Fri Dec 3 20:11:31 2010 UTC ()
add fix for CVE-2010-1323 from
http://web.mit.edu/kerberos/advisories/2010-007-patch-r15.txt


(tez)
diff -r1.49 -r1.50 pkgsrc/security/mit-krb5/Makefile
diff -r1.25 -r1.26 pkgsrc/security/mit-krb5/distinfo
diff -r0 -r1.1 pkgsrc/security/mit-krb5/patches/patch-ca
diff -r0 -r1.1 pkgsrc/security/mit-krb5/patches/patch-cb
diff -r0 -r1.1 pkgsrc/security/mit-krb5/patches/patch-cc
diff -r0 -r1.1 pkgsrc/security/mit-krb5/patches/patch-cd
cvs diff -r1.49 -r1.50 pkgsrc/security/mit-krb5/Makefile (switch to unified diff)

--- pkgsrc/security/mit-krb5/Makefile 2010/05/20 14:21:23 1.49
+++ pkgsrc/security/mit-krb5/Makefile 2010/12/03 20:11:31 1.50
@@ -1,162 +1,162 @@ @@ -1,162 +1,162 @@
1# $NetBSD: Makefile,v 1.49 2010/05/20 14:21:23 tez Exp $ 1# $NetBSD: Makefile,v 1.50 2010/12/03 20:11:31 tez Exp $
2 2
3DISTNAME= krb5-1.4.2 3DISTNAME= krb5-1.4.2
4PKGNAME= mit-${DISTNAME:S/-signed$//} 4PKGNAME= mit-${DISTNAME:S/-signed$//}
5PKGREVISION= 10 5PKGREVISION= 11
6CATEGORIES= security 6CATEGORIES= security
7MASTER_SITES= http://web.mit.edu/kerberos/dist/krb5/1.4/ 7MASTER_SITES= http://web.mit.edu/kerberos/dist/krb5/1.4/
8DISTFILES= ${DISTNAME}-signed${EXTRACT_SUFX} 8DISTFILES= ${DISTNAME}-signed${EXTRACT_SUFX}
9EXTRACT_SUFX= .tar 9EXTRACT_SUFX= .tar
10 10
11MAINTAINER= tez@NetBSD.org 11MAINTAINER= tez@NetBSD.org
12HOMEPAGE= http://web.mit.edu/kerberos/www/ 12HOMEPAGE= http://web.mit.edu/kerberos/www/
13COMMENT= MIT Kerberos 5 authentication system 13COMMENT= MIT Kerberos 5 authentication system
14 14
15PKG_DESTDIR_SUPPORT= user-destdir 15PKG_DESTDIR_SUPPORT= user-destdir
16MAKE_JOBS_SAFE= no 16MAKE_JOBS_SAFE= no
17 17
18WRKSRC= ${WRKDIR}/${DISTNAME}/src 18WRKSRC= ${WRKDIR}/${DISTNAME}/src
19 19
20.include "../../mk/bsd.prefs.mk" 20.include "../../mk/bsd.prefs.mk"
21 21
22CONFLICTS+= heimdal-[0-9]* 22CONFLICTS+= heimdal-[0-9]*
23CONFLICTS+= kth-krb4-[0-9]* 23CONFLICTS+= kth-krb4-[0-9]*
24 24
25USE_TOOLS+= autoconf gzcat yacc 25USE_TOOLS+= autoconf gzcat yacc
26GNU_CONFIGURE= yes 26GNU_CONFIGURE= yes
27USE_LIBTOOL= yes 27USE_LIBTOOL= yes
28 28
29# The actual KDC databases are stored in ${MIT_KRB5_STATEDIR}/krb5kdc. 29# The actual KDC databases are stored in ${MIT_KRB5_STATEDIR}/krb5kdc.
