authhub-commits March 2011

authhub-commits@lists.fedorahosted.org

1 participants
93 discussions

[AuthHub/krb5-1-8: 71/111] ticket: 6696 version_fixed: 1.8.2 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit e1886905c0a51473493a3a8348ee6075139a02ec Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Wed May 19 18:52:32 2010 +0000 ticket: 6696 version_fixed: 1.8.2 status: resolved pull up r23925 from trunk ------------------------------------------------------------------------ r23925 | tlyu | 2010-04-22 16:04:01 -0400 (Thu, 22 Apr 2010) | 8 lines ticket: 6696 target_version: 1.8.2 tags: pullup Apply patch from Arlene Berry to cease freeing error tokens output by accept_sec_context, allowing them to actually be sent to the initiator. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24057 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/gssapi/mechglue/g_accept_sec_context.c | 3 --- 1 files changed, 0 insertions(+), 3 deletions(-) --- diff --git a/src/lib/gssapi/mechglue/g_accept_sec_context.c b/src/lib/gssapi/mechglue/g_accept_sec_context.c index b4b1525..498bfc4 100644 --- a/src/lib/gssapi/mechglue/g_accept_sec_context.c +++ b/src/lib/gssapi/mechglue/g_accept_sec_context.c @@ -356,9 +356,6 @@ error_out: free(union_ctx_id); } - if (output_token->length) - (void) gss_release_buffer(&temp_minor_status, output_token); - if (src_name) *src_name = GSS_C_NO_NAME;

1 0

[AuthHub/krb5-1-8: 70/111] ticket: 6702 version_fixed: 1.8.2 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 4c995cb142c4c089e67393865affb523f399cab0 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Apr 20 22:37:22 2010 +0000 ticket: 6702 version_fixed: 1.8.2 status: resolved pull up r23912 from trunk ------------------------------------------------------------------------ r23912 | tlyu | 2010-04-20 17:12:10 -0400 (Tue, 20 Apr 2010) | 11 lines ticket: 6702 target_version: 1.8.2 tags: pullup Fix CVE-2010-1230 (MITKRB5-SA-2010-004) double-free in KDC triggered by ticket renewal. Add a test case. See also http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=577490 Thanks to Joel Johnson and Brian Almeida for the reports. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23914 dc483132-0cff-0310-8789-dd5450dbe970 src/kdc/do_tgs_req.c | 2 + src/tests/dejagnu/config/default.exp | 35 +++++++++++++++++++++++ src/tests/dejagnu/krb-standalone/standalone.exp | 4 ++ 3 files changed, 41 insertions(+), 0 deletions(-) --- diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c index b2f0655..76ca94a 100644 --- a/src/kdc/do_tgs_req.c +++ b/src/kdc/do_tgs_req.c @@ -543,6 +543,7 @@ tgt_again: to the caller */ ticket_reply = *(header_ticket); enc_tkt_reply = *(header_ticket->enc_part2); + enc_tkt_reply.authorization_data = NULL; clear(enc_tkt_reply.flags, TKT_FLG_INVALID); } @@ -554,6 +555,7 @@ tgt_again: to the caller */ ticket_reply = *(header_ticket); enc_tkt_reply = *(header_ticket->enc_part2); + enc_tkt_reply.authorization_data = NULL; old_life = enc_tkt_reply.times.endtime - enc_tkt_reply.times.starttime; diff --git a/src/tests/dejagnu/config/default.exp b/src/tests/dejagnu/config/default.exp index 98a9a43..79afd09 100644 --- a/src/tests/dejagnu/config/default.exp +++ b/src/tests/dejagnu/config/default.exp @@ -2226,6 +2226,41 @@ proc kinit { name pass standalone } { return 1 } + +proc kinit_renew { name pass standalone } { + global REALMNAME + global KINIT + global spawn_id + + spawn $KINIT -5 -f $name@$REALMNAME + expect { + "Password for $name@$REALMNAME:" { + verbose "kinit started" + } + timeout { + fail "kinit" + return 0 + } + eof { + fail "kinit" + return 0 + } + } + send "$pass\r" + expect eof + if ![check_exit_status kinit] { + return 0 + } + + spawn $KINIT -R + expect eof + if ![check_exit_status "kinit_renew"] { + return 0 + } + + return 1 +} + # Retrieve a ticket using FAST armor proc kinit_fast { name pass standalone } { global REALMNAME diff --git a/src/tests/dejagnu/krb-standalone/standalone.exp b/src/tests/dejagnu/krb-standalone/standalone.exp index c511798..dbaf95d 100644 --- a/src/tests/dejagnu/krb-standalone/standalone.exp +++ b/src/tests/dejagnu/krb-standalone/standalone.exp @@ -201,6 +201,10 @@ proc doit { } { return } + if ![kinit_renew krbtest/admin adminpass$KEY 1] { + return + } + # Make sure that klist can see the ticket. if ![do_klist "krbtest/admin@$REALMNAME" "krbtgt/$REALMNAME@$REALMNAME" "klist"] { return

