Updates for krb5-1.11.4

diff --git a/README b/README
index 9c5704da6045c01a6c4e1679a9482cdd1a2d96df..b3d53f7bbe8c043bab0afffbc598f6018e095736 100644 (file)
--- a/README
+++ b/README
@@ -77,6 +77,42 @@ from using single-DES cryptosystems.  Among these is a configuration
 variable that enables "weak" enctypes, which defaults to "false"
 beginning with krb5-1.8.
 
+Major changes in 1.11.4 (2013-11-04)
+------------------------------------
+
+* Fix a KDC null pointer dereference [CVE-2013-1417] that could affect
+  realms with an uncommon configuration.
+
+* Fix a KDC null pointer dereference [CVE-2013-1418] that could affect
+  KDCs that serve multiple realms.
+
+* Fix a number of bugs related to KDC master key rollover.
+
+krb5-1.11.4 changes by ticket ID
+--------------------------------
+
+7508    Indefinite FD polling
+7650    Issue following client referral from AD
+7664    Build with Visual Studio 2012
+7668    KDC null deref due to referrals [CVE-2013-1417]
+7670    Add test case for CVE-2013-1417
+7671    Install ccselect_plugin.h
+7702    krb5-1.11.3 FTBFS on NetBSD
+7723    Fix GSSAPI krb5 cred ccache import
+7724    Change KRB5KDC_ERR_NO_ACCEPTABLE_KDF to 100
+7726    Use protocol error for PKINIT cert expiry
+7727    Discuss cert expiry, no-key princs in PKINIT docs
+7734    Fix typos in kdb5_util master key command outputs
+7735    Use active master key in update_princ_encryption
+7737    Correctly activate master keys in pre-1.7 KDBs
+7742    Reset key-generation parameters for each enctype
+7746    Fix decoding of mkey kvno in mkey_aux tl-data
+7747    Improve LDAP KDB initialization error messages
+7748    Document master key rollover
+7752    Clarify kpropd standalone mode documentation
+7756    Multi-realm KDC null deref [CVE-2013-1418]
+7758    Fix reference for trace logging
+
 Major changes in 1.11.3 (2013-06-03)
 ------------------------------------
 
@@ -556,6 +592,7 @@ reports, suggestions, and valuable resources:
     Mark Bannister
     David Bantz
     Alex Baule
+    David Benjamin
     Adam Bernstein
     Arlene Berry
     Jeff Blaine
@@ -576,14 +613,18 @@ reports, suggestions, and valuable resources:
     Nalin Dahyabhai
     Mark Davies
     Dennis Davis
+    Alex Dehnert
     Mark Deneen
+    Günther Deschner
     Roland Dowdeswell
+    Viktor Dukhovni
     Jason Edgecombe
     Mark Eichin
     Shawn M. Emery
     Douglas E. Engert
     Peter Eriksson
     Juha Erkkilä
+    Gilles Espinasse
     Ronni Feldt
     Bill Fellows
     JC Ferguson
@@ -596,6 +637,7 @@ reports, suggestions, and valuable resources:
     Steve Grubb
     Philip Guenther
     Dominic Hargreaves
+    Robbie Harwood
     Jakob Haufe
     Matthieu Hautreux
     Paul B. Henson
@@ -619,6 +661,7 @@ reports, suggestions, and valuable resources:
     Jan iankko Lieskovsky
     Oliver Loch
     Kevin Longfellow
+    Nuno Lopes
     Ryan Lynch
     Nathaniel McCallum
     Greg McClement
@@ -648,6 +691,7 @@ reports, suggestions, and valuable resources:
     Mike Roszkowski
     Guillaume Rousse
     Tom Shaw
+    Jim Shi
     Peter Shoults
     Simo Sorce
     Michael Spang
@@ -668,6 +712,7 @@ reports, suggestions, and valuable resources:
     Simon Wilkinson
     Nicolas Williams
     Ross Wilper
+    Augustin Wolf
     Xu Qiang
     Nickolai Zeldovich
     Hanz van Zijst

diff --git a/src/man/k5identity.man b/src/man/k5identity.man
index b14fd093c462cc00b3d54acaefb95cfca57d4aa6..04baa86d6447b46fe3f21938ac7e5a4dc4c03711 100644 (file)
--- a/src/man/k5identity.man
+++ b/src/man/k5identity.man
@@ -1,4 +1,4 @@
-.TH "K5IDENTITY" "5" " " "1.11.3" "MIT Kerberos"
+.TH "K5IDENTITY" "5" " " "1.11.4" "MIT Kerberos"
 .SH NAME
 k5identity \- Kerberos V5 client principal selection rules
 .