30MIT_KRB5_STATEDIR?= ${VARBASE} 30MIT_KRB5_STATEDIR?= ${VARBASE}
31FILES_SUBST+= MIT_KRB5_STATEDIR=${MIT_KRB5_STATEDIR:Q} 31FILES_SUBST+= MIT_KRB5_STATEDIR=${MIT_KRB5_STATEDIR:Q}
32 32
33BUILD_DEFS+= VARBASE 33BUILD_DEFS+= VARBASE
34 34
35CONFIGURE_ARGS+= --localstatedir=${MIT_KRB5_STATEDIR:Q} 35CONFIGURE_ARGS+= --localstatedir=${MIT_KRB5_STATEDIR:Q}
36CONFIGURE_ARGS+= --sysconfdir=${PKG_SYSCONFDIR:Q} 36CONFIGURE_ARGS+= --sysconfdir=${PKG_SYSCONFDIR:Q}
37CONFIGURE_ARGS+= --enable-shared 37CONFIGURE_ARGS+= --enable-shared
38CONFIGURE_ARGS+= --enable-pkgsrc-libtool 38CONFIGURE_ARGS+= --enable-pkgsrc-libtool
39CONFIGURE_ARGS+= --enable-dns 39CONFIGURE_ARGS+= --enable-dns
40CONFIGURE_ARGS+= --enable-kdc-replay-cache 40CONFIGURE_ARGS+= --enable-kdc-replay-cache
41CONFIGURE_ARGS+= --disable-thread-support 41CONFIGURE_ARGS+= --disable-thread-support
42CONFIGURE_ARGS+= --without-krb4 42CONFIGURE_ARGS+= --without-krb4
43CONFIGURE_ARGS+= --without-tcl 43CONFIGURE_ARGS+= --without-tcl
44MAKE_ENV+= ROOT_USER=${ROOT_USER:Q} 44MAKE_ENV+= ROOT_USER=${ROOT_USER:Q}
45 45
46PKG_OPTIONS_VAR= PKG_OPTIONS.mit-krb5 46PKG_OPTIONS_VAR= PKG_OPTIONS.mit-krb5
47PKG_SUPPORTED_OPTIONS= kerberos-prefix-cmds 47PKG_SUPPORTED_OPTIONS= kerberos-prefix-cmds
48 48
49.include "../../mk/bsd.options.mk" 49.include "../../mk/bsd.options.mk"
50 50
51# Rename some of MIT krb5's applications so they won't conflict with 51# Rename some of MIT krb5's applications so they won't conflict with
52# other packages. 52# other packages.
53# 53#
54.if !empty(PKG_OPTIONS:Mkerberos-prefix-cmds) 54.if !empty(PKG_OPTIONS:Mkerberos-prefix-cmds)
55KRB5_PREFIX= k 55KRB5_PREFIX= k
56MIT_KRB5_TRANSFORM= s/^ftp/${KRB5_PREFIX}&/; \ 56MIT_KRB5_TRANSFORM= s/^ftp/${KRB5_PREFIX}&/; \
57 s/^rcp/${KRB5_PREFIX}&/; \ 57 s/^rcp/${KRB5_PREFIX}&/; \
58 s/^rlogin/${KRB5_PREFIX}&/; \ 58 s/^rlogin/${KRB5_PREFIX}&/; \
59 s/^rsh/${KRB5_PREFIX}&/; \ 59 s/^rsh/${KRB5_PREFIX}&/; \
60 s/^telnet/${KRB5_PREFIX}&/ 60 s/^telnet/${KRB5_PREFIX}&/
61.else 61.else
62KRB5_PREFIX= # empty 62KRB5_PREFIX= # empty
63MIT_KRB5_TRANSFORM= s/^ftp/k&/ 63MIT_KRB5_TRANSFORM= s/^ftp/k&/
64.endif 64.endif
65PLIST_SUBST+= KRB5_PREFIX=${KRB5_PREFIX:Q} 65PLIST_SUBST+= KRB5_PREFIX=${KRB5_PREFIX:Q}
66CONFIGURE_ARGS+= --program-transform-name=${MIT_KRB5_TRANSFORM:Q} 66CONFIGURE_ARGS+= --program-transform-name=${MIT_KRB5_TRANSFORM:Q}
67 67
68# Fix some places in the MIT krb5 sources that don't point to the correct 68# Fix some places in the MIT krb5 sources that don't point to the correct
69# Kerberized binaries when exec'ing programs. 69# Kerberized binaries when exec'ing programs.
