Bug 829818 - avoid crash with MIT krb5 1.10.0 in gss_get_name_attribute()
avoid crash with MIT krb5 1.10.0 in gss_get_name_attribute()
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: samba (Show other bugs)
6.4
Unspecified Unspecified
medium Severity medium
: rc
: ---
Assigned To: Andreas Schneider
qe-baseos-daemons
:
Depends On:
Blocks: 838818
  Show dependency treegraph
 
Reported: 2012-06-07 11:34 EDT by Alexander Bokovoy
Modified: 2013-02-21 03:44 EST (History)
5 users (show)

See Also:
Fixed In Version: samba-3.6.6-126.el6
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 838818 (view as bug list)
Environment:
Last Closed: 2013-02-21 03:44:49 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Samba Project 8988 None None None 2012-06-07 11:34:31 EDT

  None (edit)
Description Alexander Bokovoy 2012-06-07 11:34:31 EDT
(Copy of upstream bug https://bugzilla.samba.org/show_bug.cgi?id=8988)

gss_get_name_attribute() can return unintialized pac_display_buffer and later
gss_release_buffer() will crash on attempting to release it.

The fix on MIT krb5 side is in 1.10.1, reported in both Debian and MIT
upstream:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=658514
http://krbdev.mit.edu/rt/Ticket/Display.html?user=guest&pass=guest&id=7087

We need to initialize variables before using gss_get_name_attribute()

Patch for 3.6 is attached in the upstream bug. The problem was introduced with commit 1bb6b841 and
affects all 3.6 releases:
$ git tag --contains 1bb6b841
samba-3.6.0
samba-3.6.0rc1
samba-3.6.0rc2
samba-3.6.0rc3
samba-3.6.1
samba-3.6.2
samba-3.6.3
samba-3.6.4
samba-3.6.5
Comment 4 Andreas Schneider 2012-10-16 14:14:00 EDT
The problem was that a variable was not initialized correctly. The developer had a newer MIT version which made sure the stuff gets initialized. In 1.1.10 this was not the case so we crashed in the libkrb5 library. Initializing the variable fixed the crash with MIT KRB5 and 1.1.10.

I'm not sure it really makes sense to add test case for that cause it will not happen with newer MIT KRB5 releases.

To reproduce it you need to install samba 3.6.5 or an earlier 3.6.x release and MIT KRB5 1.1.10 to crash it.

It will NOT crash with samba >= 3.6.6 and MIT KRB5 <= 1.1.10

or

it will NOT crash with samba < 3.6.6 and MIT KRB > 1.1.10
Comment 9 errata-xmlrpc 2013-02-21 03:44:49 EST
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2013-0338.html

Note You need to log in before you can comment on or make changes to this bug.