1 0

[AuthHub/krb5-1-8: 69/111] krb5-1.8.1-postrelease
by sbose 15 Mar '11

15 Mar '11

commit ddb381a3977a0d805d93f2d601ec356c96c3f1a3 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Thu Apr 8 20:35:03 2010 +0000 krb5-1.8.1-postrelease git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23880 dc483132-0cff-0310-8789-dd5450dbe970 src/patchlevel.h | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) --- diff --git a/src/patchlevel.h b/src/patchlevel.h index 9be96cf..904d40a 100644 --- a/src/patchlevel.h +++ b/src/patchlevel.h @@ -53,6 +53,6 @@ #define KRB5_MAJOR_RELEASE 1 #define KRB5_MINOR_RELEASE 8 #define KRB5_PATCHLEVEL 1 -/* #undef KRB5_RELTAIL */ +#define KRB5_RELTAIL "postrelease" /* #undef KRB5_RELDATE */ -#define KRB5_RELTAG "tags/krb5-1-8-1-final" +#define KRB5_RELTAG "branches/krb5-1-8"

1 0

[AuthHub/krb5-1-8: 68/111] README and patchlevel.h for krb5-1.8.1 final
by sbose 15 Mar '11

15 Mar '11

commit 382e1390ab63ddaa95c01643be2eff71eb995ace Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Thu Apr 8 20:33:32 2010 +0000 README and patchlevel.h for krb5-1.8.1 final git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23878 dc483132-0cff-0310-8789-dd5450dbe970 README | 3 +++ src/patchlevel.h | 4 ++-- 2 files changed, 5 insertions(+), 2 deletions(-) --- diff --git a/README b/README index 13f20e3..924710c 100644 --- a/README +++ b/README @@ -400,16 +400,19 @@ reports, suggestions, and valuable resources: Ken Hornstein Henry B. Hotz Luke Howard + Jakub Hrozek Shumon Huque Jeffrey Hutzelman Wyllys Ingersoll Holger Isenberg Mikkel Kruse Volker Lendecke + Jan iankko Lieskovsky Ryan Lynch Franklyn Mendez Markus Moeller Paul Moore + Zbysek Mraz Edward Murrell Nikos Nikoleris Dmitri Pal diff --git a/src/patchlevel.h b/src/patchlevel.h index ab1b84f..9be96cf 100644 --- a/src/patchlevel.h +++ b/src/patchlevel.h @@ -53,6 +53,6 @@ #define KRB5_MAJOR_RELEASE 1 #define KRB5_MINOR_RELEASE 8 #define KRB5_PATCHLEVEL 1 -#define KRB5_RELTAIL "beta2-postrelease" +/* #undef KRB5_RELTAIL */ /* #undef KRB5_RELDATE */ -#define KRB5_RELTAG "branches/krb5-1-8" +#define KRB5_RELTAG "tags/krb5-1-8-1-final"