diff --git a/src/man/k5login.man b/src/man/k5login.man
index f3c634a53c3eb5c145b18e1193ba37bee21e9153..5fd516ca775e2bfd252e6ff45d017f7ca7f08e97 100644 (file)
--- a/src/man/k5login.man
+++ b/src/man/k5login.man
@@ -1,4 +1,4 @@
-.TH "K5LOGIN" "5" " " "1.11.3" "MIT Kerberos"
+.TH "K5LOGIN" "5" " " "1.11.4" "MIT Kerberos"
 .SH NAME
 k5login \- Kerberos V5 acl file for host access
 .

diff --git a/src/man/k5srvutil.man b/src/man/k5srvutil.man
index 8845053aacf53b3431db4830fa0dce93b0840ff3..5e2c7481c7f3b0c6cec5a4267752b3aa4891accd 100644 (file)
--- a/src/man/k5srvutil.man
+++ b/src/man/k5srvutil.man
@@ -1,4 +1,4 @@
-.TH "K5SRVUTIL" "1" " " "1.11.3" "MIT Kerberos"
+.TH "K5SRVUTIL" "1" " " "1.11.4" "MIT Kerberos"
 .SH NAME
 k5srvutil \- host key table (keytab) manipulation utility
 .

diff --git a/src/man/kadm5.acl.man b/src/man/kadm5.acl.man
index 607653c804152e142563ddec6dd4b8b87123c224..570cd96ed7d1b01f2afb22da89f81689a092d185 100644 (file)
--- a/src/man/kadm5.acl.man
+++ b/src/man/kadm5.acl.man
@@ -1,4 +1,4 @@
-.TH "KADM5.ACL" "5" " " "1.11.3" "MIT Kerberos"
+.TH "KADM5.ACL" "5" " " "1.11.4" "MIT Kerberos"
 .SH NAME
 kadm5.acl \- Kerberos ACL file
 .

diff --git a/src/man/kadmin.man b/src/man/kadmin.man
index df75fae559c0f7f6a371a9c85c507f998bc8d7b7..a3f29d4d770960dc3074247318fc1a46f210fa12 100644 (file)
--- a/src/man/kadmin.man
+++ b/src/man/kadmin.man
@@ -1,4 +1,4 @@
-.TH "KADMIN" "1" " " "1.11.3" "MIT Kerberos"
+.TH "KADMIN" "1" " " "1.11.4" "MIT Kerberos"
 .SH NAME
 kadmin \- Kerberos V5 database administration program
 .

diff --git a/src/man/kadmind.man b/src/man/kadmind.man
index e348fc015a936354d2c7a203fed002f21f082553..a49acf8c72123314542067863eaa75af7c0f8fbc 100644 (file)
--- a/src/man/kadmind.man
+++ b/src/man/kadmind.man
@@ -1,4 +1,4 @@
-.TH "KADMIND" "8" " " "1.11.3" "MIT Kerberos"
+.TH "KADMIND" "8" " " "1.11.4" "MIT Kerberos"
 .SH NAME
 kadmind \- KADM5 administration server
 .

diff --git a/src/man/kdb5_ldap_util.man b/src/man/kdb5_ldap_util.man
index 6bb86978ed9f104a9d65f4060148100b5a9906f7..aec70c7183d774c19baac3da6c4a49d85c5993b4 100644 (file)
--- a/src/man/kdb5_ldap_util.man
+++ b/src/man/kdb5_ldap_util.man
@@ -1,4 +1,4 @@
-.TH "KDB5_LDAP_UTIL" "8" " " "1.11.3" "MIT Kerberos"
+.TH "KDB5_LDAP_UTIL" "8" " " "1.11.4" "MIT Kerberos"
 .SH NAME
 kdb5_ldap_util \- Kerberos configuration utility
 .

diff --git a/src/man/kdb5_util.man b/src/man/kdb5_util.man
index 8aa82413458ea9d73914b8b3e4d4baa31dc7e119..f0063d61e7bbab5670e77735786b735668bf587c 100644 (file)
--- a/src/man/kdb5_util.man
+++ b/src/man/kdb5_util.man
@@ -1,4 +1,4 @@
-.TH "KDB5_UTIL" "8" " " "1.11.3" "MIT Kerberos"
+.TH "KDB5_UTIL" "8" " " "1.11.4" "MIT Kerberos"
 .SH NAME
 kdb5_util \- Kerberos database maintenance utility
 .
@@ -349,8 +349,8 @@ gives more verbose output.
 .sp
 Update all principal records (or only those matching the
 \fIprinc\-pattern\fP glob pattern) to re\-encrypt the key data using the
-active database master key, if they are encrypted using older
-versions, and give a count at the end of the number of principals
+active database master key, if they are encrypted using a different
+version, and give a count at the end of the number of principals
 updated.  If the \fB\-f\fP option is not given, ask for confirmation
 before starting to make changes.  The \fB\-v\fP option causes each
 principal processed to be listed, with an indication as to whether it

