Skip to content

Commit 6609658

Browse files
committed
Fix kadmind server validation [CVE-2014-9422]
[MITKRB5-SA-2015-001] In kadmind's check_rpcsec_auth(), use data_eq_string() instead of strncmp() to check components of the server principal, so that we don't erroneously match left substrings of "kadmin", "history", or the realm. ticket: 8057 (new) target_version: 1.13.1 tags: pullup
1 parent a197e92 commit 6609658

File tree

1 file changed

+3
-9
lines changed

1 file changed

+3
-9
lines changed

Diff for: src/kadmin/server/kadm_rpc_svc.c

+3-9
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
*
55
*/
66

7-
#include <k5-platform.h>
7+
#include <k5-int.h>
88
#include <gssrpc/rpc.h>
99
#include <gssapi/gssapi_krb5.h> /* for gss_nt_krb5_name */
1010
#include <syslog.h>
@@ -296,14 +296,8 @@ check_rpcsec_auth(struct svc_req *rqstp)
296296
c1 = krb5_princ_component(kctx, princ, 0);
297297
c2 = krb5_princ_component(kctx, princ, 1);
298298
realm = krb5_princ_realm(kctx, princ);
299-
if (strncmp(handle->params.realm, realm->data, realm->length) == 0
300-
&& strncmp("kadmin", c1->data, c1->length) == 0) {
301-
302-
if (strncmp("history", c2->data, c2->length) == 0)
303-
goto fail_princ;
304-
else
305-
success = 1;
306-
}
299+
success = data_eq_string(*realm, handle->params.realm) &&
300+
data_eq_string(*c1, "kadmin") && !data_eq_string(*c2, "history");
307301

308302
fail_princ:
309303
if (!success) {

0 commit comments

Comments
 (0)