1 0

[AuthHub/krb5-1-8: 67/111] krb5-1.8.1-beta2-postrelease
by sbose 15 Mar '11

15 Mar '11

commit 955b77f413f8291f4d75115ca1a91663a641931f Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Mar 30 01:54:21 2010 +0000 krb5-1.8.1-beta2-postrelease git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23849 dc483132-0cff-0310-8789-dd5450dbe970 src/patchlevel.h | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) --- diff --git a/src/patchlevel.h b/src/patchlevel.h index 614b047..ab1b84f 100644 --- a/src/patchlevel.h +++ b/src/patchlevel.h @@ -53,6 +53,6 @@ #define KRB5_MAJOR_RELEASE 1 #define KRB5_MINOR_RELEASE 8 #define KRB5_PATCHLEVEL 1 -#define KRB5_RELTAIL "beta2" +#define KRB5_RELTAIL "beta2-postrelease" /* #undef KRB5_RELDATE */ -#define KRB5_RELTAG "tags/krb5-1-8-1-beta2" +#define KRB5_RELTAG "branches/krb5-1-8"

1 0

[AuthHub/krb5-1-8: 66/111] README and patchlevel for krb5-1.8.1-beta2
by sbose 15 Mar '11

15 Mar '11

commit 2790f09141fd6e0921d7a66ae18feaa2fbac7879 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Mar 30 01:52:51 2010 +0000 README and patchlevel for krb5-1.8.1-beta2 git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23847 dc483132-0cff-0310-8789-dd5450dbe970 README | 1 + src/patchlevel.h | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) --- diff --git a/README b/README index 95cc02b..13f20e3 100644 --- a/README +++ b/README @@ -111,6 +111,7 @@ krb5-1.8.1 changes by ticket ID 6687 Change KRB5_AUTHDATA_SIGNTICKET from 142 to 512 6689 krb5_typed_data not castable to krb5_pa_data on 64-bit MacOSX 6690 MITKRB5-SA-2010-002 CVE-2010-0628 denial of service in SPNEGO +6693 Fix backwards flag output in krb5_init_creds_step() Major changes in 1.8 -------------------- diff --git a/src/patchlevel.h b/src/patchlevel.h index e50b21f..614b047 100644 --- a/src/patchlevel.h +++ b/src/patchlevel.h @@ -53,6 +53,6 @@ #define KRB5_MAJOR_RELEASE 1 #define KRB5_MINOR_RELEASE 8 #define KRB5_PATCHLEVEL 1 -#define KRB5_RELTAIL "beta1-postrelease" +#define KRB5_RELTAIL "beta2" /* #undef KRB5_RELDATE */ -#define KRB5_RELTAG "branches/krb5-1-8" +#define KRB5_RELTAG "tags/krb5-1-8-1-beta2"

