[SSSD] [PATCH] Do not accept zero-length passwords in the Kerberos provider
Stephen Gallagher
sgallagh at redhat.com
Fri Dec 18 21:03:15 UTC 2009
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 12/18/2009 03:51 PM, Stephen Gallagher wrote:
> During internal testing and review, we discovered that the 0.99.1
> preview release contained a security bug.
>
> On SSSD configurations using Kerberos 5 for authentication with cached
> credentials enabled, users of the Kerberos domain were able to
> successfully authenticate with a zero-length password. The kerberos
> child process (which performs kerberos auth on behalf of the user in
> order to guarantee correct ownership of the credential cache) was
> interpreting a zero-length password as an offline authentication attempt
> and was generating the special expired credential cache that an offline
> login would have instead of authenticating against the KDC. The attached
> patch ensures that we do not treat zero-length passwords as successful
> offline authentications.
>
> This security flaw exists ONLY in the 0.99.x release candidate series,
> and not in 0.7.1 or other stable releases.
This patch was acked off-list and has been pushed to master and 1-0-0
branches upstream.
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAksr7hMACgkQeiVVYja6o6P/MgCggGO6OyCi8My1AMP19Ku2dvFT
e+kAn1gteMBfvEBMrxo6Acug4OyoOJ37
=lO45
-----END PGP SIGNATURE-----
More information about the sssd-devel
mailing list