Skip to content

Commit 08c642c

Browse files
committed
Fix LDAP null deref on empty arg [CVE-2016-3119]
In the LDAP KDB module's process_db_args(), strtok_r() may return NULL if there is an empty string in the db_args array. Check for this case and avoid dereferencing a null pointer. CVE-2016-3119: In MIT krb5 1.6 and later, an authenticated attacker with permission to modify a principal entry can cause kadmind to dereference a null pointer by supplying an empty DB argument to the modify_principal command, if kadmind is configured to use the LDAP KDB module. CVSSv2 Vector: AV:N/AC:H/Au:S/C:N/I:N/A:C/E:H/RL:OF/RC:ND ticket: 8383 (new) target_version: 1.14-next target_version: 1.13-next tags: pullup
1 parent 89683d1 commit 08c642c

File tree

1 file changed

+1
-0
lines changed

1 file changed

+1
-0
lines changed

Diff for: src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c

+1
Original file line numberDiff line numberDiff line change
@@ -296,6 +296,7 @@ process_db_args(krb5_context context, char **db_args, xargs_t *xargs,
296296
if (db_args) {
297297
for (i=0; db_args[i]; ++i) {
298298
arg = strtok_r(db_args[i], "=", &arg_val);
299+
arg = (arg != NULL) ? arg : "";
299300
if (strcmp(arg, TKTPOLICY_ARG) == 0) {
300301
dptr = &xargs->tktpolicydn;
301302
} else {

0 commit comments

Comments
 (0)