Hello community, here is the log from the commit of package krb5 for openSUSE:Factory checked in at 2015-11-15 12:45:42 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/krb5 (Old) and /work/SRC/openSUSE:Factory/.krb5.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "krb5" Changes: -------- --- /work/SRC/openSUSE:Factory/krb5/krb5.changes 2015-11-04 15:30:38.000000000 +0100 +++ /work/SRC/openSUSE:Factory/.krb5.new/krb5.changes 2015-11-15 12:45:44.000000000 +0100 @@ -1,0 +2,7 @@ +Tue Nov 10 14:57:01 UTC 2015 - hguo@suse.com + +- Apply patch 0103-Fix-IAKERB-context-export-import-CVE-2015-2698.patch + to fix a memory corruption regression introduced by resolution of + CVE-2015-2698. bsc#954204 + +------------------------------------------------------------------- New: ---- 0103-Fix-IAKERB-context-export-import-CVE-2015-2698.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ krb5.spec ++++++ --- /var/tmp/diff_new_pack.JMVTxM/_old 2015-11-15 12:45:46.000000000 +0100 +++ /var/tmp/diff_new_pack.JMVTxM/_new 2015-11-15 12:45:46.000000000 +0100 @@ -86,6 +86,7 @@ Patch100: 0100-Fix-build_principal-memory-bug-CVE-2015-2697.patch Patch101: 0101-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch Patch102: 0102-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch +Patch103: 0103-Fix-IAKERB-context-export-import-CVE-2015-2698.patch BuildRoot: %{_tmppath}/%{name}-%{version}-build PreReq: mktemp, grep, /bin/touch, coreutils PreReq: %fillup_prereq @@ -207,6 +208,7 @@ %patch100 -p1 %patch101 -p1 %patch102 -p1 +%patch103 -p1 %build # needs to be re-generated ++++++ 0103-Fix-IAKERB-context-export-import-CVE-2015-2698.patch ++++++
From 3db8dfec1ef50ddd78d6ba9503185995876a39fd Mon Sep 17 00:00:00 2001 From: Greg Hudson
Date: Sun, 1 Nov 2015 22:45:21 -0500 Subject: [PATCH] Fix IAKERB context export/import [CVE-2015-2698]
The patches for CVE-2015-2696 contained a regression in the newly
added IAKERB iakerb_gss_export_sec_context() function, which could
cause it to corrupt memory. Fix the regression by properly
dereferencing the context_handle pointer before casting it.
Also, the patches did not implement an IAKERB gss_import_sec_context()
function, under the erroneous belief that an exported IAKERB context
would be tagged as a krb5 context. Implement it now to allow IAKERB
contexts to be successfully exported and imported after establishment.
CVE-2015-2698:
In any MIT krb5 release with the patches for CVE-2015-2696 applied, an
application which calls gss_export_sec_context() may experience memory
corruption if the context was established using the IAKERB mechanism.
Historically, some vulnerabilities of this nature can be translated
into remote code execution, though the necessary exploits must be
tailored to the individual application and are usually quite
complicated.
CVSSv2 Vector: AV:N/AC:H/Au:S/C:C/I:C/A:C/E:POC/RL:OF/RC:C
ticket: 8273 (new)
target_version: 1.14
tags: pullup
Line numbers are slightly adjusted by Howard Guo