From: Tom Yu <tlyu@mit.edu>
Date: Mon, 4 Nov 2013 20:49:03 +0000 (-0500)
Subject: Multi-realm KDC null deref [CVE-2013-1418]
X-Git-Tag: krb5-1.10.7-final~2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c2ccf4197f697c4ff143b8a786acdd875e70a89d;p=thirdparty%2Fkrb5.git

Multi-realm KDC null deref [CVE-2013-1418]

If a KDC serves multiple realms, certain requests can cause
setup_server_realm() to dereference a null pointer, crashing the KDC.

CVSSv2: AV:N/AC:M/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C

A related but more minor vulnerability requires authentication to
exploit, and is only present if a third-party KDC database module can
dereference a null pointer under certain conditions.

(back ported from commit 5d2d9a1abe46a2c1a8614d4672d08d9d30a5f8bf)

ticket: 7757 (new)
version_fixed: 1.10.7
status: resolved
---

diff --git a/src/kdc/main.c b/src/kdc/main.c
index b56ec193ca..7160607965 100644
--- a/src/kdc/main.c
+++ b/src/kdc/main.c
@@ -140,6 +140,9 @@ setup_server_realm(krb5_principal sprinc)
     kdc_realm_t         *newrealm;
 
     kret = 0;
+    if (sprinc == NULL)
+        return NULL;
+
     if (kdc_numrealms > 1) {
         if (!(newrealm = find_realm_data(sprinc->realm.data,
                                          (krb5_ui_4) sprinc->realm.length)))