]> git.ipfire.org Git - thirdparty/krb5.git/commit
projects / thirdparty / krb5.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: d89dde0) | patch
Fix kadmind server validation [CVE-2014-9422]
authorGreg Hudson <ghudson@mit.edu>
Mon, 29 Dec 2014 18:27:42 +0000 (13:27 -0500)
committerTom Yu <tlyu@mit.edu>
Wed, 4 Feb 2015 20:36:23 +0000 (15:36 -0500)
commit2bc4bb02a70d7537baf1c3f6ebc126ded42ea133
tree46e8cb587e470ddb833e5e14703810853701e351tree
parentd89dde02db71ba3ff0377e12e485f47537d43798commit | diff
Fix kadmind server validation [CVE-2014-9422]

[MITKRB5-SA-2015-001] In kadmind's check_rpcsec_auth(), use
data_eq_string() instead of strncmp() to check components of the
server principal, so that we don't erroneously match left substrings
of "kadmin", "history", or the realm.

(cherry picked from commit 6609658db0799053fbef0d7d0aa2f1fd68ef32d8)

ticket: 8057
version_fixed: 1.13.1
status: resolved
src/kadmin/server/kadm_rpc_svc.c diff | blob | blame | history
Mirror of https://github.com/krb5/krb5.git