]> git.ipfire.org Git - thirdparty/krb5.git/commit
projects / thirdparty / krb5.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: a197e92) | patch
Fix kadmind server validation [CVE-2014-9422]
authorGreg Hudson <ghudson@mit.edu>
Mon, 29 Dec 2014 18:27:42 +0000 (13:27 -0500)
committerGreg Hudson <ghudson@mit.edu>
Wed, 4 Feb 2015 19:26:15 +0000 (14:26 -0500)
commit6609658db0799053fbef0d7d0aa2f1fd68ef32d8
treee43e4cc1b7a6b2db1d9d16295bc80b6395cab26ctree | snapshot
parenta197e92349a4aa2141b5dff12e9dd44c2a2166e3commit | diff
Fix kadmind server validation [CVE-2014-9422]

[MITKRB5-SA-2015-001] In kadmind's check_rpcsec_auth(), use
data_eq_string() instead of strncmp() to check components of the
server principal, so that we don't erroneously match left substrings
of "kadmin", "history", or the realm.

ticket: 8057 (new)
target_version: 1.13.1
tags: pullup
src/kadmin/server/kadm_rpc_svc.c diff | blob | blame | history
Mirror of https://github.com/krb5/krb5.git