svn rev #25525: trunk/src/kdc/

[tlyu@MIT.EDU]

http://src.mit.edu/fisheye/changelog/krb5/?cs=25525
Commit By: tlyu
Log Message:
ticket: 7042
subject: SA-2011-007 KDC null pointer deref in TGS handling [CVE-2011-1530]
target_version: 1.10
tags: pullup

Fix a null pointer dereference condition that could cause a denial of
service.


Changed Files:
U   trunk/src/kdc/Makefile.in
U   trunk/src/kdc/do_tgs_req.c
A   trunk/src/kdc/t_emptytgt.py
Modified: trunk/src/kdc/Makefile.in
===================================================================
--- trunk/src/kdc/Makefile.in	2011-12-06 00:07:11 UTC (rev 25524)
+++ trunk/src/kdc/Makefile.in	2011-12-06 20:42:46 UTC (rev 25525)
@@ -71,6 +71,7 @@
 
 check-pytests::
 	$(RUNPYTEST) $(srcdir)/t_workers.py $(PYTESTFLAGS)
+	$(RUNPYTEST) $(srcdir)/t_emptytgt.py $(PYTESTFLAGS)
 
 install::
 	$(INSTALL_PROGRAM) krb5kdc ${DESTDIR}$(SERVER_BINDIR)/krb5kdc

Modified: trunk/src/kdc/do_tgs_req.c
===================================================================
--- trunk/src/kdc/do_tgs_req.c	2011-12-06 00:07:11 UTC (rev 25524)
+++ trunk/src/kdc/do_tgs_req.c	2011-12-06 20:42:46 UTC (rev 25525)
@@ -238,7 +238,8 @@
                     if (!tgs_1 || !data_eq(*server_1, *tgs_1)) {
                         errcode = find_alternate_tgs(request, &server);
                         firstpass = 0;
-                        goto tgt_again;
+                        if (errcode == 0)
+                            goto tgt_again;
                     }
                 }
                 status = "UNKNOWN_SERVER";

Added: trunk/src/kdc/t_emptytgt.py
===================================================================
--- trunk/src/kdc/t_emptytgt.py	                        (rev 0)
+++ trunk/src/kdc/t_emptytgt.py	2011-12-06 20:42:46 UTC (rev 25525)
@@ -0,0 +1,8 @@
+#!/usr/bin/python
+from k5test import *
+
+realm = K5Realm(start_kadmind=False, create_host=False)
+output = realm.run_as_client([kvno, 'krbtgt/'], expected_code=1)
+if 'not found in Kerberos database' not in output:
+    fail('TGT lookup for empty realm failed in unexpected way')
+success('Empty tgt lookup.')