diff -Nru krb5-1.12+dfsg/debian/changelog krb5-1.12+dfsg/debian/changelog --- krb5-1.12+dfsg/debian/changelog 2015-02-06 20:27:53.000000000 +0000 +++ krb5-1.12+dfsg/debian/changelog 2015-11-11 14:10:37.000000000 +0000 @@ -1,3 +1,43 @@ +krb5 (1.12+dfsg-2ubuntu5.2) trusty-security; urgency=medium + + * SECURITY UPDATE: denial of service via incorrect null bytes + - d/p/0030-Fix-krb5_read_message-handling-CVE-2014-5355.patch: + properly handle null bytes in src/appl/user_user/server.c, + src/lib/krb5/krb/recvauth.c. + - CVE-2015-5355 + * SECURITY UPDATE: preauthentication requirement bypass in kdcpreauth + - d/p/0031-Prevent-requires_preauth-bypass-CVE-2015-2694.patch: + improve logic in src/plugins/preauth/otp/main.c, + src/plugins/preauth/pkinit/pkinit_srv.c. + - CVE-2015-2694 + * SECURITY UPDATE: SPNEGO context aliasing bugs + - d/p/0031-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch: + improve logic in src/lib/gssapi/spnego/gssapiP_spnego.h, + src/lib/gssapi/spnego/spnego_mech.c. + - d/p/0036-Fix-SPNEGO-context-import.patch: fix SPNEGO context import + in src/lib/gssapi/spnego/spnego_mech.c. + - CVE-2015-2695 + * SECURITY UPDATE: IAKERB context aliasing bugs + - d/p/0032-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch: + improve logic in src/lib/gssapi/krb5/gssapiP_krb5.h, + src/lib/gssapi/krb5/gssapi_krb5.c, src/lib/gssapi/krb5/iakerb.c. + - d/p/0034-Fix-two-IAKERB-comments.patch: fix comments in + src/lib/gssapi/krb5/iakerb.c. + - CVE-2015-2696 + * SECURITY UPDATE: KDC crash via invalid string processing + - d/p/0033-Fix-build_principal-memory-bug-CVE-2015-2697.patch: + use k5memdup0() instead of strdup() in src/lib/krb5/krb/bld_princ.c. + - CVE-2015-2697 + * SECURITY UPDATE: memory corruption in IAKERB context export/import + - d/p/0035-Fix-IAKERB-context-export-import-CVE-2015-2698.patch: + dereferencing the context_handle pointer before casting it in + and implement implement an IAKERB gss_import_sec_context() function + in src/lib/gssapi/krb5/gssapiP_krb5.h, + src/lib/gssapi/krb5/gssapi_krb5.c, src/lib/gssapi/krb5/iakerb.c. + - CVE-2015-2698 + + -- Marc Deslauriers Wed, 11 Nov 2015 09:08:08 -0500 + krb5 (1.12+dfsg-2ubuntu5.1) trusty-security; urgency=medium * SECURITY UPDATE: ticket forging via old keys diff -Nru krb5-1.12+dfsg/debian/patches/0030-Fix-krb5_read_message-handling-CVE-2014-5355.patch krb5-1.12+dfsg/debian/patches/0030-Fix-krb5_read_message-handling-CVE-2014-5355.patch --- krb5-1.12+dfsg/debian/patches/0030-Fix-krb5_read_message-handling-CVE-2014-5355.patch 1970-01-01 00:00:00.000000000 +0000 +++ krb5-1.12+dfsg/debian/patches/0030-Fix-krb5_read_message-handling-CVE-2014-5355.patch 2015-11-11 14:06:54.000000000 +0000 @@ -0,0 +1,112 @@ +From 200a429df2c47467eb3a0973eb7594a475cc18fe Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Tue, 9 Dec 2014 12:37:44 -0500 +Subject: Fix krb5_read_message handling [CVE-2014-5355] + +In recvauth_common, do not use strcmp against the data fields of +krb5_data objects populated by krb5_read_message(), as there is no +guarantee that they are C strings. Instead, create an expected +krb5_data value and use data_eq(). + +In the sample user-to-user server application, check that the received +client principal name is null-terminated before using it with printf +and krb5_parse_name. + +CVE-2014-5355: + +In MIT krb5, when a server process uses the krb5_recvauth function, an +unauthenticated remote attacker can cause a NULL dereference by +sending a zero-byte version string, or a read beyond the end of +allocated storage by sending a non-null-terminated version string. +The example user-to-user server application (uuserver) is similarly +vulnerable to a zero-length or non-null-terminated principal name +string. + +The krb5_recvauth function reads two version strings from the client +using krb5_read_message(), which produces a krb5_data structure +containing a length and a pointer to an octet sequence. krb5_recvauth +assumes that the data pointer is a valid C string and passes it to +strcmp() to verify the versions. If the client sends an empty octet +sequence, the data pointer will be NULL and strcmp() will dereference +a NULL pointer, causing the process to crash. If the client sends a +non-null-terminated octet sequence, strcmp() will read beyond the end +of the allocated storage, possibly causing the process to crash. + +uuserver similarly uses krb5_read_message() to read a client principal +name, and then passes it to printf() and krb5_parse_name() without +verifying that it is a valid C string. + +The krb5_recvauth function is used by kpropd and the Kerberized +versions of the BSD rlogin and rsh daemons. These daemons are usually +run out of inetd or in a mode which forks before processing incoming +connections, so a process crash will generally not result in a +complete denial of service. + +Thanks to Tim Uglow for discovering this issue. + +CVSSv2: AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C + +[tlyu@mit.edu: CVSS score] + +ticket: 8050 (new) +target_version: 1.13.1 +tags: pullup + +(cherry picked from commit 102bb6ebf20f9174130c85c3b052ae104e5073ec) + +Patch-Category: upstream +--- + src/appl/user_user/server.c | 4 +++- + src/lib/krb5/krb/recvauth.c | 9 ++++++--- + 2 files changed, 9 insertions(+), 4 deletions(-) + +diff --git a/src/appl/user_user/server.c b/src/appl/user_user/server.c +index dbff68e..b136c72 100644 +--- a/src/appl/user_user/server.c ++++ b/src/appl/user_user/server.c +@@ -113,8 +113,10 @@ int main(argc, argv) + } + #endif + ++ /* principal name must be sent null-terminated. */ + retval = krb5_read_message(context, (krb5_pointer) &sock, &pname_data); +- if (retval) { ++ if (retval || pname_data.length == 0 || ++ pname_data.data[pname_data.length - 1] != '\0') { + com_err ("uu-server", retval, "reading pname"); + return 2; + } +diff --git a/src/lib/krb5/krb/recvauth.c b/src/lib/krb5/krb/recvauth.c +index da836283..5adc6dd 100644 +--- a/src/lib/krb5/krb/recvauth.c ++++ b/src/lib/krb5/krb/recvauth.c +@@ -59,6 +59,7 @@ recvauth_common(krb5_context context, + krb5_rcache rcache = 0; + krb5_octet response; + krb5_data null_server; ++ krb5_data d; + int need_error_free = 0; + int local_rcache = 0, local_authcon = 0; + +@@ -77,7 +78,8 @@ recvauth_common(krb5_context context, + */ + if ((retval = krb5_read_message(context, fd, &inbuf))) + return(retval); +- if (strcmp(inbuf.data, sendauth_version)) { ++ d = make_data((char *)sendauth_version, strlen(sendauth_version) + 1); ++ if (!data_eq(inbuf, d)) { + problem = KRB5_SENDAUTH_BADAUTHVERS; + response = 1; + } +@@ -93,8 +95,9 @@ recvauth_common(krb5_context context, + */ + if ((retval = krb5_read_message(context, fd, &inbuf))) + return(retval); +- if (appl_version && strcmp(inbuf.data, appl_version)) { +- if (!problem) { ++ if (appl_version != NULL && !problem) { ++ d = make_data(appl_version, strlen(appl_version) + 1); ++ if (!data_eq(inbuf, d)) { + problem = KRB5_SENDAUTH_BADAPPLVERS; + response = 2; + } diff -Nru krb5-1.12+dfsg/debian/patches/0031-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch krb5-1.12+dfsg/debian/patches/0031-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch --- krb5-1.12+dfsg/debian/patches/0031-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch 1970-01-01 00:00:00.000000000 +0000 +++ krb5-1.12+dfsg/debian/patches/0031-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch 2015-11-11 14:07:20.000000000 +0000 @@ -0,0 +1,569 @@ +From 7c363c0667d2d17e9e434f6eaa506b89ca56ffac Mon Sep 17 00:00:00 2001 +From: Nicolas Williams +Date: Mon, 14 Sep 2015 12:27:52 -0400 +Subject: Fix SPNEGO context aliasing bugs [CVE-2015-2695] + +The SPNEGO mechanism currently replaces its context handle with the +mechanism context handle upon establishment, under the assumption that +most GSS functions are only called after context establishment. This +assumption is incorrect, and can lead to aliasing violations for some +programs. Maintain the SPNEGO context structure after context +establishment and refer to it