|
 |
71c1a9 |
From b04cb88462863d762093760ffcfe1946200e30f5 Mon Sep 17 00:00:00 2001
|
|
|
71c1a9 |
From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
|
|
|
71c1a9 |
Date: Thu, 7 Jan 2021 10:44:46 +0100
|
|
|
71c1a9 |
Subject: [PATCH] Fix off-by-one bug in ISC SPNEGO implementation
|
|
|
71c1a9 |
|
|
|
71c1a9 |
The ISC SPNEGO implementation is based on mod_auth_kerb code. When
|
|
|
71c1a9 |
CVE-2006-5989 was disclosed, the relevant fix was not applied to the
|
|
|
71c1a9 |
BIND 9 codebase, making the latter vulnerable to the aforementioned flaw
|
|
|
71c1a9 |
when "tkey-gssapi-keytab" or "tkey-gssapi-credential" is set in
|
|
|
71c1a9 |
named.conf.
|
|
|
71c1a9 |
|
|
|
71c1a9 |
The original description of CVE-2006-5989 was:
|
|
|
71c1a9 |
|
|
|
71c1a9 |
Off-by-one error in the der_get_oid function in mod_auth_kerb 5.0
|
|
|
71c1a9 |
allows remote attackers to cause a denial of service (crash) via a
|
|
|
71c1a9 |
crafted Kerberos message that triggers a heap-based buffer overflow
|
|
|
71c1a9 |
in the component array.
|
|
|
71c1a9 |
|
|
|
71c1a9 |
Later research revealed that this flaw also theoretically enables remote
|
|
|
71c1a9 |
code execution, though achieving the latter in real-world conditions is
|
|
|
71c1a9 |
currently deemed very difficult.
|
|
|
71c1a9 |
|
|
|
71c1a9 |
This vulnerability was responsibly reported as ZDI-CAN-12302 ("ISC BIND
|
|
|
71c1a9 |
TKEY Query Heap-based Buffer Overflow Remote Code Execution
|
|
|
71c1a9 |
Vulnerability") by Trend Micro Zero Day Initiative.
|
|
|
71c1a9 |
---
|
|
|
71c1a9 |
lib/dns/spnego.c | 2 +-
|
|
|
71c1a9 |
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
71c1a9 |
|
|
|
71c1a9 |
diff --git a/lib/dns/spnego.c b/lib/dns/spnego.c
|
|
|
71c1a9 |
index e61d1c600f..753dc8049f 100644
|
|
|
71c1a9 |
--- a/lib/dns/spnego.c
|
|
|
71c1a9 |
+++ b/lib/dns/spnego.c
|
|
|
71c1a9 |
@@ -848,7 +848,7 @@ der_get_oid(const unsigned char *p, size_t len, oid *data, size_t *size) {
|
|
|
71c1a9 |
return (ASN1_OVERRUN);
|
|
|
71c1a9 |
}
|
|
|
71c1a9 |
|
|
|
71c1a9 |
- data->components = malloc(len * sizeof(*data->components));
|
|
|
71c1a9 |
+ data->components = malloc((len + 1) * sizeof(*data->components));
|
|
|
71c1a9 |
if (data->components == NULL) {
|
|
|
71c1a9 |
return (ENOMEM);
|
|
|
71c1a9 |
}
|
|
|
71c1a9 |
--
|
|
|
71c1a9 |
2.26.2
|
|
|
71c1a9 |
|