diff options
| author | root <root@rshg054.dnsready.net> | 2011-12-10 23:14:51 +0000 |
|---|---|---|
| committer | root <root@rshg054.dnsready.net> | 2011-12-10 23:14:51 +0000 |
| commit | e37e888e9ecdc23a004eb19d72c64c02c5af3249 (patch) | |
| tree | 19ab9633db499218c0eaf69356525133fd2c4e7f /core/krb5 | |
| parent | d22b68a6758c4f29a8e50a7be467374a53c68415 (diff) | |
Sat Dec 10 23:14:51 UTC 2011
Diffstat (limited to 'core/krb5')
| -rw-r--r-- | core/krb5/PKGBUILD | 17 | ||||
| -rw-r--r-- | core/krb5/krb5-1.9.1-2011-007.patch | 40 |
2 files changed, 52 insertions, 5 deletions
diff --git a/core/krb5/PKGBUILD b/core/krb5/PKGBUILD index 065797f99..e93b19963 100644 --- a/core/krb5/PKGBUILD +++ b/core/krb5/PKGBUILD @@ -1,9 +1,9 @@ -# $Id: PKGBUILD 142223 2011-11-06 13:03:25Z stephane $ +# $Id: PKGBUILD 144896 2011-12-09 11:55:57Z stephane $ # Maintainer: Stéphane Gaudreault <stephane@archlinux.org> pkgname=krb5 pkgver=1.9.2 -pkgrel=1 +pkgrel=2 pkgdesc="The Kerberos network authentication system" arch=('i686' 'x86_64') url="http://web.mit.edu/kerberos/" @@ -18,12 +18,14 @@ source=(http://web.mit.edu/kerberos/dist/${pkgname}/1.9/${pkgname}-${pkgver}-sig krb5-kadmind krb5-kdc krb5-kpropd - krb5-1.9.1-config-script.patch) + krb5-1.9.1-config-script.patch + krb5-1.9.1-2011-007.patch) sha1sums=('aa06f778ee1f9791cd4c5cf4c9e9465769ffec92' '2aa229369079ed1bbb201a1ef72c47bf143f4dbe' '77d2312ecd8bf12a6e72cc8fd871a8ac93b23393' '7f402078fa65bb9ff1beb6cbbbb017450df78560' - '7342410760cf44bfa01bb99bb4c49e12496cb46f') + '7342410760cf44bfa01bb99bb4c49e12496cb46f' + 'ec917dd1d1c96fa331f512331d5aa37c2e9b9df7') options=('!emptydirs') build() { @@ -37,10 +39,15 @@ build() { # by libkrb5, unless do_deps is set to 1, which indicates that the caller # wants the whole list. # - # Patch from upstream : + # Patch from upstream : # http://anonsvn.mit.edu/viewvc/krb5/trunk/src/krb5-config.in?r1=23662&r2=25236 patch -Np2 -i ${srcdir}/krb5-1.9.1-config-script.patch + # Apply upstream patch to fix a null pointer dereference when processing TGS requests + # CVE-2011-1530 + # see http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-007.txt + patch -Np2 -i ${srcdir}/krb5-1.9.1-2011-007.patch + # FS#25384 sed -i "/KRB5ROOT=/s/\/local//" util/ac_check_krb5.m4 diff --git a/core/krb5/krb5-1.9.1-2011-007.patch b/core/krb5/krb5-1.9.1-2011-007.patch new file mode 100644 index 000000000..336a4ad31 --- /dev/null +++ b/core/krb5/krb5-1.9.1-2011-007.patch @@ -0,0 +1,40 @@ +diff --git a/src/kdc/Makefile.in b/src/kdc/Makefile.in +index f46cad3..102fbaa 100644 +--- a/src/kdc/Makefile.in ++++ b/src/kdc/Makefile.in +@@ -67,6 +67,7 @@ check-unix:: rtest + + check-pytests:: + $(RUNPYTEST) $(srcdir)/t_workers.py $(PYTESTFLAGS) ++ $(RUNPYTEST) $(srcdir)/t_emptytgt.py $(PYTESTFLAGS) + + install:: + $(INSTALL_PROGRAM) krb5kdc ${DESTDIR}$(SERVER_BINDIR)/krb5kdc +diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c +index c169c54..840a2ef 100644 +--- a/src/kdc/do_tgs_req.c ++++ b/src/kdc/do_tgs_req.c +@@ -243,7 +243,8 @@ tgt_again: + if (!tgs_1 || !data_eq(*server_1, *tgs_1)) { + errcode = find_alternate_tgs(request, &server); + firstpass = 0; +- goto tgt_again; ++ if (errcode == 0) ++ goto tgt_again; + } + } + status = "UNKNOWN_SERVER"; +diff --git a/src/kdc/t_emptytgt.py b/src/kdc/t_emptytgt.py +new file mode 100644 +index 0000000..1760bcd +--- /dev/null ++++ b/src/kdc/t_emptytgt.py +@@ -0,0 +1,8 @@ ++#!/usr/bin/python ++from k5test import * ++ ++realm = K5Realm(start_kadmind=False, create_host=False) ++output = realm.run_as_client([kvno, 'krbtgt/'], expected_code=1) ++if 'not found in Kerberos database' not in output: ++ fail('TGT lookup for empty realm failed in unexpected way') ++success('Empty tgt lookup.') |