in all GSS methods. Add initiate and +opened flags to the SPNEGO context structure for use in +gss_inquire_context() prior to context establishment. + +CVE-2015-2695: + +In MIT krb5 1.5 and later, applications which call +gss_inquire_context() on a partially-established SPNEGO context can +cause the GSS-API library to read from a pointer using the wrong type, +generally causing a process crash. This bug may go unnoticed, because +the most common SPNEGO authentication scenario establishes the context +after just one call to gss_accept_sec_context(). Java server +applications using the native JGSS provider are vulnerable to this +bug. A carefully crafted SPNEGO packet might allow the +gss_inquire_context() call to succeed with attacker-determined +results, but applications should not make access control decisions +based on gss_inquire_context() results prior to context establishment. + + CVSSv2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:C/E:POC/RL:OF/RC:C + +[ghudson@mit.edu: several bugfixes, style changes, and edge-case +behavior changes; commit message and CVE description] + +ticket: 8244 +target_version: 1.14 +tags: pullup + +(cherry picked from commit b51b33f2bc5d1497ddf5bd107f791c101695000d) +(cherry picked from commit b813d5811432faed844a2dfd3daecde914978f2c) + +Patch-Category: upstream +--- + src/lib/gssapi/spnego/gssapiP_spnego.h | 2 + + src/lib/gssapi/spnego/spnego_mech.c | 254 ++++++++++++++++++++++++--------- + 2 files changed, 192 insertions(+), 64 deletions(-) + +Index: krb5-1.12+dfsg/src/lib/gssapi/spnego/gssapiP_spnego.h +=================================================================== +--- krb5-1.12+dfsg.orig/src/lib/gssapi/spnego/gssapiP_spnego.h 2015-11-11 09:07:15.090380006 -0500 ++++ krb5-1.12+dfsg/src/lib/gssapi/spnego/gssapiP_spnego.h 2015-11-11 09:07:15.082380267 -0500 +@@ -102,6 +102,8 @@ + int firstpass; + int mech_complete; + int nego_done; ++ int initiate; ++ int opened; + OM_uint32 ctx_flags; + gss_name_t internal_name; + gss_OID actual_mech; +Index: krb5-1.12+dfsg/src/lib/gssapi/spnego/spnego_mech.c +=================================================================== +--- krb5-1.12+dfsg.orig/src/lib/gssapi/spnego/spnego_mech.c 2015-11-11 09:07:15.090380006 -0500 ++++ krb5-1.12+dfsg/src/lib/gssapi/spnego/spnego_mech.c 2015-11-11 09:07:15.082380267 -0500 +@@ -108,7 +108,7 @@ + gss_cred_usage_t, gss_OID_set *); + static void release_spnego_ctx(spnego_gss_ctx_id_t *); + static void check_spnego_options(spnego_gss_ctx_id_t); +-static spnego_gss_ctx_id_t create_spnego_ctx(void); ++static spnego_gss_ctx_id_t create_spnego_ctx(int); + static int put_mech_set(gss_OID_set mechSet, gss_buffer_t buf); + static int put_input_token(unsigned char **, gss_buffer_t, unsigned int); + static int put_mech_oid(unsigned char **, gss_OID_const, unsigned int); +@@ -440,7 +440,7 @@ + } + + static spnego_gss_ctx_id_t +-create_spnego_ctx(void) ++create_spnego_ctx(int initiate) + { + spnego_gss_ctx_id_t spnego_ctx = NULL; + spnego_ctx = (spnego_gss_ctx_id_t) +@@ -463,6 +463,8 @@ + spnego_ctx->mic_rcvd = 0; + spnego_ctx->mech_complete = 0; + spnego_ctx->nego_done = 0; ++ spnego_ctx->opened = 0; ++ spnego_ctx->initiate = initiate; + spnego_ctx->internal_name = GSS_C_NO_NAME; + spnego_ctx->actual_mech = GSS_C_NO_OID; + +@@ -595,7 +597,7 @@ + OM_uint32 ret; + spnego_gss_ctx_id_t sc = NULL; + +- sc = create_spnego_ctx(); ++ sc = create_spnego_ctx(1); + if (sc == NULL) + return GSS_S_FAILURE; + +@@ -612,10 +614,7 @@ + ret = GSS_S_FAILURE; + goto cleanup; + } +- /* +- * The actual context is not yet determined, set the output +- * context handle to refer to the spnego context itself. +- */ ++ + sc->ctx_handle = GSS_C_NO_CONTEXT; + *ctx = (gss_ctx_id_t)sc; + sc = NULL; +@@ -1043,16 +1042,11 @@ + } + gss_release_buffer(&tmpmin, &mechtok_out); + if (ret == GSS_S_COMPLETE) { +- /* +- * Now, switch the output context to refer to the +- * negotiated mechanism's context. +- */ +- *context_handle = (gss_ctx_id_t)spnego_ctx->ctx_handle; ++ spnego_ctx->opened = 1; + if (actual_mech != NULL) + *actual_mech = spnego_ctx->actual_mech; + if (ret_flags != NULL) + *ret_flags = spnego_ctx->ctx_flags; +- release_spnego_ctx(&spnego_ctx); + } else if (ret != GSS_S_CONTINUE_NEEDED) { + if (spnego_ctx != NULL) { + gss_delete_sec_context(&tmpmin, +@@ -1296,7 +1290,7 @@ + if (ret != GSS_S_COMPLETE) + goto cleanup; + +- sc = create_spnego_ctx(); ++ sc = create_spnego_ctx(0); + if (sc == NULL) { + ret = GSS_S_FAILURE; + goto cleanup; +@@ -1378,7 +1372,7 @@ + gss_release_buffer(&tmpmin, &sc->DER_mechTypes); + assert(mech_wanted != GSS_C_NO_OID); + } else +- sc = create_spnego_ctx(); ++ sc = create_spnego_ctx(0); + if (sc == NULL) { + ret = GSS_S_FAILURE; + *return_token = NO_TOKEN_SEND; +@@ -1761,13 +1755,12 @@ + ret = GSS_S_FAILURE; + } + if (ret == GSS_S_COMPLETE) { +- *context_handle = (gss_ctx_id_t)sc->ctx_handle; ++ sc->opened = 1; + if (sc->internal_name != GSS_C_NO_NAME && + src_name != NULL) { + *src_name = sc->internal_name; + sc->internal_name = GSS_C_NO_NAME; + } +- release_spnego_ctx(&sc); + } else if (ret != GSS_S_CONTINUE_NEEDED) { + if (sc != NULL) { + gss_delete_sec_context(&tmpmin, &sc->ctx_handle, +@@ -2060,8 +2053,13 @@ + gss_qop_t *qop_state) + { + OM_uint32 ret; ++ spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle; ++ ++ if (sc->ctx_handle == GSS_C_NO_CONTEXT) ++ return (GSS_S_NO_CONTEXT); ++ + ret = gss_unwrap(minor_status, +- context_handle, ++ sc->ctx_handle, + input_message_buffer, + output_message_buffer, + conf_state, +@@ -2081,8 +2079,13 @@ + gss_buffer_t output_message_buffer) + { + OM_uint32 ret; ++ spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle; ++ ++ if (sc->ctx_handle == GSS_C_NO_CONTEXT) ++ return (GSS_S_NO_CONTEXT); ++ + ret = gss_wrap(minor_status, +- context_handle, ++ sc->ctx_handle, + conf_req_flag, + qop_req, + input_message_buffer, +@@ -2099,8 +2102,14 @@ + const gss_buffer_t token_buffer) + { + OM_uint32 ret; ++ spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle; ++ ++ /* SPNEGO doesn't have its own context tokens. */ ++ if (!sc->opened) ++ return (GSS_S_DEFECTIVE_TOKEN); ++ + ret = gss_process_context_token(minor_status, +- context_handle, ++ sc->ctx_handle, + token_buffer); + + return (ret); +@@ -2124,19 +2133,9 @@ + if (*ctx == NULL) + return (GSS_S_COMPLETE); + +- /* +- * If this is still an SPNEGO mech, release it locally. +- */ +- if ((*ctx)->magic_num == SPNEGO_MAGIC_ID) { +- (void) gss_delete_sec_context(minor_status, +- &(*ctx)->ctx_handle, +- output_token); +- (void) release_spnego_ctx(ctx); +- } else { +- ret = gss_delete_sec_context(minor_status, +- context_handle, +- output_token); +- } ++ (void) gss_delete_sec_context(minor_status, &(*ctx)->ctx_handle, ++ output_token); ++ (void) release_spnego_ctx(ctx); + + return (ret); + } +@@ -2148,8 +2147,13 @@ + OM_uint32 *time_rec) + { + OM_uint32 ret; ++ spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle; ++ ++ if (sc->ctx_handle == GSS_C_NO_CONTEXT) ++ return (GSS_S_NO_CONTEXT); ++ + ret = gss_context_time(minor_status, +- context_handle, ++ sc->ctx_handle, + time_rec); + return (ret); + } +@@ -2161,9 +2165,20 @@ + gss_buffer_t interprocess_token) + { + OM_uint32 ret; ++ spnego_gss_ctx_id_t sc = *(spnego_gss_ctx_id_t *)context_handle; ++ ++ /* We don't currently support exporting partially established ++ * contexts. */ ++ if (!sc->opened) ++ return GSS_S_UNAVAILABLE; ++ + ret = gss_export_sec_context(minor_status, +- context_handle, ++ &sc->ctx_handle, + interprocess_token); ++ if (sc->ctx_handle == GSS_C_NO_CONTEXT) { ++ release_spnego_ctx(&sc); ++ *context_handle = GSS_C_NO_CONTEXT; ++ } + return (ret); + } + +@@ -2173,11 +2188,12 @@ + const gss_buffer_t interprocess_token, + gss_ctx_id_t *context_handle) + { +- OM_uint32 ret; +- ret = gss_import_sec_context(minor_status, +- interprocess_token, +- context_handle); +- return (ret); ++ /* ++ * Until we implement partial context exports, there are no SPNEGO ++ * exported context tokens, only tokens for underlying