Package: libgssapi-krb5-2
Version: 1.10+dfsg~beta1-2
Severity: important
Tags: upstream
Dear Maintainer,
There is a really nasty bug in krb5_gss_get_name_attribute(), called
indirectly from the public gss_get_name_attribute() function. The
bug is around lines 389-394 of "src/lib/gssapi/krb5/naming_exts.c":
if (display_value != NULL) {
if (code != 0)
code = data_to_gss(&kdisplay_value, display_value);
else
free(kdisplay_value.data);
}
The "if (code != 0)" test should be inverted, otherwise
*display_value is updated on error instead of on success.
What is meant to happen is that on success, if display_value is
non-NULL, display_value->length and display_value->value describe
some dynamically allocated blob of data or refer to NULL with a
length of 0. (Similarly for the 'value' parameter which is not
affected by the bug.)
I found this problem when investigating a problem in Samba's smbd
whicj kept dumping core when I browsed a Samba share (using security
= "ads") from Windows Explorer running on Windows XP.
In Samba 3.6.1 and 3.6.3, the problem occurs in gse_get_pac_blob()
in "source3/librpc/crypto/gse.c". It calls gss_get_name_attribute()
with the 'value' and 'display_value' pointers pointing to
uninitialized variables on the stack (called 'pac_buffer' and
'pac_display_buffer' respectively). When the function return value
indicates success, it later passes pointers to these same variables
(which are assumed to be valid) to gss_release_buffer() which
eventually calls free(). However, because of the bug in
krb5_gss_get_name_attribute(), only the first of these variables
('pac_buffer') is valid, the second one ('pac_display_buffer') being
still in its uninitialized state. Crucially, its '.value' member is
uninitialized, but is meant to be either NULL or a pointer to
dynamically allocated memory, so when gss_release_buffer() tries to
release this memory it blows up. (As an aside, gse_get_pac_blob()
does nothing else with the 'pac_display_buffer' variable.)
I emailed a bug report to <[email protected]> about 90 minutes ago,
but so far it hasn't appeared in the archive for the list. (I'm not
subscribed, so its probably awaiting moderator approval.)
-- System Information:
Debian Release: wheezy/sid
APT prefers testing
APT policy: (990, 'testing'), (500, 'unstable'), (500, 'stable'), (1,
'experimental')
Architecture: i386 (i686)
Kernel: Linux 3.1.0-1-686-pae (SMP w/1 CPU core)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash
Versions of packages libgssapi-krb5-2 depends on:
ii libc6 2.13-24
ii libcomerr2 1.42-1
ii libk5crypto3 1.10+dfsg~beta1-2
ii libkeyutils1 1.5.2-2
ii libkrb5-3 1.10+dfsg~beta1-2
ii libkrb5support0 1.10+dfsg~beta1-2
ii multiarch-support 2.13-24
libgssapi-krb5-2 recommends no packages.
Versions of packages libgssapi-krb5-2 suggests:
ii krb5-doc 1.10+dfsg~beta1-2
ii krb5-user 1.10+dfsg~beta1-2
-- no debconf information
--
To UNSUBSCRIBE, email to [email protected]
with a subject of "unsubscribe". Trouble? Contact [email protected]