70# 70#
71SUBST_CLASSES+= mit-krb5 71SUBST_CLASSES+= mit-krb5
72SUBST_STAGE.mit-krb5= pre-configure 72SUBST_STAGE.mit-krb5= pre-configure
73SUBST_FILES.mit-krb5= appl/bsd/Makefile.in include/krb5/stock/osconf.h 73SUBST_FILES.mit-krb5= appl/bsd/Makefile.in include/krb5/stock/osconf.h
74SUBST_SED.mit-krb5= -e "/KRB5_PATH_RLOGIN/s,/rlogin,/${KRB5_PREFIX}rlogin,g" 74SUBST_SED.mit-krb5= -e "/KRB5_PATH_RLOGIN/s,/rlogin,/${KRB5_PREFIX}rlogin,g"
75 75
76# Fix autoconf incompatibility in new versions where substitutions won't be 76# Fix autoconf incompatibility in new versions where substitutions won't be
77# processed properly. For more details see: 77# processed properly. For more details see:
78# http://mailman.mit.edu/pipermail/krb5-bugs/2006-June/004587.html 78# http://mailman.mit.edu/pipermail/krb5-bugs/2006-June/004587.html
79SUBST_CLASSES+= frag 79SUBST_CLASSES+= frag
80SUBST_STAGE.frag= post-patch 80SUBST_STAGE.frag= post-patch
81SUBST_FILES.frag= appl/telnet/libtelnet/Makefile.in \ 81SUBST_FILES.frag= appl/telnet/libtelnet/Makefile.in \
82 lib/apputils/Makefile.in \ 82 lib/apputils/Makefile.in \
83 lib/crypto/Makefile.in \ 83 lib/crypto/Makefile.in \
84 lib/crypto/aes/Makefile.in \ 84 lib/crypto/aes/Makefile.in \
85 lib/crypto/arcfour/Makefile.in \ 85 lib/crypto/arcfour/Makefile.in \
86 lib/crypto/crc32/Makefile.in \ 86 lib/crypto/crc32/Makefile.in \
87 lib/crypto/des/Makefile.in \ 87 lib/crypto/des/Makefile.in \
88 lib/crypto/dk/Makefile.in \ 88 lib/crypto/dk/Makefile.in \
89 lib/crypto/enc_provider/Makefile.in \ 89 lib/crypto/enc_provider/Makefile.in \
90 lib/crypto/hash_provider/Makefile.in \ 90 lib/crypto/hash_provider/Makefile.in \
91 lib/crypto/keyhash_provider/Makefile.in \ 91 lib/crypto/keyhash_provider/Makefile.in \
92 lib/crypto/md4/Makefile.in \ 92 lib/crypto/md4/Makefile.in \
93 lib/crypto/md5/Makefile.in \ 93 lib/crypto/md5/Makefile.in \
94 lib/crypto/old/Makefile.in \ 94 lib/crypto/old/Makefile.in \
95 lib/crypto/raw/Makefile.in \ 95 lib/crypto/raw/Makefile.in \
96 lib/crypto/sha1/Makefile.in \ 96 lib/crypto/sha1/Makefile.in \
97 lib/crypto/yarrow/Makefile.in \ 97 lib/crypto/yarrow/Makefile.in \
98 lib/des425/Makefile.in \ 98 lib/des425/Makefile.in \
99 lib/gssapi/Makefile.in \ 99 lib/gssapi/Makefile.in \
100 lib/gssapi/generic/Makefile.in \ 100 lib/gssapi/generic/Makefile.in \
101 lib/gssapi/krb5/Makefile.in \ 101 lib/gssapi/krb5/Makefile.in \
102 lib/kadm5/Makefile.in \ 102 lib/kadm5/Makefile.in \
103 lib/kadm5/clnt/Makefile.in \ 103 lib/kadm5/clnt/Makefile.in \
