krb5-libs/1065: krb5_get_init_creds_password does not warn about password expiration

[Dan Riley]

>Number:         1065
>Category:       krb5-libs
>Synopsis:       gic_pwd does not warn about password expiration
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    krb5-unassigned
>State:          open
>Class:          sw-bug
>Submitter-Id:   unknown
>Arrival-Date:   Fri Feb 22 14:56:00 EST 2002
>Last-Modified:
>Originator:     Dan Riley
>Organization:
LNS, Cornell U.
>Release:        krb5-1.2.3
>Environment:
System: OSF1 lnscu6.lns.cornell.edu V4.0 1229 alpha
Machine: alpha
>Description:
If given a prompter krb5_get_init_creds_password is supposed to warn
the user when password expiration is near.  It does not do so if no
in_tkt_service is provided, due to a logic bug.  The code

      if (prompter &&
	  (in_tkt_service &&
	   (strcmp(in_tkt_service, "kadmin/changepw") != 0)) &&
	[...]

is, I believe, supposed to not warn only if in_tkt_service is
"kadmin/changepw".  However, if in_tkt_service is NULL, the first part
of the && fails and the entire && fails.

>How-To-Repeat:
Set a principal (or password, depending on what your kdc sets the
key expiration field to) to expire in a few hours.  Try to login
via login.krb5 or equivalent.  Note that no warning is issued.

>Fix:
The correct test is "no in_tkt_service provided or in_tkt_service
is not kadmin/changepw":

diff -ur krb5-1.2.3/src/lib/krb5/krb/gic_pwd.c krb5/lib/krb5/krb/gic_pwd.c
--- krb5-1.2.3/src/lib/krb5/krb/gic_pwd.c	Wed Jan  9 17:27:57 2002
+++ krb5/lib/krb5/krb/gic_pwd.c	Fri Dec 21 13:54:00 2001
@@ -304,11 +304,11 @@
 	 with timezones, etc. */
 
       if (prompter &&
-	  (in_tkt_service &&
+	  (!in_tkt_service ||
 	   (strcmp(in_tkt_service, "kadmin/changepw") != 0)) &&
 	  ((ret = krb5_timeofday(context, &now)) == 0) &&
 	  as_reply->enc_part2->key_exp &&
	  ((hours = ((as_reply->enc_part2->key_exp-now)/(60*60))) <= 7*24) &&
 	  (hours >= 0)) {
 	 if (hours < 1)
 	    sprintf(banner,
>Audit-Trail:
>Unformatted: