))
+ return(retval);
+- if (appl_version && strcmp(inbuf.data, appl_version)) {
+- if (!problem) {
++ if (appl_version != NULL && !problem) {
++ d = make_data(appl_version, strlen(appl_version) + 1);
++ if (!data_eq(inbuf, d)) {
+ problem = KRB5_SENDAUTH_BADAPPLVERS;
+ response = 2;
+ }
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-16 14:13:51 +0000