Date: Monday, August 11, 2014 @ 23:14:36 Author: eric Revision: 219582
upgpkg: krb5 1.12.1-2 Fix for CVE-2014-4345 Added: krb5/trunk/krb5-81c332e29f10887c6b9deb065f81ba259f4c7e03.patch Modified: krb5/trunk/PKGBUILD krb5/trunk/krb5-config_LDFLAGS.patch -----------------------------------------------------+ PKGBUILD | 19 +++-- krb5-81c332e29f10887c6b9deb065f81ba259f4c7e03.patch | 64 ++++++++++++++++++ krb5-config_LDFLAGS.patch | 4 - 3 files changed, 77 insertions(+), 10 deletions(-) Modified: PKGBUILD =================================================================== --- PKGBUILD 2014-08-11 20:36:43 UTC (rev 219581) +++ PKGBUILD 2014-08-11 21:14:36 UTC (rev 219582) @@ -3,7 +3,7 @@ pkgname=krb5 pkgver=1.12.1 -pkgrel=1 +pkgrel=2 pkgdesc="The Kerberos network authentication system" arch=('i686' 'x86_64') url="http://web.mit.edu/kerberos/" @@ -12,20 +12,22 @@ makedepends=('perl') backup=('etc/krb5.conf' 'var/lib/krb5kdc/kdc.conf') options=('!emptydirs') -source=(http://web.mit.edu/kerberos/dist/${pkgname}/${pkgver%.*}/${pkgname}-${pkgver}-signed.tar +source=(http://web.mit.edu/kerberos/dist/krb5/${pkgver%.*}/${pkgname}-${pkgver}-signed.tar krb5-config_LDFLAGS.patch krb5-kadmind.service krb5-kdc.service krb5-kpropd.service krb5-kpropd@.service - krb5-kpropd.socket) + krb5-kpropd.socket + krb5-81c332e29f10887c6b9deb065f81ba259f4c7e03.patch) sha1sums=('d59e8dc0fc9e1890e109cd033756539984e3d3fe' - '09e478cddfb9d46d2981dd25ef96b8c3fd91e1aa' + 'f125824ed37f31e6fd2fdb6a437be8ff1c3700ab' '59bbc7e686cbb4bcefddf0f134d928d7bd5e7722' '2ef2476a8673b3b702e829d8f451c839c2273b02' '74d66aefd291f22dd80799f0437cc03d83083ed5' '6787c6ce2783b3f980c423e2dd4abf5236af670b' - 'f3677d30dbbd7106c581379c2c6ebb1bf7738912') + 'f3677d30dbbd7106c581379c2c6ebb1bf7738912' + '8273976824137df1d42a4f9c7bafdfbd92f27d0a') prepare() { # the signature and source are bundled together, so signature check needs to be done here @@ -32,12 +34,13 @@ _check_pgpsig tar -xf ${pkgname}-${pkgver}.tar.gz - cd ${pkgname}-${pkgver}/src + cd ${pkgname}-${pkgver} # cf https://bugs.gentoo.org/show_bug.cgi?id=448778 - (cd build-tools; patch -Np2 -i "${srcdir}"/krb5-config_LDFLAGS.patch; cd ..) + patch -p1 -i "${srcdir}"/krb5-config_LDFLAGS.patch + patch -p1 -i "${srcdir}"/krb5-81c332e29f10887c6b9deb065f81ba259f4c7e03.patch # FS#25384 - sed -i "/KRB5ROOT=/s/\/local//" util/ac_check_krb5.m4 + sed -i "/KRB5ROOT=/s/\/local//" src/util/ac_check_krb5.m4 } build() { Added: krb5-81c332e29f10887c6b9deb065f81ba259f4c7e03.patch =================================================================== --- krb5-81c332e29f10887c6b9deb065f81ba259f4c7e03.patch (rev 0) +++ krb5-81c332e29f10887c6b9deb065f81ba259f4c7e03.patch 2014-08-11 21:14:36 UTC (rev 219582) @@ -0,0 +1,64 @@ +From 81c332e29f10887c6b9deb065f81ba259f4c7e03 Mon Sep 17 00:00:00 2001 +From: Tomas Kuthan <tkut...@gmail.com> +Date: Fri, 1 Aug 2014 15:25:50 +0200 +Subject: [PATCH] Fix LDAP key data segmentation [CVE-2014-4345] + +For principal entries having keys with multiple kvnos (due to use of +-keepold), the LDAP KDB module makes an attempt to store all the keys +having the same kvno into a single krbPrincipalKey attribute value. +There is a fencepost error in the loop, causing currkvno to be set to +the just-processed value instead of the next kvno. As a result, the +second and all following groups of multiple keys by kvno are each +stored in two krbPrincipalKey attribute values. Fix the loop to use +the correct kvno value. + +CVE-2014-4345: + +In MIT krb5, when kadmind is configured to use LDAP for the KDC +database, an authenticated remote attacker can cause it to perform an +out-of-bounds write (buffer overrun) by performing multiple cpw +-keepold operations. An off-by-one error while copying key +information to the new database entry results in keys sharing a common +kvno being written to different array buckets, in an array whose size +is determined by the number of kvnos present. After sufficient +iterations, the extra writes extend past the end of the +(NULL-terminated) array. The NULL terminator is always written after +the end of the loop, so no out-of-bounds data is read, it is only +written. + +Historically, it has been possible to convert an out-of-bounds write +into remote code execution in some cases, though the necessary +exploits must be tailored to the individual application and are +usually quite complicated. Depending on the allocated length of the +array, an out-of-bounds write may also cause a segmentation fault +and/or application crash. + + CVSSv2 Vector: AV:N/AC:M/Au:S/C:C/I:C/A:C/E:POC/RL:OF/RC:C + +[ghud...@mit.edu: clarified commit message] +[ka...@mit.edu: CVE summary, CVSSv2 vector] + +ticket: 7980 (new) +target_version: 1.12.2 +tags: pullup +--- + src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c +index ce851ea..df5934c 100644 +--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c ++++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c +@@ -456,7 +456,8 @@ krb5_encode_krbsecretkey(krb5_key_data *key_data_in, int n_key_data, + j++; + last = i + 1; + +- currkvno = key_data[i].key_data_kvno; ++ if (i < n_key_data - 1) ++ currkvno = key_data[i + 1].key_data_kvno; + } + } + ret[num_versions] = NULL; +-- +2.0.3 + Modified: krb5-config_LDFLAGS.patch =================================================================== --- krb5-config_LDFLAGS.patch 2014-08-11 20:36:43 UTC (rev 219581) +++ krb5-config_LDFLAGS.patch 2014-08-11 21:14:36 UTC (rev 219582) @@ -1,6 +1,6 @@ Bug #448778 ---- krb5-1.11/src/krb5-config.in 2012-12-18 02:47:04.000000000 +0000 -+++ krb5-1.11/src/krb5-config.in 2012-12-28 07:13:16.582693363 +0000 +--- krb5-1.11/src/build-tools/krb5-config.in 2012-12-18 02:47:04.000000000 +0000 ++++ krb5-1.11/src/build-tools/krb5-config.in 2012-12-28 07:13:16.582693363 +0000 @@ -217,7 +217,7 @@ -e 's#\$(PROG_RPATH)#'$libdir'#' \ -e 's#\$(PROG_LIBPATH)#'$libdirarg'#' \