1 0

[AuthHub/krb5-1-8: 65/111] make depend
by sbose 15 Mar '11

15 Mar '11

commit d2065da320f8ae3eb4169fd5664391011cd26511 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Mar 30 01:51:11 2010 +0000 make depend git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23846 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/gssapi/mechglue/deps | 8 ++++ src/lib/krb5/krb/deps | 74 ++++------------------------------------- src/util/ss/deps | 2 +- 3 files changed, 17 insertions(+), 67 deletions(-) --- diff --git a/src/lib/gssapi/mechglue/deps b/src/lib/gssapi/mechglue/deps index 39ea22c..950c5cf 100644 --- a/src/lib/gssapi/mechglue/deps +++ b/src/lib/gssapi/mechglue/deps @@ -358,6 +358,14 @@ g_set_name_attr.so g_set_name_attr.po $(OUTPRE)g_set_name_attr.$(OBJEXT): \ $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-thread.h \ ../generic/gssapi_err_generic.h g_set_name_attr.c mechglue.h \ mglueP.h +g_set_neg_mechs.so g_set_neg_mechs.po $(OUTPRE)g_set_neg_mechs.$(OBJEXT): \ + $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/gssapi/gssapi.h \ + $(BUILDTOP)/include/gssapi/gssapi_ext.h $(COM_ERR_DEPS) \ + $(srcdir)/../generic/gssapiP_generic.h $(srcdir)/../generic/gssapi_ext.h \ + $(srcdir)/../generic/gssapi_generic.h $(top_srcdir)/include/k5-buf.h \ + $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-thread.h \ + ../generic/gssapi_err_generic.h g_set_neg_mechs.c mechglue.h \ + mglueP.h g_sign.so g_sign.po $(OUTPRE)g_sign.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ $(BUILDTOP)/include/gssapi/gssapi.h $(BUILDTOP)/include/gssapi/gssapi_ext.h \ $(COM_ERR_DEPS) $(srcdir)/../generic/gssapiP_generic.h \ diff --git a/src/lib/krb5/krb/deps b/src/lib/krb5/krb/deps index 0267483..fa1d550 100644 --- a/src/lib/krb5/krb/deps +++ b/src/lib/krb5/krb/deps @@ -63,45 +63,10 @@ authdata.so authdata.po $(OUTPRE)authdata.$(OBJEXT): \ $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ - $(top_srcdir)/include/k5-utf8.h $(top_srcdir)/include/krb5.h \ - $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/locate_plugin.h \ - $(top_srcdir)/include/krb5/preauth_plugin.h $(top_srcdir)/include/port-sockets.h \ - $(top_srcdir)/include/socket-utils.h auth_con.h authdata.c \ - authdata.h int-proto.h -authdata_exp.so authdata_exp.po $(OUTPRE)authdata_exp.$(OBJEXT): \ - $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ - $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ - $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \ - $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ - $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ - $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ - $(top_srcdir)/include/k5-utf8.h $(top_srcdir)/include/krb5.h \ - $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/locate_plugin.h \ - $(top_srcdir)/include/krb5/preauth_plugin.h $(top_srcdir)/include/port-sockets.h \ - $(top_srcdir)/include/socket-utils.h auth_con.h authdata.h \ - authdata_exp.c int-proto.h -authdata_enc.so authdata_enc.po $(OUTPRE)authdata_enc.$(OBJEXT): \ - $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ - $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ - $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \ - $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ - $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ - $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ - authdata_enc.c -authdata_dec.so authdata_dec.po $(OUTPRE)authdata_dec.$(OBJEXT): \ - $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ - $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ - $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \ - $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ - $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ - $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ - $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ - $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ - $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ - authdata_dec.c int-proto.h + auth_con.h authdata.c authdata.h int-proto.h bld_pr_ext.so bld_pr_ext.po $(OUTPRE)bld_pr_ext.$(OBJEXT): \ $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ @@ -190,7 +155,7 @@ copy_auth.so copy_auth.po $(OUTPRE)copy_auth.$(OBJEXT): \ $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ - copy_auth.c int-proto.h + copy_auth.c copy_athctr.so copy_athctr.po $(OUTPRE)copy_athctr.$(OBJEXT): \ $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ @@ -201,7 +166,7 @@ copy_athctr.so copy_athctr.po $(OUTPRE)copy_athctr.$(OBJEXT): \ $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ - auth_con.h copy_athctr.c + copy_athctr.c copy_cksum.so copy_cksum.po $(OUTPRE)copy_cksum.$(OBJEXT): \ $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ @@ -669,17 +634,6 @@ pac.so pac.po $(OUTPRE)pac.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ authdata.h pac.c -pac_sign.so pac_sign.po $(OUTPRE)pac_sign.$(OBJEXT): \ - $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ - $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ - $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \ - $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ - $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ - $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ - $(top_srcdir)/include/k5-utf8.h $(top_srcdir)/include/krb5.h \ - $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/locate_plugin.h \ - $(top_srcdir)/include/krb5/preauth_plugin.h $(top_srcdir)/include/port-sockets.h \ - $(top_srcdir)/include/socket-utils.h authdata.h pac_sign.c parse.so parse.po $(OUTPRE)parse.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \ $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \ @@ -722,17 +676,6 @@ preauth2.so preauth2.po $(OUTPRE)preauth2.$(OBJEXT): \ $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ fast.h int-proto.h preauth2.c -gic_opt_set_pa.so gic_opt_set_pa.po $(OUTPRE)gic_opt_set_pa.$(OBJEXT): \ - $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ - $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ - $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \ - $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ - $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ - $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ - $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ - $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ - $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ - gic_opt_set_pa.c int-proto.h princ_comp.so princ_comp.po $(OUTPRE)princ_comp.$(OBJEXT): \ $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ @@ -805,11 +748,10 @@ rd_req_dec.so rd_req_dec.po $(OUTPRE)rd_req_dec.$(OBJEXT): \ $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ - $(top_srcdir)/include/k5-utf8.h $(top_srcdir)/include/krb5.h \ - $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/locate_plugin.h \ - $(top_srcdir)/include/krb5/preauth_plugin.h $(top_srcdir)/include/port-sockets.h \ - $(top_srcdir)/include/socket-utils.h auth_con.h authdata.h \ - int-proto.h rd_req_dec.c + $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ + $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ + $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ + auth_con.h authdata.h int-proto.h rd_req_dec.c rd_safe.so rd_safe.po $(OUTPRE)rd_safe.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \ $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \ @@ -1038,7 +980,7 @@ valid_times.so valid_times.po $(OUTPRE)valid_times.$(OBJEXT): \ $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ - int-proto.h valid_times.c + valid_times.c vfy_increds.so vfy_increds.po $(OUTPRE)vfy_increds.$(OBJEXT): \ $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ diff --git a/src/util/ss/deps b/src/util/ss/deps index c71d18c..7ad73c5 100644 --- a/src/util/ss/deps +++ b/src/util/ss/deps @@ -63,7 +63,7 @@ utils.so utils.po $(OUTPRE)utils.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ ss_internal.h utils.c options.so options.po $(OUTPRE)options.$(OBJEXT): $(BUILDTOP)/include/ss/ss_err.h \ $(COM_ERR_DEPS) copyright.h options.c ss.h -cmd_tbl.lex.o: cmd_tbl.lex.c +cmd_tbl.lex.o: cmd_tbl.lex.c ct.tab.h ct.tab.o: $(BUILDTOP)/include/ss/ss_err.h $(COM_ERR_DEPS) \ ct.tab.c ss.h ss_err.so ss_err.po $(OUTPRE)ss_err.$(OBJEXT): $(COM_ERR_DEPS) \