mechs. So just ++ * return an error for now. ++ */ ++ return GSS_S_UNAVAILABLE; + } + #endif /* LEAN_CLIENT */ + +@@ -2194,16 +2210,48 @@ + int *opened) + { + OM_uint32 ret = GSS_S_COMPLETE; ++ spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle; ++ ++ if (src_name != NULL) ++ *src_name = GSS_C_NO_NAME; ++ if (targ_name != NULL) ++ *targ_name = GSS_C_NO_NAME; ++ if (lifetime_rec != NULL) ++ *lifetime_rec = 0; ++ if (mech_type != NULL) ++ *mech_type = (gss_OID)gss_mech_spnego; ++ if (ctx_flags != NULL) ++ *ctx_flags = 0; ++ if (locally_initiated != NULL) ++ *locally_initiated = sc->initiate; ++ if (opened != NULL) ++ *opened = sc->opened; ++ ++ if (sc->ctx_handle != GSS_C_NO_CONTEXT) { ++ ret = gss_inquire_context(minor_status, sc->ctx_handle, ++ src_name, targ_name, lifetime_rec, ++ mech_type, ctx_flags, NULL, NULL); ++ } + +- ret = gss_inquire_context(minor_status, +- context_handle, +- src_name, +- targ_name, +- lifetime_rec, +- mech_type, +- ctx_flags, +- locally_initiated, +- opened); ++ if (!sc->opened) { ++ /* ++ * We are still doing SPNEGO negotiation, so report SPNEGO as ++ * the OID. After negotiation is complete we will report the ++ * underlying mechanism OID. ++ */ ++ if (mech_type != NULL) ++ *mech_type = (gss_OID)gss_mech_spnego; ++ ++ /* ++ * Remove flags we don't support with partially-established ++ * contexts. (Change this to keep GSS_C_TRANS_FLAG if we add ++ * support for exporting partial SPNEGO contexts.) ++ */ ++ if (ctx_flags != NULL) { ++ *ctx_flags &= ~GSS_C_PROT_READY_FLAG; ++ *ctx_flags &= ~GSS_C_TRANS_FLAG; ++ } ++ } + + return (ret); + } +@@ -2218,8 +2266,13 @@ + OM_uint32 *max_input_size) + { + OM_uint32 ret; ++ spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle; ++ ++ if (sc->ctx_handle == GSS_C_NO_CONTEXT) ++ return (GSS_S_NO_CONTEXT); ++ + ret = gss_wrap_size_limit(minor_status, +- context_handle, ++ sc->ctx_handle, + conf_req_flag, + qop_req, + req_output_size, +@@ -2236,8 +2289,13 @@ + gss_buffer_t message_token) + { + OM_uint32 ret; ++ spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle; ++ ++ if (sc->ctx_handle == GSS_C_NO_CONTEXT) ++ return (GSS_S_NO_CONTEXT); ++ + ret = gss_get_mic(minor_status, +- context_handle, ++ sc->ctx_handle, + qop_req, + message_buffer, + message_token); +@@ -2253,8 +2311,13 @@ + gss_qop_t *qop_state) + { + OM_uint32 ret; ++ spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle; ++ ++ if (sc->ctx_handle == GSS_C_NO_CONTEXT) ++ return (GSS_S_NO_CONTEXT); ++ + ret = gss_verify_mic(minor_status, +- context_handle, ++ sc->ctx_handle, + msg_buffer, + token_buffer, + qop_state); +@@ -2269,8 +2332,14 @@ + gss_buffer_set_t *data_set) + { + OM_uint32 ret; ++ spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle; ++ ++ /* There are no SPNEGO-specific OIDs for this function. */ ++ if (sc->ctx_handle == GSS_C_NO_CONTEXT) ++ return (GSS_S_UNAVAILABLE); ++ + ret = gss_inquire_sec_context_by_oid(minor_status, +- context_handle, ++ sc->ctx_handle, + desired_object, + data_set); + return (ret); +@@ -2339,8 +2408,15 @@ + const gss_buffer_t value) + { + OM_uint32 ret; ++ spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)*context_handle; ++ ++ /* There are no SPNEGO-specific OIDs for this function, and we cannot ++ * construct an empty SPNEGO context with it. */ ++ if (sc == NULL || sc->ctx_handle == GSS_C_NO_CONTEXT) ++ return (GSS_S_UNAVAILABLE); ++ + ret = gss_set_sec_context_option(minor_status, +- context_handle, ++ &sc->ctx_handle, + desired_object, + value); + return (ret); +@@ -2357,8 +2433,13 @@ + gss_buffer_t output_message_buffer) + { + OM_uint32 ret; ++ spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle; ++ ++ if (sc->ctx_handle == GSS_C_NO_CONTEXT) ++ return (GSS_S_NO_CONTEXT); ++ + ret = gss_wrap_aead(minor_status, +- context_handle, ++ sc->ctx_handle, + conf_req_flag, + qop_req, + input_assoc_buffer, +@@ -2379,8 +2460,13 @@ + gss_qop_t *qop_state) + { + OM_uint32 ret; ++ spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle; ++ ++ if (sc->ctx_handle == GSS_C_NO_CONTEXT) ++ return (GSS_S_NO_CONTEXT); ++ + ret = gss_unwrap_aead(minor_status, +- context_handle, ++ sc->ctx_handle, + input_message_buffer, + input_assoc_buffer, + output_payload_buffer, +@@ -2399,8 +2485,13 @@ + int iov_count) + { + OM_uint32 ret; ++ spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle; ++ ++ if (sc->ctx_handle == GSS_C_NO_CONTEXT) ++ return (GSS_S_NO_CONTEXT); ++ + ret = gss_wrap_iov(minor_status, +- context_handle, ++ sc->ctx_handle, + conf_req_flag, + qop_req, + conf_state, +@@ -2418,8 +2509,13 @@ + int iov_count) + { + OM_uint32 ret; ++ spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle; ++ ++ if (sc->ctx_handle == GSS_C_NO_CONTEXT) ++ return (GSS_S_NO_CONTEXT); ++ + ret = gss_unwrap_iov(minor_status, +- context_handle, ++ sc->ctx_handle, + conf_state, + qop_state, + iov, +@@ -2437,8 +2533,13 @@ + int iov_count) + { + OM_uint32 ret; ++ spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle; ++ ++ if (sc->ctx_handle == GSS_C_NO_CONTEXT) ++ return (GSS_S_NO_CONTEXT); ++ + ret = gss_wrap_iov_length(minor_status, +- context_handle, ++ sc->ctx_handle, + conf_req_flag, + qop_req, + conf_state, +@@ -2455,8 +2556,13 @@ + gss_buffer_t input_message_buffer) + { + OM_uint32 ret; ++ spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle; ++ ++ if (sc->ctx_handle == GSS_C_NO_CONTEXT) ++ return (GSS_S_UNAVAILABLE); ++ + ret = gss_complete_auth_token(minor_status, +- context_handle, ++ sc->ctx_handle, + input_message_buffer); + return (ret); + } +@@ -2708,8 +2814,13 @@ + gss_buffer_t prf_out) + { + OM_uint32 ret; ++ spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context; ++ ++ if (sc->ctx_handle == GSS_C_NO_CONTEXT) ++ return (GSS_S_NO_CONTEXT); ++ + ret = gss_pseudo_random(minor_status, +- context, ++ sc->ctx_handle, + prf_key, + prf_in, + desired_output_len, +@@ -2850,7 +2961,12 @@ + gss_qop_t qop_req, gss_iov_buffer_desc *iov, + int iov_count) + { +- return gss_get_mic_iov(minor_status, context_handle, qop_req, iov, ++ spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle; ++ ++ if (sc->ctx_handle == GSS_C_NO_CONTEXT) ++ return (GSS_S_NO_CONTEXT); ++ ++ return gss_get_mic_iov(minor_status, sc->ctx_handle, qop_req, iov, + iov_count); + } + +@@ -2859,7 +2975,12 @@ + gss_qop_t *qop_state, gss_iov_buffer_desc *iov, + int iov_count) + { +- return gss_verify_mic_iov(minor_status, context_handle, qop_state, iov, ++ spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle; ++ ++ if (sc->ctx_handle == GSS_C_NO_CONTEXT) ++ return (GSS_S_NO_CONTEXT); ++ ++ return gss_verify_mic_iov(minor_status, sc->ctx_handle, qop_state, iov, + iov_count); + } + +@@ -2868,7 +2989,12 @@ + gss_ctx_id_t context_handle, gss_qop_t qop_req, + gss_iov_buffer_desc *iov, int iov_count) + { +- return gss_get_mic_iov_length(minor_status, context_handle, qop_req, iov, ++ spnego_gss_ctx_id_t sc = (spnego_gss_ctx_id_t)context_handle; ++ ++ if (sc->ctx_handle == GSS_C_NO_CONTEXT) ++ return (GSS_S_NO_CONTEXT); ++ ++ return gss_get_mic_iov_length(minor_status, sc->ctx_handle, qop_req, iov, + iov_count); + } + diff -Nru krb5-1.12+dfsg/debian/patches/0031-Prevent-requires_preauth-bypass-CVE-2015-2694.patch krb5-1.12+dfsg/debian/patches/0031-Prevent-requires_preauth-bypass-CVE-2015-2694.patch --- krb5-1.12+dfsg/debian/patches/0031-Prevent-requires_preauth-bypass-CVE-2015-2694.patch 1970-01-01 00:00:00.000000000 +0000 +++ krb5-1.12+dfsg/debian/patches/0031-Prevent-requires_preauth-bypass-CVE-2015-2694.patch 2015-11-11 14:07:04.000000000 +0000 @@ -0,0 +1,104 @@ +From 8159057a3dfa382ffd6c1cceaab436011e92f435 Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Tue, 24 Mar 2015 12:02:37 -0400 +Subject: Prevent requires_preauth bypass [CVE-2015-2694] + +In the OTP kdcpreauth module, don't set the TKT_FLG_PRE_AUTH bit until +the request is successfully verified. In the PKINIT kdcpreauth +module, don't respond with code 0 on empty input or an unconfigured +realm. Together these bugs could cause the KDC preauth framework