Bugzilla – Bug 56562
VUL-0: CVE-2004-0523: heimdal: buffer overflows in krb5_aname_to_localname
Last modified: 2021-10-02 09:05:31 UTC
Hello, an announcement about serveral buffer overflows in krb5_aname_to_localname() reached us.
<!-- SBZ_reproduce --> -
Created attachment 20634 [details] MIT Advisory
Should this update obsolete the folloeing update: c9e1b28a0689b282b00614ce00e02260
CAN: CAN-2004-0523
This is about MIT Kerberos. It does not affect heimdal.
The heimdal code of SL8.1 include the following function: krb5_error_code krb5_aname_to_localname (krb5_context context, krb5_const_principal aname, size_t lnsize, char *lname) { The code looks different but I'll check it.
Hm, maybe this should get a trailing zero: len = strlen (res); if (len >= lnsize) return ERANGE; strcpy (lname, res); // XXX thomas: append terminating 0 return 0;
In heimdal form SLES9 there is strlcpy()
Yes, saw it. len = strlen (res); if (len >= lnsize) return ERANGE; strlcpy (lname, res, lnsize); Do we use this function?
re comment #6: the code looks fine to me, assuming that lnsize == sizeof(lname). if (len >= lnsize) return ERANGE now we now that len < lnsize, so that the string including NUL fits strcpy (lname, res); copies "res" including the NUL byte.
Ah yes.. I missed that strcpy() copies the trailing 0 byte too. Can we be sure it exists?
Well, of course. We just did a strlen on the string! /me hands Thomas a large cup of strong coffee :)
Thanks *schluerf* I will shut up now. :)
CVE-2004-0523: CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)