Ubuntu
libapache-mod-auth-kerb package

remote heap buffer overflow DoS/code exec

  1. Edgy (6.10)
  2. Bug #78486
Bug #78486 reported by Kees Cook
8
Affects Status Importance Assigned to Milestone
libapache-mod-auth-kerb (Debian)
Fix Released
Unknown
libapache-mod-auth-kerb (Ubuntu)
Invalid
Undecided
Unassigned
Breezy
Fix Released
Undecided
Unassigned
Dapper
Fix Released
Undecided
Unassigned
Edgy
Fix Released
Undecided
Unassigned

Bug Description

Binary package hint: libapache-mod-auth-kerb

Security vulnerability.

CVE References

Revision history for this message
Kees Cook (kees) wrote :

Version 5.3-1, in Feisty, is not vulnerable.

Changed in libapache-mod-auth-kerb:
status: Unconfirmed → Rejected
Bug Watch Updater (bug-watch-updater)
Changed in libapache-mod-auth-kerb:
status: Unknown → Confirmed
Revision history for this message
Michael Bienia (geser) wrote :

Here is a patch extracted from DSA-1247-1:

--- libapache-mod-auth-kerb-4.996-5.0-rc6.orig/spnegokrb5/der_get.c
+++ libapache-mod-auth-kerb-4.996-5.0-rc6/spnegokrb5/der_get.c
@@ -151,7 +151,7 @@
     if (len < 1)
        return ASN1_OVERRUN;

- data->components = malloc(len * sizeof(*data->components));
+ data->components = malloc((len + 1) * sizeof(*data->components));
     if (data->components == NULL && len != 0)
        return ENOMEM;
     data->components[0] = (*p) / 40;

Revision history for this message
Michael Bienia (geser) wrote :

Here is a debdiff for edgy.

Revision history for this message
Michael Bienia (geser) wrote :

Here is a debdiff for dapper.

Revision history for this message
Michael Bienia (geser) wrote :

Here is a debdiff for breezy.

Revision history for this message
Michael Bienia (geser) wrote :

I could only test if the package for edgy builds.
As I've no pbuilder for dapper and breezy anymore I couldn't test the build for those.

Revision history for this message
Michael Bienia (geser) wrote :

Here is an updated debdiff for edgy as the last didn't fix the FTBFS.
It now has the fix for the FTBFS backported from feisty.

Revision history for this message
Kees Cook (kees) wrote :

Great! These look good, thanks. Don't worry about setting "urgency"; Ubuntu doesn't actually use that field yet. I'm building them now, and I'll get them published shortly.

Kees Cook (kees)
Changed in libapache-mod-auth-kerb:
status: Unconfirmed → Fix Committed
status: Unconfirmed → Fix Committed
status: Unconfirmed → Fix Committed
magilus (magilus)
Changed in libapache-mod-auth-kerb:
status: Fix Committed → Fix Released
status: Fix Committed → Fix Released
status: Fix Committed → Fix Released
Bug Watch Updater (bug-watch-updater)
Changed in libapache-mod-auth-kerb:
status: Confirmed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.