to +erroneously treat a request as pre-authenticated. + +CVE-2015-2694: + +In MIT krb5 1.12 and later, when the KDC is configured with PKINIT +support, an unauthenticated remote attacker can bypass the +requires_preauth flag on a client principal and obtain a ciphertext +encrypted in the principal's long-term key. This ciphertext could be +used to conduct an off-line dictionary attack against the user's +password. + + CVSSv2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N/E:POC/RL:OF/RC:C + +(cherry picked from commit e3b5a5e5267818c97750b266df50b6a3d4649604) + +ticket: 8160 +version_fixed: 1.13.2 +status: resolved + +(cherry picked from commit df8afc60d970a7176a55ffe7ce21cfd57ba423cd) +patch-category: upstream +--- + src/plugins/preauth/otp/main.c | 10 +++++++--- + src/plugins/preauth/pkinit/pkinit_srv.c | 4 ++-- + 2 files changed, 9 insertions(+), 5 deletions(-) + +diff --git a/src/plugins/preauth/otp/main.c b/src/plugins/preauth/otp/main.c +index bf9c6a8..7941b4a 100644 +--- a/src/plugins/preauth/otp/main.c ++++ b/src/plugins/preauth/otp/main.c +@@ -42,6 +42,7 @@ static krb5_preauthtype otp_pa_type_list[] = + struct request_state { + krb5_kdcpreauth_verify_respond_fn respond; + void *arg; ++ krb5_enc_tkt_part *enc_tkt_reply; + }; + + static krb5_error_code +@@ -159,6 +160,9 @@ on_response(void *data, krb5_error_code retval, otp_response response) + if (retval == 0 && response != otp_response_success) + retval = KRB5_PREAUTH_FAILED; + ++ if (retval == 0) ++ rs.enc_tkt_reply->flags |= TKT_FLG_PRE_AUTH; ++ + rs.respond(rs.arg, retval, NULL, NULL, NULL); + } + +@@ -263,8 +267,6 @@ otp_verify(krb5_context context, krb5_data *req_pkt, krb5_kdc_req *request, + krb5_data d, plaintext; + char *config; + +- enc_tkt_reply->flags |= TKT_FLG_PRE_AUTH; +- + /* Get the FAST armor key. */ + armor_key = cb->fast_armor(context, rock); + if (armor_key == NULL) { +@@ -298,12 +300,14 @@ otp_verify(krb5_context context, krb5_data *req_pkt, krb5_kdc_req *request, + goto error; + } + +- /* Create the request state. */ ++ /* Create the request state. Save the response callback, and the ++ * enc_tkt_reply pointer so we can set the TKT_FLG_PRE_AUTH flag later. */ + rs = k5alloc(sizeof(struct request_state), &retval); + if (rs == NULL) + goto error; + rs->arg = arg; + rs->respond = respond; ++ rs->enc_tkt_reply = enc_tkt_reply; + + /* Get the principal's OTP configuration string. */ + retval = cb->get_string(context, rock, "otp", &config); +diff --git a/src/plugins/preauth/pkinit/pkinit_srv.c b/src/plugins/preauth/pkinit/pkinit_srv.c +index 1179216..279415a 100644 +--- a/src/plugins/preauth/pkinit/pkinit_srv.c ++++ b/src/plugins/preauth/pkinit/pkinit_srv.c +@@ -306,7 +306,7 @@ pkinit_server_verify_padata(krb5_context context, + + pkiDebug("pkinit_verify_padata: entered!\n"); + if (data == NULL || data->length <= 0 || data->contents == NULL) { +- (*respond)(arg, 0, NULL, NULL, NULL); ++ (*respond)(arg, EINVAL, NULL, NULL, NULL); + return; + } + +@@ -318,7 +318,7 @@ pkinit_server_verify_padata(krb5_context context, + + plgctx = pkinit_find_realm_context(context, moddata, request->server); + if (plgctx == NULL) { +- (*respond)(arg, 0, NULL, NULL, NULL); ++ (*respond)(arg, EINVAL, NULL, NULL, NULL); + return; + } + diff -Nru krb5-1.12+dfsg/debian/patches/0032-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch krb5-1.12+dfsg/debian/patches/0032-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch --- krb5-1.12+dfsg/debian/patches/0032-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch 1970-01-01 00:00:00.000000000 +0000 +++ krb5-1.12+dfsg/debian/patches/0032-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch 2015-11-11 14:07:29.000000000 +0000 @@ -0,0 +1,736 @@ +From 515ddf7c62b5944e550728ee8bab284b852f8995 Mon Sep 17 00:00:00 2001 +From: Nicolas Williams +Date: Mon, 14 Sep 2015 12:28:36 -0400 +Subject: Fix IAKERB context aliasing bugs [CVE-2015-2696] + +The IAKERB mechanism currently replaces its context handle with the +krb5 mechanism handle upon establishment, under the assumption that +most GSS functions are only called after context establishment. This +assumption is incorrect, and can lead to aliasing violations for some +programs. Maintain the IAKERB context structure after context +establishment and add new IAKERB entry points to refer to it with that +type. Add initiate and established flags to the IAKERB context +structure for use in gss_inquire_context() prior to context +establishment. + +CVE-2015-2696: + +In MIT krb5 1.9 and later, applications which call +gss_inquire_context() on a partially-established IAKERB context can +cause the GSS-API library to read from a pointer using the wrong type, +generally causing a process crash. Java server applications using the +native JGSS provider are vulnerable to this bug. A carefully crafted +IAKERB packet might allow the gss_inquire_context() call to succeed +with attacker-determined results, but applications should not make +access control decisions based on gss_inquire_context() results prior +to context establishment. + + CVSSv2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:C/E:POC/RL:OF/RC:C + +[ghudson@mit.edu: several bugfixes, style changes, and edge-case +behavior changes; commit message and CVE description] + +ticket: 8244 +target_version: 1.14 +tags: pullup + +(cherry picked from commit e04f0283516e80d2f93366e0d479d13c9b5c8c2a) +(cherry picked from commit ebea85358bc72ec20c53130d83acb93f95853b76) + +Patch-Category: upstream +--- + src/lib/gssapi/krb5/gssapiP_krb5.h | 114 ++++++++++++ + src/lib/gssapi/krb5/gssapi_krb5.c | 105 +++++++++-- + src/lib/gssapi/krb5/iakerb.c | 351 +++++++++++++++++++++++++++++++++---- + 3 files changed, 529 insertions(+), 41 deletions(-) + +diff --git a/src/lib/gssapi/krb5/gssapiP_krb5.h b/src/lib/gssapi/krb5/gssapiP_krb5.h +index 42d16ad..b14788d 100644 +--- a/src/lib/gssapi/krb5/gssapiP_krb5.h ++++ b/src/lib/gssapi/krb5/gssapiP_krb5.h +@@ -618,6 +618,21 @@ OM_uint32 KRB5_CALLCONV krb5_gss_accept_sec_context_ext + ); + #endif /* LEAN_CLIENT */ + ++OM_uint32 KRB5_CALLCONV krb5_gss_inquire_sec_context_by_oid ++(OM_uint32*, /* minor_status */ ++ const gss_ctx_id_t, ++ /* context_handle */ ++ const gss_OID, /* desired_object */ ++ gss_buffer_set_t* /* data_set */ ++); ++ ++OM_uint32 KRB5_CALLCONV krb5_gss_set_sec_context_option ++(OM_uint32*, /* minor_status */ ++ gss_ctx_id_t*, /* context_handle */ ++ const gss_OID, /* desired_object */ ++ const gss_buffer_t/* value */ ++); ++ + OM_uint32 KRB5_CALLCONV krb5_gss_process_context_token + (OM_uint32*, /* minor_status */ + gss_ctx_id_t, /* context_handle */ +@@ -1298,6 +1313,105 @@ OM_uint32 KRB5_CALLCONV + krb5_gss_import_cred(OM_uint32 *minor_status, gss_buffer_t token, + gss_cred_id_t *cred_handle); + ++OM_uint32 KRB5_CALLCONV ++iakerb_gss_process_context_token(OM_uint32 *minor_status, ++ const gss_ctx_id_t context_handle, ++ const gss_buffer_t token_buffer); ++ ++OM_uint32 KRB5_CALLCONV ++iakerb_gss_context_time(OM_uint32 *minor_status, gss_ctx_id_t context_handle, ++ OM_uint32 *time_rec); ++ ++OM_uint32 KRB5_CALLCONV ++iakerb_gss_inquire_context(OM_uint32 *minor_status, ++ gss_ctx_id_t context_handle, gss_name_t *src_name, ++ gss_name_t *targ_name, OM_uint32 *lifetime_rec, ++ gss_OID *mech_type, OM_uint32 *ctx_flags, ++ int *locally_initiated, int *opened); ++ ++OM_uint32 KRB5_CALLCONV ++iakerb_gss_get_mic(OM_uint32 *minor_status, gss_ctx_id_t context_handle, ++ gss_qop_t qop_req, gss_buffer_t message_buffer, ++ gss_buffer_t message_token); ++ ++OM_uint32 KRB5_CALLCONV ++iakerb_gss_get_mic_iov(OM_uint32 *minor_status, gss_ctx_id_t context_handle, ++ gss_qop_t qop_req, gss_iov_buffer_desc *iov, ++ int iov_count); ++ ++OM_uint32 KRB5_CALLCONV ++iakerb_gss_get_mic_iov_length(OM_uint32 *minor_status, ++ gss_ctx_id_t context_handle, gss_qop_t qop_req, ++ gss_iov_buffer_desc *iov, int iov_count); ++ ++OM_uint32 KRB5_CALLCONV ++iakerb_gss_verify_mic(OM_uint32 *minor_status, gss_ctx_id_t context_handle, ++ gss_buffer_t msg_buffer, gss_buffer_t