[SSSD] [PATCH] Do not accept zero-length passwords in the Kerberos provider

Stephen Gallagher sgallagh at redhat.com
Fri Dec 18 21:03:15 UTC 2009


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 12/18/2009 03:51 PM, Stephen Gallagher wrote:
> During internal testing and review, we discovered that the 0.99.1
> preview release contained a security bug.
> 
> On SSSD configurations using Kerberos 5 for authentication with cached
> credentials enabled, users of the Kerberos domain were able to
> successfully authenticate with a zero-length password. The kerberos
> child process (which performs kerberos auth on behalf of the user in
> order to guarantee correct ownership of the credential cache) was
> interpreting a zero-length password as an offline authentication attempt
> and was generating the special expired credential cache that an offline
> login would have instead of authenticating against the KDC. The attached
> patch ensures that we do not treat zero-length passwords as successful
> offline authentications.
> 
> This security flaw exists ONLY in the 0.99.x release candidate series,
> and not in 0.7.1 or other stable releases.

This patch was acked off-list and has been pushed to master and 1-0-0
branches upstream.

- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAksr7hMACgkQeiVVYja6o6P/MgCggGO6OyCi8My1AMP19Ku2dvFT
e+kAn1gteMBfvEBMrxo6Acug4OyoOJ37
=lO45
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list