Bug#428732: [krbdev.mit.edu #5593] kadmin crashes during password changes

[Andrew Reid via RT]

On Fri, Jul 06, 2007 at 07:53:46PM -0400, Ken Raeburn wrote:
> This code path requires that the principal in question have a policy  
> dictating a minimum time before the password can be changed, and a  
> password change made before that time has elapsed.  (I should've  
> thought of that given the description of changing passwords  
> specifically in a short time.)  Andrew, does that describe your  
> situation?  If so, changing src/kadmin/server/misc.c to include  
> <time.h> could fix the problem.

  That's some nice shooting, Ken -- making the suggested change 
(adding a <time.h> include) is a fix.

  I built a new kadmind binary from the source tree for the -7etch2
version of the Debian package (with helpful instructions, thanks Russ),
and ran it on our server.  Now rapid-fire password changes get
a correct response from the server that the minimum password lifetime
has not expired, and the daemon continues to run.

  Will there be an "etch" security patch for this for amd64?  The daemon 
runs as root, so there's a potential exploit opportunity, and even if there
weren't, it's a possible DOS attack.

				-- A.
-- 
Dr. Andrew C. E. Reid, Guest Researcher 
Center for Theoretical and Computational Materials Science
National Institute of Standards and Technology, Mail Stop 8910
Gaithersburg MD 20899 USA
andrew.reid at nist.gov