token_buffer, ++ gss_qop_t *qop_state); ++ ++OM_uint32 KRB5_CALLCONV ++iakerb_gss_verify_mic_iov(OM_uint32 *minor_status, gss_ctx_id_t context_handle, ++ gss_qop_t *qop_state, gss_iov_buffer_desc *iov, ++ int iov_count); ++ ++OM_uint32 KRB5_CALLCONV ++iakerb_gss_wrap(OM_uint32 *minor_status, gss_ctx_id_t context_handle, ++ int conf_req_flag, gss_qop_t qop_req, ++ gss_buffer_t input_message_buffer, int *conf_state, ++ gss_buffer_t output_message_buffer); ++ ++OM_uint32 KRB5_CALLCONV ++iakerb_gss_wrap_iov(OM_uint32 *minor_status, gss_ctx_id_t context_handle, ++ int conf_req_flag, gss_qop_t qop_req, int *conf_state, ++ gss_iov_buffer_desc *iov, int iov_count); ++ ++OM_uint32 KRB5_CALLCONV ++iakerb_gss_wrap_iov_length(OM_uint32 *minor_status, ++ gss_ctx_id_t context_handle, int conf_req_flag, ++ gss_qop_t qop_req, int *conf_state, ++ gss_iov_buffer_desc *iov, int iov_count); ++ ++OM_uint32 KRB5_CALLCONV ++iakerb_gss_unwrap(OM_uint32 *minor_status, gss_ctx_id_t context_handle, ++ gss_buffer_t input_message_buffer, ++ gss_buffer_t output_message_buffer, int *conf_state, ++ gss_qop_t *qop_state); ++ ++OM_uint32 KRB5_CALLCONV ++iakerb_gss_unwrap_iov(OM_uint32 *minor_status, gss_ctx_id_t context_handle, ++ int *conf_state, gss_qop_t *qop_state, ++ gss_iov_buffer_desc *iov, int iov_count); ++ ++OM_uint32 KRB5_CALLCONV ++iakerb_gss_wrap_size_limit(OM_uint32 *minor_status, ++ gss_ctx_id_t context_handle, int conf_req_flag, ++ gss_qop_t qop_req, OM_uint32 req_output_size, ++ OM_uint32 *max_input_size); ++ ++#ifndef LEAN_CLIENT ++OM_uint32 KRB5_CALLCONV ++iakerb_gss_export_sec_context(OM_uint32 *minor_status, ++ gss_ctx_id_t *context_handle, ++ gss_buffer_t interprocess_token); ++#endif /* LEAN_CLIENT */ ++ ++OM_uint32 KRB5_CALLCONV ++iakerb_gss_inquire_sec_context_by_oid(OM_uint32 *minor_status, ++ const gss_ctx_id_t context_handle, ++ const gss_OID desired_object, ++ gss_buffer_set_t *data_set); ++ ++OM_uint32 KRB5_CALLCONV ++iakerb_gss_set_sec_context_option(OM_uint32 *minor_status, ++ gss_ctx_id_t *context_handle, ++ const gss_OID desired_object, ++ const gss_buffer_t value); ++ ++OM_uint32 KRB5_CALLCONV ++iakerb_gss_pseudo_random(OM_uint32 *minor_status, gss_ctx_id_t context_handle, ++ int prf_key, const gss_buffer_t prf_in, ++ ssize_t desired_output_len, gss_buffer_t prf_out); ++ + /* Magic string to identify exported krb5 GSS credentials. Increment this if + * the format changes. */ + #define CRED_EXPORT_MAGIC "K5C1" +diff --git a/src/lib/gssapi/krb5/gssapi_krb5.c b/src/lib/gssapi/krb5/gssapi_krb5.c +index 088219a..61a6922 100644 +--- a/src/lib/gssapi/krb5/gssapi_krb5.c ++++ b/src/lib/gssapi/krb5/gssapi_krb5.c +@@ -345,7 +345,7 @@ static struct { + } + }; + +-static OM_uint32 KRB5_CALLCONV ++OM_uint32 KRB5_CALLCONV + krb5_gss_inquire_sec_context_by_oid (OM_uint32 *minor_status, + const gss_ctx_id_t context_handle, + const gss_OID desired_object, +@@ -459,7 +459,7 @@ static struct { + }; + #endif + +-static OM_uint32 KRB5_CALLCONV ++OM_uint32 KRB5_CALLCONV + krb5_gss_set_sec_context_option (OM_uint32 *minor_status, + gss_ctx_id_t *context_handle, + const gss_OID desired_object, +@@ -904,20 +904,103 @@ static struct gss_config krb5_mechanism = { + krb5_gss_get_mic_iov_length, + }; + ++/* Functions which use security contexts or acquire creds are IAKERB-specific; ++ * other functions can borrow from the krb5 mech. */ ++static struct gss_config iakerb_mechanism = { ++ { GSS_MECH_KRB5_OID_LENGTH, GSS_MECH_KRB5_OID }, ++ NULL, ++ iakerb_gss_acquire_cred, ++ krb5_gss_release_cred, ++ iakerb_gss_init_sec_context, ++#ifdef LEAN_CLIENT ++ NULL, ++#else ++ iakerb_gss_accept_sec_context, ++#endif ++ iakerb_gss_process_context_token, ++ iakerb_gss_delete_sec_context, ++ iakerb_gss_context_time, ++ iakerb_gss_get_mic, ++ iakerb_gss_verify_mic, ++#if defined(IOV_SHIM_EXERCISE_WRAP) || defined(IOV_SHIM_EXERCISE) ++ NULL, ++#else ++ iakerb_gss_wrap, ++#endif ++#if defined(IOV_SHIM_EXERCISE_UNWRAP) || defined(IOV_SHIM_EXERCISE) ++ NULL, ++#else ++ iakerb_gss_unwrap, ++#endif ++ krb5_gss_display_status, ++ krb5_gss_indicate_mechs, ++ krb5_gss_compare_name, ++ krb5_gss_display_name, ++ krb5_gss_import_name, ++ krb5_gss_release_name, ++ krb5_gss_inquire_cred, ++ NULL, /* add_cred */ ++#ifdef LEAN_CLIENT ++ NULL, ++ NULL, ++#else ++ iakerb_gss_export_sec_context, ++ NULL, ++#endif ++ krb5_gss_inquire_cred_by_mech, ++ krb5_gss_inquire_names_for_mech, ++ iakerb_gss_inquire_context, ++ krb5_gss_internal_release_oid, ++ iakerb_gss_wrap_size_limit, ++ krb5_gss_localname, ++ krb5_gss_authorize_localname, ++ krb5_gss_export_name, ++ krb5_gss_duplicate_name, ++ krb5_gss_store_cred, ++ iakerb_gss_inquire_sec_context_by_oid, ++ krb5_gss_inquire_cred_by_oid, ++ iakerb_gss_set_sec_context_option, ++ krb5_gssspi_set_cred_option, ++ krb5_gssspi_mech_invoke, ++ NULL, /* wrap_aead */ ++ NULL, /* unwrap_aead */ ++ iakerb_gss_wrap_iov, ++ iakerb_gss_unwrap_iov, ++ iakerb_gss_wrap_iov_length, ++ NULL, /* complete_auth_token */ ++ NULL, /* acquire_cred_impersonate_name */ ++ NULL, /* add_cred_impersonate_name */ ++ NULL, /* display_name_ext */ ++ krb5_gss_inquire_name, ++ krb5_gss_get_name_attribute, ++ krb5_gss_set_name_attribute, ++ krb5_gss_delete_name_attribute, ++ krb5_gss_export_name_composite, ++ krb5_gss_map_name_to_any, ++ krb5_gss_release_any_name_mapping, ++ iakerb_gss_pseudo_random, ++ NULL, /* set_neg_mechs */ ++ krb5_gss_inquire_saslname_for_mech, ++ krb5_gss_inquire_mech_for_saslname, ++ krb5_gss_inquire_attrs_for_mech, ++ krb5_gss_acquire_cred_from, ++ krb5_gss_store_cred_into, ++ iakerb_gss_acquire_cred_with_password, ++ krb5_gss_export_cred, ++ krb5_gss_import_cred, ++ NULL, /* import_sec_context_by_mech */ ++ NULL, /* import_name_by_mech */ ++ NULL, /* import_cred_by_mech */ ++ iakerb_gss_get_mic_iov, ++ iakerb_gss_verify_mic_iov, ++ iakerb_gss_get_mic_iov_length, ++}; ++ + #ifdef _GSS_STATIC_LINK + #include "mglueP.h" + static int gss_iakerbmechglue_init(void) + { + struct gss_mech_config mech_iakerb; +- struct gss_config iakerb_mechanism = krb5_mechanism; +- +- /* IAKERB mechanism mirrors krb5, but with different context SPIs */ +- iakerb_mechanism.gss_accept_sec_context = iakerb_gss_accept_sec_context; +- iakerb_mechanism.gss_init_sec_context = iakerb_gss_init_sec_context; +- iakerb_mechanism.gss_delete_sec_context = iakerb_gss_delete_sec_context; +- iakerb_mechanism.gss_acquire_cred = iakerb_gss_acquire_cred; +- iakerb_mechanism.gssspi_acquire_cred_with_password +- = iakerb_gss_acquire_cred_with_password; + + memset(&mech_iakerb, 0, sizeof(mech_iakerb)); + mech_iakerb.mech = &iakerb_mechanism; +diff --git a/src/lib/gssapi/krb5/iakerb.c b/src/lib/gssapi/krb5/iakerb.c +index f30de32..4662bd9 100644 +--- a/src/lib/gssapi/krb5/iakerb.c ++++ b/src/lib/gssapi/krb5/iakerb.c +@@ -47,6 +47,8 @@ struct _iakerb_ctx_id_rec { + gss_ctx_id_t gssc; + krb5_data conv; /* conversation for checksumming */ + unsigned int count; /* number of round trips */ ++ int initiate; ++ int established; + krb5_get_init_creds_opt *gic_opts; + }; + +@@ -695,7 +697,7 @@ cleanup: + * Allocate and initialise an IAKERB context + */ + static krb5_error_code +-iakerb_alloc_context(iakerb_ctx_id_t *pctx) ++iakerb_alloc_context(iakerb_ctx_id_t *pctx, int initiate) + { + iakerb_ctx_id_t ctx; + krb5_error_code code; +@@ -709,6 +711,8 @@ iakerb_alloc_context(iakerb_ctx_id_t *pctx) + ctx->magic = KG_IAKERB_CONTEXT; + ctx->state = IAKERB_AS_REQ; + ctx->count = 0; ++ ctx->initiate = initiate; ++ ctx->established = 0; + + code = krb5_gss_init_context(&ctx->k5c); + if (code != 0) +@@ -732,7 +736,7 @@ iakerb_gss_delete_sec_context(OM_uint32 *minor_status, + gss_ctx_id_t *context_handle, + gss_buffer_t output_token) + { +- OM_uint32 major_status = GSS_S_COMPLETE; ++ iakerb_ctx_id_t iakerb_ctx = (iakerb_ctx_id_t)*context_handle; + + if (output_token != GSS_C_NO_BUFFER) { + output_token->length = 0; +@@ -740,23 +744,10 @@ iakerb_gss_delete_sec_context(OM_uint32 *minor_status, + } + + *minor_status = 0; ++ *context_handle = GSS_C_NO_CONTEXT; ++ iakerb_release_context(iakerb_ctx); + +- if (*context_handle != GSS_C_NO_CONTEXT) { +- iakerb_ctx_id_t iakerb_ctx = (iakerb_ctx_id_t)*context_handle; +- +- if (iakerb_ctx->magic == KG_IAKERB_CONTEXT) { +- iakerb_release_context(iakerb_ctx); +- *context_handle = GSS_C_NO_CONTEXT; +- } else { +- assert(iakerb_ctx->magic == KG_CONTEXT); +- +- major_status = krb5_gss_delete_sec_context(minor_status, +- context_handle, +- output_token); +- } +- } +- +- return major_status; ++ return GSS_S_COMPLETE; + } + + static krb5_boolean +@@ -802,7 +793,7 @@ iakerb_gss_accept_sec_context(OM_uint32 *minor_status, + int initialContextToken = (*context_handle == GSS_C_NO_CONTEXT); + + if (initialContextToken) { +- code = iakerb_alloc_context(&ctx); ++ code = iakerb_alloc_context(&ctx, 0); + if (code != 0) + goto cleanup; + +@@ -854,11 +845,8 @@ iakerb_gss_accept_sec_context(OM_uint32 *minor_status, + time_rec, + delegated_cred_handle, + &exts); +- if (major_status == GSS_S_COMPLETE) { +- *context_handle = ctx->gssc; +- ctx->gssc = NULL; +- iakerb_release_context(ctx); +- } ++ if (major_status == GSS_S_COMPLETE) ++ ctx->established = 1; + if (mech_type != NULL) + *mech_type = (gss_OID)gss_mech_krb5; + } +@@ -897,7 +885,7 @@ iakerb_gss_init_sec_context(OM_uint32 *minor_status, + int initialContextToken = (*context_handle == GSS_C_NO_CONTEXT); + + if (initialContextToken) { +- code = iakerb_alloc_context(&ctx); ++ code = iakerb_alloc_context(&ctx, 1); + if (code != 0) { + *minor_status = code; + goto cleanup; +@@ -983,11 +971,8 @@ iakerb_gss_init_sec_context(OM_uint32 *minor_status, + ret_flags, + time_rec, + &exts); +- if (major_status == GSS_S_COMPLETE) { +- *context_handle = ctx->gssc; +- ctx->gssc = GSS_C_NO_CONTEXT; +- iakerb_release_context(ctx); +- } ++ if (major_status == GSS_S_COMPLETE) ++ ctx->established = 1; + if (actual_mech_type != NULL) + *actual_mech_type = (gss_OID)gss_mech_krb5; + } else { +@@ -1010,3 +995,309 @@ cleanup: + + return major_status; + } ++ ++OM_uint32 KRB5_CALLCONV ++iakerb_gss_unwrap(OM_uint32 *minor_status, gss_ctx_id_t context_handle, ++ gss_buffer_t input_message_buffer, ++ gss_buffer_t output_message_buffer, int *conf_state, ++ gss_qop_t *qop_state) ++{ ++ iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle; ++ ++ if (ctx->gssc == GSS_C_NO_CONTEXT) ++ return GSS_S_NO_CONTEXT; ++ ++ return krb5_gss_unwrap(minor_status, ctx->gssc, input_message_buffer, ++ output_message_buffer, conf_state, qop_state); ++} ++ ++OM_uint32 KRB5_CALLCONV ++iakerb_gss_wrap(OM_uint32 *minor_status, gss_ctx_id_t context_handle, ++ int conf_req_flag, gss_qop_t qop_req, ++ gss_buffer_t input_message_buffer, int *conf_state, ++ gss_buffer_t output_message_buffer) ++{ ++ iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle; ++ ++ if (ctx->gssc == GSS_C_NO_CONTEXT) ++ return GSS_S_NO_CONTEXT; ++ ++ return krb5_gss_wrap(minor_status, ctx->gssc, conf_req_flag, qop_req, ++ input_message_buffer, conf_state, ++ output_message_buffer); ++} ++ ++OM_uint32 KRB5_CALLCONV ++iakerb_gss_process_context_token(OM_uint32 *minor_status, ++ const gss_ctx_id_t context_handle, ++ const gss_buffer_t token_buffer) ++{ ++ iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle; ++ ++ if (ctx->gssc == GSS_C_NO_CONTEXT) ++ return GSS_S_DEFECTIVE_TOKEN; ++ ++ return krb5_gss_process_context_token(minor_status, ctx->gssc, ++ token_buffer); ++} ++ ++OM_uint32 KRB5_CALLCONV ++iakerb_gss_context_time(OM_uint32 *minor_status, gss_ctx_id_t context_handle, ++ OM_uint32 *time_rec) ++{ ++ iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle; ++ ++ if (ctx->gssc == GSS_C_NO_CONTEXT) ++ return GSS_S_NO_CONTEXT; ++ ++ return krb5_gss_context_time(minor_status, ctx->gssc, time_rec); ++} ++ ++#ifndef LEAN_CLIENT ++ ++OM_uint32 KRB5_CALLCONV ++iakerb_gss_export_sec_context(OM_uint32 *minor_status, ++ gss_ctx_id_t *context_handle, ++ gss_buffer_t interprocess_token) ++{ ++ OM_uint32 maj; ++ iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle; ++ ++ /* We don't currently support exporting partially established contexts. */ ++ if (!ctx->established) ++ return GSS_S_UNAVAILABLE; ++ ++ maj = krb5_gss_export_sec_context(minor_status, &ctx->gssc, ++ interprocess_token); ++ if (ctx->gssc == GSS_C_NO_CONTEXT) { ++ iakerb_release_context(ctx); ++ *context_handle = GSS_C_NO_CONTEXT; ++ } ++ return maj; ++} ++ ++/* ++ * Until we implement partial context exports, there are no SPNEGO exported ++ * context tokens, only tokens for the underlying krb5 context. So we do not ++ * need to implement an iakerb_gss_import_sec_context() yet; it would be ++ * unreachable except via a manually constructed token. ++ */ ++ ++#endif /* LEAN_CLIENT */ ++ ++OM_uint32 KRB5_CALLCONV ++iakerb_gss_inquire_context(OM_uint32 *minor_status, ++ gss_ctx_id_t context_handle, gss_name_t *src_name, ++ gss_name_t *targ_name, OM_uint32 *lifetime_rec, ++ gss_OID *mech_type, OM_uint32 *ctx_flags, ++ int *initiate, int *opened) ++{ ++ OM_uint32 ret; ++ iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle; ++ ++ if (src_name != NULL) ++ *src_name = GSS_C_NO_NAME; ++ if (targ_name != NULL) ++ *targ_name = GSS_C_NO_NAME; ++ if (lifetime_rec != NULL) ++ *lifetime_rec = 0; ++ if (mech_type != NULL) ++ *mech_type = (gss_OID)gss_mech_iakerb; ++ if (ctx_flags != NULL) ++ *ctx_flags = 0; ++ if (initiate != NULL) ++ *initiate = ctx->initiate; ++ if (opened != NULL) ++ *opened = ctx->established; ++ ++ if (ctx->gssc == GSS_C_NO_CONTEXT) ++ return GSS_S_COMPLETE; ++ ++ ret = krb5_gss_inquire_context(minor_status, ctx->gssc, src_name, ++ targ_name, lifetime_rec, mech_type, ++ ctx_flags, initiate, opened); ++ ++ if (!ctx->established) { ++ /* Report IAKERB as the mech OID until the context is established. */ ++ if (mech_type != NULL) ++ *mech_type = (gss_OID)gss_mech_iakerb; ++ ++ /* We don't support exporting partially-established contexts. */ ++ if (ctx_flags != NULL) ++ *ctx_flags &= ~GSS_C_TRANS_FLAG; ++ } ++ ++ return ret; ++} ++ ++OM_uint32 KRB5_CALLCONV ++iakerb_gss_wrap_size_limit(OM_uint32 *minor_status, ++ gss_ctx_id_t context_handle, int conf_req_flag, ++ gss_qop_t qop_req, OM_uint32 req_output_size, ++ OM_uint32 *max_input_size) ++{ ++ iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle; ++ ++ if (ctx->gssc == GSS_C_NO_CONTEXT) ++ return GSS_S_NO_CONTEXT; ++ ++ return krb5_gss_wrap_size_limit(minor_status, ctx->gssc, conf_req_flag, ++ qop_req, req_output_size, max_input_size); ++} ++ ++OM_uint32 KRB5_CALLCONV ++iakerb_gss_get_mic(OM_uint32 *minor_status, gss_ctx_id_t context_handle, ++ gss_qop_t qop_req, gss_buffer_t message_buffer, ++ gss_buffer_t message_token) ++{ ++ iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle; ++ ++ if (ctx->gssc == GSS_C_NO_CONTEXT) ++ return GSS_S_NO_CONTEXT; ++ ++ return krb5_gss_get_mic(minor_status, ctx->gssc, qop_req, message_buffer, ++ message_token); ++} ++ ++OM_uint32 KRB5_CALLCONV ++iakerb_gss_verify_mic(OM_uint32 *minor_status, gss_ctx_id_t context_handle, ++ gss_buffer_t msg_buffer, gss_buffer_t token_buffer, ++ gss_qop_t *qop_state) ++{ ++ iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle; ++ ++ if (ctx->gssc == GSS_C_NO_CONTEXT) ++ return GSS_S_NO_CONTEXT; ++ ++ return krb5_gss_verify_mic(minor_status, ctx->gssc, msg_buffer, ++ token_buffer, qop_state); ++} ++ ++OM_uint32 KRB5_CALLCONV ++iakerb_gss_inquire_sec_context_by_oid(OM_uint32 *minor_status, ++ const gss_ctx_id_t context_handle, ++ const gss_OID desired_object, ++ gss_buffer_set_t *data_set) ++{ ++ iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle; ++ ++ if (ctx->gssc == GSS_C_NO_CONTEXT) ++ return GSS_S_UNAVAILABLE; ++ ++ return krb5_gss_inquire_sec_context_by_oid(minor_status, ctx->gssc, ++ desired_object, data_set); ++} ++ ++OM_uint32 KRB5_CALLCONV ++iakerb_gss_set_sec_context_option(OM_uint32 *minor_status, ++ gss_ctx_id_t *context_handle, ++ const gss_OID desired_object, ++ const gss_buffer_t value) ++{ ++ iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)*context_handle; ++ ++ if (ctx == NULL || ctx->gssc == GSS_C_NO_CONTEXT) ++ return GSS_S_UNAVAILABLE; ++ ++ return krb5_gss_set_sec_context_option(minor_status, &ctx->gssc, ++ desired_object, value); ++} ++ ++OM_uint32 KRB5_CALLCONV ++iakerb_gss_wrap_iov(OM_uint32 *minor_status, gss_ctx_id_t context_handle, ++ int conf_req_flag, gss_qop_t qop_req, int *conf_state, ++ gss_iov_buffer_desc *iov, int iov_count) ++{ ++ iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle; ++ ++ if (ctx->gssc == GSS_C_NO_CONTEXT) ++ return GSS_S_NO_CONTEXT; ++ ++ return krb5_gss_wrap_iov(minor_status, ctx->gssc, conf_req_flag, qop_req, ++ conf_state, iov, iov_count); ++} ++ ++OM_uint32 KRB5_CALLCONV ++iakerb_gss_unwrap_iov(OM_uint32 *minor_status, gss_ctx_id_t context_handle, ++ int *conf_state, gss_qop_t *qop_state, ++ gss_iov_buffer_desc *iov, int iov_count) ++{ ++ iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle; ++ ++ if (ctx->gssc == GSS_C_NO_CONTEXT) ++ return GSS_S_NO_CONTEXT; ++ ++ return krb5_gss_unwrap_iov(minor_status, ctx->gssc, conf_state, qop_state, ++ iov, iov_count); ++} ++ ++OM_uint32 KRB5_CALLCONV ++iakerb_gss_wrap_iov_length(OM_uint32 *minor_status, ++ gss_ctx_id_t context_handle, int conf_req_flag, ++ gss_qop_t qop_req, int *conf_state, ++ gss_iov_buffer_desc *iov, int iov_count) ++{ ++ iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle; ++ ++ if (ctx->gssc == GSS_C_NO_CONTEXT) ++ return GSS_S_NO_CONTEXT; ++ ++ return krb5_gss_wrap_iov_length(minor_status, ctx->gssc, conf_req_flag, ++ qop_req, conf_state, iov, iov_count); ++} ++ ++OM_uint32 KRB5_CALLCONV ++iakerb_gss_pseudo_random(OM_uint32 *minor_status, gss_ctx_id_t context_handle, ++ int prf_key, const gss_buffer_t prf_in, ++ ssize_t desired_output_len, gss_buffer_t prf_out) ++{ ++ iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle; ++ ++ if (ctx->gssc == GSS_C_NO_CONTEXT) ++ return GSS_S_NO_CONTEXT; ++ ++ return krb5_gss_pseudo_random(minor_status, ctx->gssc, prf_key, prf_in, ++ desired_output_len, prf_out); ++} ++ ++OM_uint32 KRB5_CALLCONV ++iakerb_gss_get_mic_iov(OM_uint32 *minor_status, gss_ctx_id_t context_handle, ++ gss_qop_t qop_req, gss_iov_buffer_desc *iov, ++ int iov_count) ++{ ++ iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle; ++ ++ if (ctx->gssc == GSS_C_NO_CONTEXT) ++ return GSS_S_NO_CONTEXT; ++ ++ return krb5_gss_get_mic_iov(minor_status, ctx->gssc, qop_req, iov, ++ iov_count); ++} ++ ++OM_uint32 KRB5_CALLCONV ++iakerb_gss_verify_mic_iov(OM_uint32 *minor_status, gss_ctx_id_t context_handle, ++ gss_qop_t *qop_state, gss_iov_buffer_desc *iov, ++ int iov_count) ++{ ++ iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle; ++ ++ if (ctx->gssc == GSS_C_NO_CONTEXT) ++ return GSS_S_NO_CONTEXT; ++ ++ return krb5_gss_verify_mic_iov(minor_status, ctx->gssc, qop_state, iov, ++ iov_count); ++} ++ ++OM_uint32 KRB5_CALLCONV ++iakerb_gss_get_mic_iov_length(OM_uint32 *minor_status, ++ gss_ctx_id_t context_handle, gss_qop_t qop_req, ++ gss_iov_buffer_desc *iov, int iov_count) ++{ ++ iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle; ++ ++ if (ctx->gssc == GSS_C_NO_CONTEXT) ++ return GSS_S_NO_CONTEXT; ++ ++ return krb5_gss_get_mic_iov_length(minor_status, ctx->gssc, qop_req, iov, ++ iov_count); ++} diff -Nru krb5-1.12+dfsg/debian/patches/0033-Fix-build_principal-memory-bug-CVE-2015-2697.patch krb5-1.12+dfsg/debian/patches/0033-Fix-build_principal-memory-bug-CVE-2015-2697.patch --- krb5-1.12+dfsg/debian/patches/0033-Fix-build_principal-memory-bug-CVE-2015-2697.patch 1970-01-01 00:00:00.000000000 +0000 +++ krb5-1.12+dfsg/debian/patches/0033-Fix-build_principal-memory-bug-CVE-2015-2697.patch 2015-11-11 14:07:36.000000000 +0000 @@ -0,0 +1,55 @@ +From 8ab3d571e2ef808f0167ddcee34334d7653b914b Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Fri, 25 Sep 2015 12:51:47 -0400 +Subject: Fix build_principal memory bug [CVE-2015-2697] + +In build_principal_va(), use k5memdup0() instead of strdup() to make a +copy of the realm, to ensure that we allocate the correct number of +bytes and do not read past the end of the input string. This bug +affects krb5_build_principal(), krb5_build_principal_va(), and +krb5_build_principal_alloc_va(). krb5_build_principal_ext() is not +affected. + +CVE-2015-2697: + +In MIT krb5 1.7 and later, an authenticated attacker may be able to +cause a KDC to crash using a TGS request with a large realm field +beginning with a null byte. If the KDC attempts to find a referral to +answer the request, it constructs a principal name for lookup using +krb5_build_principal() with the requested realm. Due to a bug in this +function, the null byte causes only one byte be allocated for the +realm field of the constructed principal, far less than its length. +Subsequent operations on the lookup principal may cause a read beyond +the end of the mapped memory region, causing the KDC process to crash. + +CVSSv2: AV:N/AC:L/Au:S/C:N/I:N/A:C/E:POC/RL:OF/RC:C + +ticket: 8252 (new) +target_version: 1.14 +tags: pullup + +(cherry picked from commit f0c094a1b745d91ef2f9a4eae2149aac026a5789) +(cherry picked from commit fcafb522a0509bfd6f4f6b57e4a1e93c0092eeb0) + +Patch-Category: upstream +--- + src/lib/krb5/krb/bld_princ.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/src/lib/krb5/krb/bld_princ.c b/src/lib/krb5/krb/bld_princ.c +index 3dbe356..442cbf5 100644 +--- a/src/lib/krb5/krb/bld_princ.c ++++ b/src/lib/krb5/krb/bld_princ.c +@@ -41,10 +41,8 @@ build_principal_va(krb5_context context, krb5_principal princ, + data = malloc(size * sizeof(krb5_data)); + if (!data) { retval = ENOMEM; } + +- if (!retval) { +- r = strdup(realm); +- if (!r) { retval = ENOMEM; } +- } ++ if (!retval) ++ r = k5memdup0(realm, rlen, &retval); + + while (!retval && (component = va_arg(ap, char *))) { + if (count == size) { diff -Nru krb5-1.12+dfsg/debian/patches/0034-Fix-two-IAKERB-comments.patch krb5-1.12+dfsg/debian/patches/0034-Fix-two-IAKERB-comments.patch --- krb5-1.12+dfsg/debian/patches/0034-Fix-two-IAKERB-comments.patch 1970-01-01 00:00:00.000000000 +0000 +++ krb5-1.12+dfsg/debian/patches/0034-Fix-two-IAKERB-comments.patch 2015-11-11 14:07:42.000000000 +0000 @@ -0,0 +1,41 @@ +From 0874247af914192102c97c49941772b24ec5136c Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Tue, 27 Oct 2015 00:44:24 -0400 +Subject: Fix two IAKERB comments + +The comment explaining why there is no iakerb_gss_import_sec_context() +erroneously referenced SPNEGO instead of IAKERB (noticed by Ben +Kaduk). The comment above iakerb_gss_delete_sec_context() is out of +date after the last commit. + +(cherry picked from commit 92d6dd045dfc06cc03d20b327a6ee7a71e6bc24d) + +Patch-Category: upstream +--- + src/lib/gssapi/krb5/iakerb.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +diff --git a/src/lib/gssapi/krb5/iakerb.c b/src/lib/gssapi/krb5/iakerb.c +index 4662bd9..e25862d 100644 +--- a/src/lib/gssapi/krb5/iakerb.c ++++ b/src/lib/gssapi/krb5/iakerb.c +@@ -727,10 +727,6 @@ cleanup: + return code; + } + +-/* +- * Delete an IAKERB context. This can also accept Kerberos context +- * handles. The heuristic is similar to SPNEGO's delete_sec_context. +- */ + OM_uint32 KRB5_CALLCONV + iakerb_gss_delete_sec_context(OM_uint32 *minor_status, + gss_ctx_id_t *context_handle, +@@ -1077,7 +1073,7 @@ iakerb_gss_export_sec_context(OM_uint32 *minor_status, + } + + /* +- * Until we implement partial context exports, there are no SPNEGO exported ++ * Until we implement partial context exports, there are no IAKERB exported + * context tokens, only tokens for the underlying krb5 context. So we do not + * need to implement an iakerb_gss_import_sec_context() yet; it would be + * unreachable except via a manually constructed token. diff -Nru krb5-1.12+dfsg/debian/patches/0035-Fix-IAKERB-context-export-import-CVE-2015-2698.patch krb5-1.12+dfsg/debian/patches/0035-Fix-IAKERB-context-export-import-CVE-2015-2698.patch --- krb5-1.12+dfsg/debian/patches/0035-Fix-IAKERB-context-export-import-CVE-2015-2698.patch 1970-01-01 00:00:00.000000000 +0000 +++ krb5-1.12+dfsg/debian/patches/0035-Fix-IAKERB-context-export-import-CVE-2015-2698.patch 