1 0

[AuthHub/krb5-1-8: 64/111] ticket: 6693 version_fixed: 1.8.1 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 692433183006b8cb5f0d8b5b3014614822a4881f Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Mar 30 01:51:04 2010 +0000 ticket: 6693 version_fixed: 1.8.1 status: resolved pull up r23844 from trunk ------------------------------------------------------------------------ r23844 | ghudson | 2010-03-29 18:08:21 -0400 (Mon, 29 Mar 2010) | 9 lines ticket: 6693 subject: Fix backwards flag output in krb5_init_creds_step() tags: pullup target_version: 1.8.1 krb5_init_creds_step() is taken from Heimdal, which sets *flags to 1 for "continue" and 0 for "stop". Unfortunately, we got it backwards in 1.8; fix it for 1.8.1. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23845 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/krb5/krb/get_in_tkt.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) --- diff --git a/src/lib/krb5/krb/get_in_tkt.c b/src/lib/krb5/krb/get_in_tkt.c index ab92ee1..b1b837d 100644 --- a/src/lib/krb5/krb/get_in_tkt.c +++ b/src/lib/krb5/krb/get_in_tkt.c @@ -1083,7 +1083,7 @@ init_creds_get(krb5_context context, &flags); if (code == KRB5KRB_ERR_RESPONSE_TOO_BIG && !tcp_only) tcp_only = 1; - else if (code != 0 || (flags & KRB5_INIT_CREDS_STEP_FLAG_COMPLETE)) + else if (code != 0 || (flags & 1) == 0) break; krb5_free_data_contents(context, &reply); @@ -2065,7 +2065,7 @@ cleanup: } } - *flags = (ctx->flags & KRB5_INIT_CREDS_STEP_FLAG_COMPLETE); + *flags = (ctx->flags & KRB5_INIT_CREDS_STEP_FLAG_COMPLETE) ? 0 : 1; return code; }

