Bug 829818

Summary:	avoid crash with MIT krb5 1.10.0 in gss_get_name_attribute()
Product:	Red Hat Enterprise Linux 6	Reporter:	Alexander Bokovoy <abokovoy>
Component:	samba	Assignee:	Andreas Schneider <asn>
Status:	CLOSED ERRATA	QA Contact:	qe-baseos-daemons
Severity:	medium	Docs Contact:
Priority:	medium
Version:	6.4	CC:	asn, azelinka, gdeschner, prc, sbose
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	samba-3.6.6-126.el6	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:
Clones:	838818 (view as bug list)		Environment:
Last Closed:	2013-02-21 08:44:49 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	838818

Description Alexander Bokovoy 2012-06-07 15:34:31 UTC

(Copy of upstream bug https://bugzilla.samba.org/show_bug.cgi?id=8988)

gss_get_name_attribute() can return unintialized pac_display_buffer and later
gss_release_buffer() will crash on attempting to release it.

The fix on MIT krb5 side is in 1.10.1, reported in both Debian and MIT
upstream:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=658514
http://krbdev.mit.edu/rt/Ticket/Display.html?user=guest&pass=guest&id=7087

We need to initialize variables before using gss_get_name_attribute()

Patch for 3.6 is attached in the upstream bug. The problem was introduced with commit 1bb6b841 and
affects all 3.6 releases:
$ git tag --contains 1bb6b841
samba-3.6.0
samba-3.6.0rc1
samba-3.6.0rc2
samba-3.6.0rc3
samba-3.6.1
samba-3.6.2
samba-3.6.3
samba-3.6.4
samba-3.6.5

Comment 4 Andreas Schneider 2012-10-16 18:14:00 UTC

The problem was that a variable was not initialized correctly. The developer had a newer MIT version which made sure the stuff gets initialized. In 1.1.10 this was not the case so we crashed in the libkrb5 library. Initializing the variable fixed the crash with MIT KRB5 and 1.1.10.

I'm not sure it really makes sense to add test case for that cause it will not happen with newer MIT KRB5 releases.

To reproduce it you need to install samba 3.6.5 or an earlier 3.6.x release and MIT KRB5 1.1.10 to crash it.

It will NOT crash with samba >= 3.6.6 and MIT KRB5 <= 1.1.10

or

it will NOT crash with samba < 3.6.6 and MIT KRB > 1.1.10

Comment 9 errata-xmlrpc 2013-02-21 08:44:49 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2013-0338.html