104 lib/kadm5/srv/Makefile.in \ 104 lib/kadm5/srv/Makefile.in \
105 lib/kdb/Makefile.in \ 105 lib/kdb/Makefile.in \
106 lib/krb4/Makefile.in \ 106 lib/krb4/Makefile.in \
107 lib/krb5/Makefile.in \ 107 lib/krb5/Makefile.in \
108 lib/krb5/asn.1/Makefile.in \ 108 lib/krb5/asn.1/Makefile.in \
109 lib/krb5/ccache/Makefile.in \ 109 lib/krb5/ccache/Makefile.in \
110 lib/krb5/error_tables/Makefile.in \ 110 lib/krb5/error_tables/Makefile.in \
111 lib/krb5/keytab/Makefile.in \ 111 lib/krb5/keytab/Makefile.in \
112 lib/krb5/krb/Makefile.in \ 112 lib/krb5/krb/Makefile.in \
113 lib/krb5/os/Makefile.in \ 113 lib/krb5/os/Makefile.in \
114 lib/krb5/posix/Makefile.in \ 114 lib/krb5/posix/Makefile.in \
115 lib/krb5/rcache/Makefile.in \ 115 lib/krb5/rcache/Makefile.in \
116 lib/rpc/Makefile.in \ 116 lib/rpc/Makefile.in \
117 util/db2/Makefile.in \ 117 util/db2/Makefile.in \
118 util/db2/btree/Makefile.in \ 118 util/db2/btree/Makefile.in \
119 util/db2/clib/Makefile.in \ 119 util/db2/clib/Makefile.in \
120 util/db2/db/Makefile.in \ 120 util/db2/db/Makefile.in \
121 util/db2/hash/Makefile.in \ 121 util/db2/hash/Makefile.in \
122 util/db2/mpool/Makefile.in \ 122 util/db2/mpool/Makefile.in \
123 util/db2/recno/Makefile.in \ 123 util/db2/recno/Makefile.in \
124 util/et/Makefile.in \ 124 util/et/Makefile.in \
125 util/profile/Makefile.in \ 125 util/profile/Makefile.in \
126 util/pty/Makefile.in \ 126 util/pty/Makefile.in \
127 util/ss/Makefile.in \ 127 util/ss/Makefile.in \
128 util/support/Makefile.in 128 util/support/Makefile.in
129SUBST_SED.frag= -e "s/^\#.\\(@lib.*_frag@\\)/\\1/g" 129SUBST_SED.frag= -e "s/^\#.\\(@lib.*_frag@\\)/\\1/g"
130 130
131INFO_FILES= # PLIST 131INFO_FILES= # PLIST
132 132
133OWN_DIRS_PERMS= ${MIT_KRB5_STATEDIR}/krb5kdc \ 133OWN_DIRS_PERMS= ${MIT_KRB5_STATEDIR}/krb5kdc \
134 ${ROOT_USER} ${ROOT_GROUP} 0700 134 ${ROOT_USER} ${ROOT_GROUP} 0700
135RCD_SCRIPTS= kadmind kdc 135RCD_SCRIPTS= kadmind kdc
136 136
137INSTALLATION_DIRS= bin include/gssapi include/gssrpc ${PKGINFODIR} \ 137INSTALLATION_DIRS= bin include/gssapi include/gssrpc ${PKGINFODIR} \
138 lib ${PKGMANDIR}/man1 ${PKGMANDIR}/man5 \ 138 lib ${PKGMANDIR}/man1 ${PKGMANDIR}/man5 \
139 ${PKGMANDIR}/man8 sbin share/examples/krb5 139 ${PKGMANDIR}/man8 sbin share/examples/krb5
140 140
141# The MIT krb5 distribution is actually a tar file that contains the 141# The MIT krb5 distribution is actually a tar file that contains the
142# real .tar.gz distfile and a PGP signature. 142# real .tar.gz distfile and a PGP signature.