1 0

[AuthHub/krb5-1-8: 63/111] krb5-1.8.1-beta1-postrelease
by sbose 15 Mar '11

15 Mar '11

commit 130f11fcd3ece80c87bcd178c44a8f14d7827333 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Sun Mar 28 23:00:08 2010 +0000 krb5-1.8.1-beta1-postrelease git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23841 dc483132-0cff-0310-8789-dd5450dbe970 src/patchlevel.h | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) --- diff --git a/src/patchlevel.h b/src/patchlevel.h index 99f2abe..e50b21f 100644 --- a/src/patchlevel.h +++ b/src/patchlevel.h @@ -53,6 +53,6 @@ #define KRB5_MAJOR_RELEASE 1 #define KRB5_MINOR_RELEASE 8 #define KRB5_PATCHLEVEL 1 -#define KRB5_RELTAIL "beta1" +#define KRB5_RELTAIL "beta1-postrelease" /* #undef KRB5_RELDATE */ -#define KRB5_RELTAG "tags/krb5-1-8-1-beta1" +#define KRB5_RELTAG "branches/krb5-1-8"

1 0

[AuthHub/krb5-1-8: 62/111] README and patchlevel for krb5-1.8.1-beta1
by sbose 15 Mar '11

15 Mar '11

commit f366db0fcb5e66d6710d5582d6670c438961414d Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Sun Mar 28 22:47:01 2010 +0000 README and patchlevel for krb5-1.8.1-beta1 git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23839 dc483132-0cff-0310-8789-dd5450dbe970 README | 30 ++++++++++++++++++++++++++++++ src/patchlevel.h | 6 +++--- 2 files changed, 33 insertions(+), 3 deletions(-) --- diff --git a/README b/README index 8063109..95cc02b 100644 --- a/README +++ b/README @@ -82,6 +82,36 @@ additional measures include: crypto * easier kadmin history key changes +Major changes in 1.8.1 +---------------------- + +This is primarily a bugfix release. + +* MITKRB5-SA-2010-002 CVE-2010-0628 denial of service in SPNEGO + +* Support IPv6 in kpasswd client. + +* Fix an authorization data type number assignment that conflicted + with an undocumented Microsoft usage. + +krb5-1.8.1 changes by ticket ID +------------------------------- + +6661 [RFE] properly support IPv6 in kpasswd +6668 Two problems in kadm5_get_principal mask handling +6674 memory leak in SPNEGO +6676 Ignore improperly encoded signedpath AD elements +6678 use of freed memory in gss_import_sec_context error path +6680 the "ticket_lifetime" setting isn't documented +6681 krb5_get_init_creds_password() can crash with NULL options and + expired keys +6683 kpasswd doesn't guess the client principal name correctly + without a ccache +6685 handle NT_SRV_INST in service principal referrals +6687 Change KRB5_AUTHDATA_SIGNTICKET from 142 to 512 +6689 krb5_typed_data not castable to krb5_pa_data on 64-bit MacOSX +6690 MITKRB5-SA-2010-002 CVE-2010-0628 denial of service in SPNEGO + Major changes in 1.8 -------------------- diff --git a/src/patchlevel.h b/src/patchlevel.h index aadebb9..99f2abe 100644 --- a/src/patchlevel.h +++ b/src/patchlevel.h @@ -52,7 +52,7 @@ */ #define KRB5_MAJOR_RELEASE 1 #define KRB5_MINOR_RELEASE 8 -#define KRB5_PATCHLEVEL 0 -#define KRB5_RELTAIL "postrelease" +#define KRB5_PATCHLEVEL 1 +#define KRB5_RELTAIL "beta1" /* #undef KRB5_RELDATE */ -#define KRB5_RELTAG "branches/krb5-1-8" +#define KRB5_RELTAG "tags/krb5-1-8-1-beta1"

1 0

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

authhub-commits March 2011