From 2bc4bb02a70d7537baf1c3f6ebc126ded42ea133 Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Mon, 29 Dec 2014 13:27:42 -0500 Subject: [PATCH] Fix kadmind server validation [CVE-2014-9422] [MITKRB5-SA-2015-001] In kadmind's check_rpcsec_auth(), use data_eq_string() instead of strncmp() to check components of the server principal, so that we don't erroneously match left substrings of "kadmin", "history", or the realm. (cherry picked from commit 6609658db0799053fbef0d7d0aa2f1fd68ef32d8) ticket: 8057 version_fixed: 1.13.1 status: resolved --- src/kadmin/server/kadm_rpc_svc.c | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-) diff --git a/src/kadmin/server/kadm_rpc_svc.c b/src/kadmin/server/kadm_rpc_svc.c index 3837931b6f..f4d2a7cba7 100644 --- a/src/kadmin/server/kadm_rpc_svc.c +++ b/src/kadmin/server/kadm_rpc_svc.c @@ -4,7 +4,7 @@ * */ -#include +#include #include #include /* for gss_nt_krb5_name */ #include @@ -296,14 +296,8 @@ check_rpcsec_auth(struct svc_req *rqstp) c1 = krb5_princ_component(kctx, princ, 0); c2 = krb5_princ_component(kctx, princ, 1); realm = krb5_princ_realm(kctx, princ); - if (strncmp(handle->params.realm, realm->data, realm->length) == 0 - && strncmp("kadmin", c1->data, c1->length) == 0) { - - if (strncmp("history", c2->data, c2->length) == 0) - goto fail_princ; - else - success = 1; - } + success = data_eq_string(*realm, handle->params.realm) && + data_eq_string(*c1, "kadmin") && !data_eq_string(*c2, "history"); fail_princ: if (!success) { -- 2.47.2