diff --git a/src/man/kdc.conf.man b/src/man/kdc.conf.man
index d98198aa818263f43df68df1ddb323229ae42709..04e47f97179d5176b83f2a971eeb5f4a7c76c0b6 100644 (file)
--- a/src/man/kdc.conf.man
+++ b/src/man/kdc.conf.man
@@ -1,4 +1,4 @@
-.TH "KDC.CONF" "5" " " "1.11.3" "MIT Kerberos"
+.TH "KDC.CONF" "5" " " "1.11.4" "MIT Kerberos"
 .SH NAME
 kdc.conf \- Kerberos V5 KDC configuration file
 .

diff --git a/src/man/kdestroy.man b/src/man/kdestroy.man
index c647ec073952e6f4169f9468799eef1aa8b5b2ad..b4512f7168b0444d6f0b1a1373b88fea3f4411c8 100644 (file)
--- a/src/man/kdestroy.man
+++ b/src/man/kdestroy.man
@@ -1,4 +1,4 @@
-.TH "KDESTROY" "1" " " "1.11.3" "MIT Kerberos"
+.TH "KDESTROY" "1" " " "1.11.4" "MIT Kerberos"
 .SH NAME
 kdestroy \- destroy Kerberos tickets
 .

diff --git a/src/man/kinit.man b/src/man/kinit.man
index 6a8f32b76fd3a0138ba2de530e93bedc3a127fb3..fc44aacef622cf15f8f87e19bd81707823016656 100644 (file)
--- a/src/man/kinit.man
+++ b/src/man/kinit.man
@@ -1,4 +1,4 @@
-.TH "KINIT" "1" " " "1.11.3" "MIT Kerberos"
+.TH "KINIT" "1" " " "1.11.4" "MIT Kerberos"
 .SH NAME
 kinit \- obtain and cache Kerberos ticket-granting ticket
 .

diff --git a/src/man/klist.man b/src/man/klist.man
index 598c7790bbb1b16f0906482874c3bd78a9706a78..f581e674209a96135b90b09aae577d91152c556f 100644 (file)
--- a/src/man/klist.man
+++ b/src/man/klist.man
@@ -1,4 +1,4 @@
-.TH "KLIST" "1" " " "1.11.3" "MIT Kerberos"
+.TH "KLIST" "1" " " "1.11.4" "MIT Kerberos"
 .SH NAME
 klist \- list cached Kerberos tickets
 .

diff --git a/src/man/kpasswd.man b/src/man/kpasswd.man
index c890562f6f13a4e44f17992916bed05931728e8c..82e2fd8adbb98053b11203d77ab76fa1c93257e8 100644 (file)
--- a/src/man/kpasswd.man
+++ b/src/man/kpasswd.man
@@ -1,4 +1,4 @@
-.TH "KPASSWD" "1" " " "1.11.3" "MIT Kerberos"
+.TH "KPASSWD" "1" " " "1.11.4" "MIT Kerberos"
 .SH NAME
 kpasswd \- change a user's Kerberos password
 .

diff --git a/src/man/kprop.man b/src/man/kprop.man
index 389fd6121e14112b1e9ea36f140c07bf8d5a19e6..f072ff7c0e487025187ab68031ef2315ed19611b 100644 (file)
--- a/src/man/kprop.man
+++ b/src/man/kprop.man
@@ -1,4 +1,4 @@
-.TH "KPROP" "8" " " "1.11.3" "MIT Kerberos"
+.TH "KPROP" "8" " " "1.11.4" "MIT Kerberos"
 .SH NAME
 kprop \- propagate a Kerberos V5 principal database to a slave server
 .

