remote heap buffer overflow DoS/code exec

[Kees Cook]

Binary package hint: libapache-mod-auth-kerb

Security vulnerability.

[Kees Cook (kees)]

Version 5.3-1, in Feisty, is not vulnerable.

[Michael Bienia (geser)]

Here is a patch extracted from DSA-1247-1:

--- libapache-mod-auth-kerb-4.996-5.0-rc6.orig/spnegokrb5/der_get.c
+++ libapache-mod-auth-kerb-4.996-5.0-rc6/spnegokrb5/der_get.c
@@ -151,7 +151,7 @@
     if (len < 1)
        return ASN1_OVERRUN;

- data->components = malloc(len * sizeof(*data->components));
+ data->components = malloc((len + 1) * sizeof(*data->components));
     if (data->components == NULL && len != 0)
        return ENOMEM;
     data->components[0] = (*p) / 40;

[Michael Bienia (geser)]

Here is a debdiff for edgy.

[Michael Bienia (geser)]

Here is a debdiff for dapper.

[Michael Bienia (geser)]

Here is a debdiff for breezy.

[Michael Bienia (geser)]

I could only test if the package for edgy builds.
As I've no pbuilder for dapper and breezy anymore I couldn't test the build for those.

[Michael Bienia (geser)]

Here is an updated debdiff for edgy as the last didn't fix the FTBFS.
It now has the fix for the FTBFS backported from feisty.

[Kees Cook (kees)]

Great! These look good, thanks. Don't worry about setting "urgency"; Ubuntu doesn't actually use that field yet. I'm building them now, and I'll get them published shortly.