2015-11-11 14:07:47.000000000 +0000 @@ -0,0 +1,130 @@ +From 5651adc61b31dcad69a35be5ef631586cd33ff87 Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Wed, 4 Nov 2015 21:28:28 -0500 +Subject: Fix IAKERB context export/import [CVE-2015-2698] + +The patches for CVE-2015-2696 contained a regression in the newly +added IAKERB iakerb_gss_export_sec_context() function, which could +cause it to corrupt memory. Fix the regression by properly +dereferencing the context_handle pointer before casting it. + +Also, the patches did not implement an IAKERB gss_import_sec_context() +function, under the erroneous belief than an exported IAKERB context +would be tagged as a krb5 context. Implement it now to allow IAKERB +contexts to be successfully exported and imported after establishment. + +CVE-2015-2698: + +In any MIT krb5 release with the patches for CVE-2015-2696 applied, an +application which calls gss_export_sec_context() may experience memory +corruption if the context was established using the IAKERB mechanism. +Historically, some vulnerabilities of this nature can be translated +into remote code execution, though the necessary exploits must be +tailored to the individual application and are usually quite +complicated. + + CVSSv2 Vector: AV:N/AC:H/Au:S/C:C/I:C/A:C/E:POC/RL:OF/RC:C + +ticket: 8273 (new) +target_version: 1.14 +tags: pullup + +(cherry picked from commit d8b31c874c7d1039be7649362ef11c89f4e14c27) + +Patch-Category: upstream +--- + src/lib/gssapi/krb5/gssapiP_krb5.h | 5 +++++ + src/lib/gssapi/krb5/gssapi_krb5.c | 2 +- + src/lib/gssapi/krb5/iakerb.c | 42 +++++++++++++++++++++++++++++++------- + 3 files changed, 41 insertions(+), 8 deletions(-) + +diff --git a/src/lib/gssapi/krb5/gssapiP_krb5.h b/src/lib/gssapi/krb5/gssapiP_krb5.h +index b14788d..1ae40c9 100644 +--- a/src/lib/gssapi/krb5/gssapiP_krb5.h ++++ b/src/lib/gssapi/krb5/gssapiP_krb5.h +@@ -1393,6 +1393,11 @@ OM_uint32 KRB5_CALLCONV + iakerb_gss_export_sec_context(OM_uint32 *minor_status, + gss_ctx_id_t *context_handle, + gss_buffer_t interprocess_token); ++ ++OM_uint32 KRB5_CALLCONV ++iakerb_gss_import_sec_context(OM_uint32 *minor_status, ++ const gss_buffer_t interprocess_token, ++ gss_ctx_id_t *context_handle); + #endif /* LEAN_CLIENT */ + + OM_uint32 KRB5_CALLCONV +diff --git a/src/lib/gssapi/krb5/gssapi_krb5.c b/src/lib/gssapi/krb5/gssapi_krb5.c +index 61a6922..4931f86 100644 +--- a/src/lib/gssapi/krb5/gssapi_krb5.c ++++ b/src/lib/gssapi/krb5/gssapi_krb5.c +@@ -945,7 +945,7 @@ static struct gss_config iakerb_mechanism = { + NULL, + #else + iakerb_gss_export_sec_context, +- NULL, ++ iakerb_gss_import_sec_context, + #endif + krb5_gss_inquire_cred_by_mech, + krb5_gss_inquire_names_for_mech, +diff --git a/src/lib/gssapi/krb5/iakerb.c b/src/lib/gssapi/krb5/iakerb.c +index e25862d..32a341e 100644 +--- a/src/lib/gssapi/krb5/iakerb.c ++++ b/src/lib/gssapi/krb5/iakerb.c +@@ -1057,7 +1057,7 @@ iakerb_gss_export_sec_context(OM_uint32 *minor_status, + gss_buffer_t interprocess_token) + { + OM_uint32 maj; +- iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)context_handle; ++ iakerb_ctx_id_t ctx = (iakerb_ctx_id_t)*context_handle; + + /* We don't currently support exporting partially established contexts. */ + if (!ctx->established) +@@ -1072,13 +1072,41 @@ iakerb_gss_export_sec_context(OM_uint32 *minor_status, + return maj; + } + +-/* +- * Until we implement partial context exports, there are no IAKERB exported +- * context tokens, only tokens for the underlying krb5 context. So we do not +- * need to implement an iakerb_gss_import_sec_context() yet; it would be +- * unreachable except via a manually constructed token. +- */ ++OM_uint32 KRB5_CALLCONV ++iakerb_gss_import_sec_context(OM_uint32 *minor_status, ++ gss_buffer_t interprocess_token, ++ gss_ctx_id_t *context_handle) ++{ ++ OM_uint32 maj, tmpmin; ++ krb5_error_code code; ++ gss_ctx_id_t gssc; ++ krb5_gss_ctx_id_t kctx; ++ iakerb_ctx_id_t ctx; ++ ++ maj = krb5_gss_import_sec_context(minor_status, interprocess_token, &gssc); ++ if (maj != GSS_S_COMPLETE) ++ return maj; ++ kctx = (krb5_gss_ctx_id_t)gssc; ++ ++ if (!kctx->established) { ++ /* We don't currently support importing partially established ++ * contexts. */ ++ krb5_gss_delete_sec_context(&tmpmin, &gssc, GSS_C_NO_BUFFER); ++ return GSS_S_FAILURE; ++ } + ++ code = iakerb_alloc_context(&ctx, kctx->initiate); ++ if (code != 0) { ++ krb5_gss_delete_sec_context(&tmpmin, &gssc, GSS_C_NO_BUFFER); ++ *minor_status = code; ++ return GSS_S_FAILURE; ++ } ++ ++ ctx->gssc = gssc; ++ ctx->established = 1; ++ *context_handle = (gss_ctx_id_t)ctx; ++ return GSS_S_COMPLETE; ++} + #endif /* LEAN_CLIENT */ + + OM_uint32 KRB5_CALLCONV diff -Nru krb5-1.12+dfsg/debian/patches/0036-Fix-SPNEGO-context-import.patch krb5-1.12+dfsg/debian/patches/0036-Fix-SPNEGO-context-import.patch --- krb5-1.12+dfsg/debian/patches/0036-Fix-SPNEGO-context-import.patch 1970-01-01 00:00:00.000000000 +0000 +++ krb5-1.12+dfsg/debian/patches/0036-Fix-SPNEGO-context-import.patch 2015-11-11 14:08:03.000000000 +0000 @@ -0,0 +1,63 @@ +From 2767f63e5d4d35c16d8a2e4863d15341f9ac0a9b Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Wed, 4 Nov 2015 21:29:10 -0500 +Subject: Fix SPNEGO context import + +The patches for CVE-2015-2695 did not implement a SPNEGO +gss_import_sec_context() function, under the erroneous belief than an +exported SPNEGO context would be tagged with the underlying context +mechanism. Implement it now to allow SPNEGO contexts to be +successfully exported and imported after establishment. + +ticket: 8273 +(cherry picked from commit fbb565f913c52eba9bea82f1694aba7a8c90e93d) + +Patch-Category: upstream +--- + src/lib/gssapi/spnego/spnego_mech.c | 33 +++++++++++++++++++++++++++------ + 1 file changed, 27 insertions(+), 6 deletions(-) + +Index: krb5-1.12+dfsg/src/lib/gssapi/spnego/spnego_mech.c +=================================================================== +--- krb5-1.12+dfsg.orig/src/lib/gssapi/spnego/spnego_mech.c 2015-11-11 09:08:01.168866504 -0500 ++++ krb5-1.12+dfsg/src/lib/gssapi/spnego/spnego_mech.c 2015-11-11 09:08:01.168866504 -0500 +@@ -2188,12 +2188,33 @@ + const gss_buffer_t interprocess_token, + gss_ctx_id_t *context_handle) + { +- /* +- * Until we implement partial context exports, there are no SPNEGO +- * exported context tokens, only tokens for underlying mechs. So just +- * return an error for now. +- */ +- return GSS_S_UNAVAILABLE; ++ OM_uint32 ret, tmpmin; ++ gss_ctx_id_t mctx; ++ spnego_gss_ctx_id_t sc; ++ int initiate, opened; ++ ++ ret = gss_import_sec_context(minor_status, interprocess_token, &mctx); ++ if (ret != GSS_S_COMPLETE) ++ return ret; ++ ++ ret = gss_inquire_context(&tmpmin, mctx, NULL, NULL, NULL, NULL, NULL, ++ &initiate, &opened); ++ if (ret != GSS_S_COMPLETE || !opened) { ++ /* We don't currently support importing partially established ++ * contexts. */ ++ (void) gss_delete_sec_context(&tmpmin, &mctx, GSS_C_NO_BUFFER); ++ return GSS_S_FAILURE; ++ } ++ ++ sc = create_spnego_ctx(initiate); ++ if (sc == NULL) { ++ (void) gss_delete_sec_context(&tmpmin, &mctx, GSS_C_NO_BUFFER); ++ return GSS_S_FAILURE; ++ } ++ sc->ctx_handle = mctx; ++ sc->opened = 1; ++ *context_handle = (gss_ctx_id_t)sc; ++ return GSS_S_COMPLETE; + } + #endif /* LEAN_CLIENT */ + diff -Nru krb5-1.12+dfsg/debian/patches/series krb5-1.12+dfsg/debian/patches/series --- krb5-1.12+dfsg/debian/patches/series 2015-02-06 20:26:07.000000000 +0000 +++ krb5-1.12+dfsg/debian/patches/series 2015-11-11 14:07:58.000000000 +0000 @@ -21,3 +21,11 @@ CVE-2014-9421.patch CVE-2014-9422.patch CVE-2014-9423.patch +0030-Fix-krb5_read_message-handling-CVE-2014-5355.patch +0031-Prevent-requires_preauth-bypass-CVE-2015-2694.patch +0031-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch +0032-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch +0033-Fix-build_principal-memory-bug-CVE-2015-2697.patch +0034-Fix-two-IAKERB-comments.patch +0035-Fix-IAKERB-context-export-import-CVE-2015-2698.patch +0036-Fix-SPNEGO-context-import.patch