diff --git a/src/man/kpropd.man b/src/man/kpropd.man
index a244f497a7cf544a01c6800f8a079ac25c883997..02f91bcf33751949ab0a75bb4347ce99cb6e5eb4 100644 (file)
--- a/src/man/kpropd.man
+++ b/src/man/kpropd.man
@@ -1,4 +1,4 @@
-.TH "KPROPD" "8" " " "1.11.3" "MIT Kerberos"
+.TH "KPROPD" "8" " " "1.11.4" "MIT Kerberos"
 .SH NAME
 kpropd \- Kerberos V5 slave KDC update server
 .
@@ -69,9 +69,14 @@ kprop  stream  tcp  nowait  root  /usr/local/sbin/kpropd  kpropd
 .UNINDENT
 .UNINDENT
 .sp
-kpropd can also run as a standalone daemon.  This is required for
-incremental propagation.  But this is also useful for debugging
-purposes.
+kpropd can also run as a standalone daemon, backgrounding itself and
+waiting for connections on port 754 (or the port specified with the
+\fB\-P\fP option if given).  Standalone mode is required for incremental
+propagation.  Starting in release 1.11, kpropd automatically detects
+whether it was run from inetd and runs in standalone mode if it is
+not.  Prior to release 1.11, the \fB\-S\fP option is required to run
+kpropd in standalone mode; this option is now accepted for backward
+compatibility but does nothing.
 .sp
 Incremental propagation may be enabled with the \fBiprop_enable\fP
 variable in \fIkdc.conf(5)\fP.  If incremental propagation is
@@ -101,19 +106,11 @@ to be stored; by default the dumped database file is \fB@LOCALSTATEDIR@\fP\fB/kr
 Allows the user to specify the pathname to the \fIkdb5_util(8)\fP
 program; by default the pathname used is \fB@SBINDIR@\fP\fB/kdb5_util\fP.
 .TP
-.B \fB\-S\fP
-[DEPRECATED] Enable standalone mode.  Normally kpropd is invoked by
-inetd(8) so it expects a network connection to be passed to it
-from inetd(8).  If the \fB\-S\fP option is specified, or if standard
-input is not a socket, kpropd will put itself into the background,
-and wait for connections on port 754 (or the port specified with the
-\fB\-P\fP option if given).
-.TP
 .B \fB\-d\fP
-Turn on debug mode.  In this mode, if the \fB\-S\fP option is
-selected, kpropd will not detach itself from the current job and
-run in the background.  Instead, it will run in the foreground and
-print out debugging messages during the database propagation.
+Turn on debug mode.  In this mode, kpropd will not detach
+itself from the current job and run in the background.  Instead,
+it will run in the foreground and print out debugging messages
+during the database propagation.
 .TP
 .B \fB\-P\fP
 Allow for an alternate port number for kpropd to listen on.  This

diff --git a/src/man/kproplog.man b/src/man/kproplog.man
index 34dc812127cef2be0288571c7a67b254ff07ffae..d9184cca52507482f44e4b9b4cc41ef01d55070b 100644 (file)
--- a/src/man/kproplog.man
+++ b/src/man/kproplog.man
@@ -1,4 +1,4 @@
-.TH "KPROPLOG" "8" " " "1.11.3" "MIT Kerberos"
+.TH "KPROPLOG" "8" " " "1.11.4" "MIT Kerberos"
 .SH NAME
 kproplog \- display the contents of the Kerberos principal update log
 .

diff --git a/src/man/krb5-config.man b/src/man/krb5-config.man
index 74e5cfbbfdf829f01ea70041ffdfedb37a77910d..2be370acb02eba28c36f2c4cb536ba4512380d4c 100644 (file)
--- a/src/man/krb5-config.man
+++ b/src/man/krb5-config.man
@@ -1,4 +1,4 @@
-.TH "KRB5-CONFIG" "1" " " "1.11.3" "MIT Kerberos"
+.TH "KRB5-CONFIG" "1" " " "1.11.4" "MIT Kerberos"
 .SH NAME
 krb5-config \- tool for linking against MIT Kerberos libraries
 .

diff --git a/src/man/krb5.conf.man b/src/man/krb5.conf.man
index bdf35853fcdb79aa893d11be669b40961352ef29..4ffe03ed246106ab3959214038b63cad1b3a966a 100644 (file)
--- a/src/man/krb5.conf.man
+++ b/src/man/krb5.conf.man
@@ -1,4 +1,4 @@
-.TH "KRB5.CONF" "5" " " "1.11.3" "MIT Kerberos"
+.TH "KRB5.CONF" "5" " " "1.11.4" "MIT Kerberos"
 .SH NAME
 krb5.conf \- Kerberos configuration file
 .

diff --git a/src/man/krb5kdc.man b/src/man/krb5kdc.man
index f8fdc60bf8338feee4cb7cacf7affec529313929..21b7814d9838e11b050c45e1ab2b711b08253189 100644 (file)
--- a/src/man/krb5kdc.man
+++ b/src/man/krb5kdc.man
@@ -1,4 +1,4 @@
-.TH "KRB5KDC" "8" " " "1.11.3" "MIT Kerberos"
+.TH "KRB5KDC" "8" " " "1.11.4" "MIT Kerberos"
 .SH NAME
 krb5kdc \- Kerberos V5 KDC
 .

