svn rev #25387: branches/krb5-1-10/src/plugins/kdb/ db2/ ldap/libkdb_ldap/

[tlyu@MIT.EDU]

http://src.mit.edu/fisheye/changelog/krb5/?cs=25387
Commit By: tlyu
Log Message:
ticket: 6981
version_fixed: 1.10
status: resolved

pull up r25368 from trunk

 ------------------------------------------------------------------------
 r25368 | tlyu | 2011-10-18 14:51:35 -0400 (Tue, 18 Oct 2011) | 8 lines

 ticket: 6981
 subject: SA-2011-006 KDC denial of service [CVE-2011-1527 CVE-2011-1528 CVE-2011-1529]
 target_version: 1.10
 tags: pullup

 Fix null pointer dereference and assertion failure conditions that
 could cause a denial of service.


Changed Files:
U   branches/krb5-1-10/src/plugins/kdb/db2/lockout.c
U   branches/krb5-1-10/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
U   branches/krb5-1-10/src/plugins/kdb/ldap/libkdb_ldap/lockout.c
Modified: branches/krb5-1-10/src/plugins/kdb/db2/lockout.c
===================================================================
--- branches/krb5-1-10/src/plugins/kdb/db2/lockout.c	2011-10-20 19:27:32 UTC (rev 25386)
+++ branches/krb5-1-10/src/plugins/kdb/db2/lockout.c	2011-10-20 19:27:38 UTC (rev 25387)
@@ -165,6 +165,9 @@
         return 0;
     }
 
+    if (entry == NULL)
+        return 0;
+
     if (!db_ctx->disable_lockout) {
         code = lookup_lockout_policy(context, entry, &max_fail,
                                      &failcnt_interval, &lockout_duration);
@@ -172,6 +175,15 @@
             return code;
     }
 
+    /*
+     * Don't continue to modify the DB for an already locked account.
+     * (In most cases, status will be KRB5KDC_ERR_CLIENT_REVOKED, and
+     * this check is unneeded, but in rare cases, we can fail with an
+     * integrity error or preauth failure before a policy check.)
+     */
+    if (locked_check_p(context, stamp, max_fail, lockout_duration, entry))
+        return 0;
+
     /* Only mark the authentication as successful if the entry
      * required preauthentication, otherwise we have no idea. */
     if (status == 0 && (entry->attributes & KRB5_KDB_REQUIRES_PRE_AUTH)) {

Modified: branches/krb5-1-10/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
===================================================================
--- branches/krb5-1-10/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c	2011-10-20 19:27:32 UTC (rev 25386)
+++ branches/krb5-1-10/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c	2011-10-20 19:27:38 UTC (rev 25387)
@@ -104,6 +104,7 @@
     CHECK_LDAP_HANDLE(ldap_context);
 
     if (is_principal_in_realm(ldap_context, searchfor) != 0) {
+        st = KRB5_KDB_NOENTRY;
         krb5_set_error_message(context, st,
                                _("Principal does not belong to realm"));
         goto cleanup;

Modified: branches/krb5-1-10/src/plugins/kdb/ldap/libkdb_ldap/lockout.c
===================================================================
--- branches/krb5-1-10/src/plugins/kdb/ldap/libkdb_ldap/lockout.c	2011-10-20 19:27:32 UTC (rev 25386)
+++ branches/krb5-1-10/src/plugins/kdb/ldap/libkdb_ldap/lockout.c	2011-10-20 19:27:38 UTC (rev 25387)
@@ -161,6 +161,9 @@
         return 0;
     }
 
+    if (entry == NULL)
+        return 0;
+
     if (!ldap_context->disable_lockout) {
         code = lookup_lockout_policy(context, entry, &max_fail,
                                      &failcnt_interval,
@@ -169,10 +172,17 @@
             return code;
     }
 
+    /*
+     * Don't continue to modify the DB for an already locked account.
+     * (In most cases, status will be KRB5KDC_ERR_CLIENT_REVOKED, and
+     * this check is unneeded, but in rare cases, we can fail with an
+     * integrity error or preauth failure before a policy check.)
+     */
+    if (locked_check_p(context, stamp, max_fail, lockout_duration, entry))
+        return 0;
+
     entry->mask = 0;
 
-    assert (!locked_check_p(context, stamp, max_fail, lockout_duration, entry));
-
     /* Only mark the authentication as successful if the entry
      * required preauthentication, otherwise we have no idea. */
     if (status == 0 && (entry->attributes & KRB5_KDB_REQUIRES_PRE_AUTH)) {