]> git.ipfire.org Git - thirdparty/krb5.git/commitdiff
Null pointer deref in kadmind [CVE-2012-1013]
authorRichard Basch <basch@alum.mit.edu>
Tue, 29 May 2012 18:07:03 +0000 (14:07 -0400)
committerTom Yu <tlyu@mit.edu>
Tue, 29 May 2012 20:16:00 +0000 (16:16 -0400)
The fix for #6626 could cause kadmind to dereference a null pointer if
a create-principal request contains no password but does contain the
KRB5_KDB_DISALLOW_ALL_TIX flag (e.g. "addprinc -randkey -allow_tix
name").  Only clients authorized to create principals can trigger the
bug.  Fix the bug by testing for a null password in check_1_6_dummy.

CVSSv2 vector: AV:N/AC:M/Au:S/C:N/I:N/A:P/E:H/RL:O/RC:C

[ghudson@mit.edu: Minor style change and commit message]

(cherry picked from commit c5be6209311d4a8f10fda37d0d3f876c1b33b77b)

ticket: 7152
version_fixed: 1.10.2
status: resolved

src/lib/kadm5/srv/svr_principal.c

index c4f8bc87d97d5afaf99880be5bca4946c0064ba9..027b186fa14e1e817d90e0719297ddf870f28154 100644 (file)
@@ -187,7 +187,7 @@ check_1_6_dummy(kadm5_principal_ent_t entry, long mask,
     char *password = *passptr;
 
     /* Old-style randkey operations disallowed tickets to start. */
-    if (!(mask & KADM5_ATTRIBUTES) ||
+    if (password == NULL || !(mask & KADM5_ATTRIBUTES) ||
         !(entry->attributes & KRB5_KDB_DISALLOW_ALL_TIX))
         return;