diff --git a/src/man/ksu.man b/src/man/ksu.man
index 02318b9f1af837a4f80f6456c10f9a08be2a5bbe..1d099c0727181b96482b6571c38f1bbbcd8fdbc4 100644 (file)
--- a/src/man/ksu.man
+++ b/src/man/ksu.man
@@ -1,4 +1,4 @@
-.TH "KSU" "1" " " "1.11.3" "MIT Kerberos"
+.TH "KSU" "1" " " "1.11.4" "MIT Kerberos"
 .SH NAME
 ksu \- Kerberized super-user
 .

diff --git a/src/man/kswitch.man b/src/man/kswitch.man
index 20e0190565bd176f227b45427a79114fb1dc763b..9190a7af9dea80feabb30b9dd729b1ca2a58beb4 100644 (file)
--- a/src/man/kswitch.man
+++ b/src/man/kswitch.man
@@ -1,4 +1,4 @@
-.TH "KSWITCH" "1" " " "1.11.3" "MIT Kerberos"
+.TH "KSWITCH" "1" " " "1.11.4" "MIT Kerberos"
 .SH NAME
 kswitch \- switch primary ticket cache
 .

diff --git a/src/man/ktutil.man b/src/man/ktutil.man
index 064c50612fd669076db149417253291340f5d699..36211ae3f9723dc809b24f1a105ed741c6dfd491 100644 (file)
--- a/src/man/ktutil.man
+++ b/src/man/ktutil.man
@@ -1,4 +1,4 @@
-.TH "KTUTIL" "1" " " "1.11.3" "MIT Kerberos"
+.TH "KTUTIL" "1" " " "1.11.4" "MIT Kerberos"
 .SH NAME
 ktutil \- Kerberos keytab file maintenance utility
 .

diff --git a/src/man/kvno.man b/src/man/kvno.man
index df3d27970ede2302c4da98623f2e7b9fd0896682..47bdda88465826f9db9a898c1cf2da27ff5b27c6 100644 (file)
--- a/src/man/kvno.man
+++ b/src/man/kvno.man
@@ -1,4 +1,4 @@
-.TH "KVNO" "1" " " "1.11.3" "MIT Kerberos"
+.TH "KVNO" "1" " " "1.11.4" "MIT Kerberos"
 .SH NAME
 kvno \- print key version numbers of Kerberos principals
 .

diff --git a/src/man/sclient.man b/src/man/sclient.man
index 6684b2890b6988de80bd13c393c4ad4da77bf531..6d80a00bf6f258d18ff80c843fd0afed296c3e10 100644 (file)
--- a/src/man/sclient.man
+++ b/src/man/sclient.man
@@ -1,4 +1,4 @@
-.TH "SCLIENT" "1" " " "1.11.3" "MIT Kerberos"
+.TH "SCLIENT" "1" " " "1.11.4" "MIT Kerberos"
 .SH NAME
 sclient \- sample Kerberos version 5 client
 .

diff --git a/src/man/sserver.man b/src/man/sserver.man
index 325ace60b92c9b7830d6790ae28e45ed58ff27e4..1f7cc5fb01722cb2bd203e2a2bd9eadf072909db 100644 (file)
--- a/src/man/sserver.man
+++ b/src/man/sserver.man
@@ -1,4 +1,4 @@
-.TH "SSERVER" "8" " " "1.11.3" "MIT Kerberos"
+.TH "SSERVER" "8" " " "1.11.4" "MIT Kerberos"
 .SH NAME
 sserver \- sample Kerberos version 5 server
 .

diff --git a/src/patchlevel.h b/src/patchlevel.h
index eb6cf940444b6ef0d86cc10107e2fdc3c5283f59..9674800092b336788c48df59d6223b91445c709b 100644 (file)
--- a/src/patchlevel.h
+++ b/src/patchlevel.h
@@ -51,7 +51,7 @@
  */
 #define KRB5_MAJOR_RELEASE 1
 #define KRB5_MINOR_RELEASE 11
-#define KRB5_PATCHLEVEL 3
-#define KRB5_RELTAIL "postrelease"
+#define KRB5_PATCHLEVEL 4
+/* #undef KRB5_RELTAIL */
 /* #undef KRB5_RELDATE */
-#define KRB5_RELTAG "krb5-1.11"
+#define KRB5_RELTAG "krb5-1.11.4-final"