143# 143#
144post-extract: 144post-extract:
145 extract_file="${WRKDIR}/${DISTNAME}.tar.gz"; \ 145 extract_file="${WRKDIR}/${DISTNAME}.tar.gz"; \
146 cd ${WRKDIR} && ${EXTRACT_CMD} 146 cd ${WRKDIR} && ${EXTRACT_CMD}
147 147
148pre-configure: 148pre-configure:
149 cd ${WRKSRC}; ${FIND} . -name configure -print | \ 149 cd ${WRKSRC}; ${FIND} . -name configure -print | \
150 ${XARGS} -n 1 ${DIRNAME} | \ 150 ${XARGS} -n 1 ${DIRNAME} | \
151 while read dir; do \ 151 while read dir; do \
152 ${ECHO} "=> Generating configure in $$dir"; \ 152 ${ECHO} "=> Generating configure in $$dir"; \
153 (cd $$dir && autoconf -I ${WRKSRC} -f); \ 153 (cd $$dir && autoconf -I ${WRKSRC} -f); \
154 done 154 done
155 155
156post-install: 156post-install:
157 cd ${WRKSRC}/../doc; for f in *.info *.info-[0-9]*; do \ 157 cd ${WRKSRC}/../doc; for f in *.info *.info-[0-9]*; do \
158 ${TEST} ! -f "$$f" || \ 158 ${TEST} ! -f "$$f" || \
159 ${INSTALL_MAN} "$$f" ${DESTDIR}${PREFIX}/${PKGINFODIR}; \ 159 ${INSTALL_MAN} "$$f" ${DESTDIR}${PREFIX}/${PKGINFODIR}; \
160 done 160 done
161 161
162.include "../../mk/bsd.pkg.mk" 162.include "../../mk/bsd.pkg.mk"
cvs diff -r1.25 -r1.26 pkgsrc/security/mit-krb5/distinfo (switch to unified diff)

--- pkgsrc/security/mit-krb5/distinfo 2010/05/20 14:21:23 1.25
+++ pkgsrc/security/mit-krb5/distinfo 2010/12/03 20:11:31 1.26
@@ -1,55 +1,59 @@ @@ -1,55 +1,59 @@
1$NetBSD: distinfo,v 1.25 2010/05/20 14:21:23 tez Exp $ 1$NetBSD: distinfo,v 1.26 2010/12/03 20:11:31 tez Exp $
2 2
3SHA1 (krb5-1.4.2-signed.tar) = bbc03bd319d539fb9523c2545d80ba0784522e88 3SHA1 (krb5-1.4.2-signed.tar) = bbc03bd319d539fb9523c2545d80ba0784522e88
4RMD160 (krb5-1.4.2-signed.tar) = 44500f5fab8e5959cf43f17f5f52f68e2dc73a1f 4RMD160 (krb5-1.4.2-signed.tar) = 44500f5fab8e5959cf43f17f5f52f68e2dc73a1f
5Size (krb5-1.4.2-signed.tar) = 6696960 bytes 5Size (krb5-1.4.2-signed.tar) = 6696960 bytes
6SHA1 (patch-aa) = 17e0934ea2ef21b3457fba54cf3d1c36de2da479 6SHA1 (patch-aa) = 17e0934ea2ef21b3457fba54cf3d1c36de2da479
7SHA1 (patch-ab) = 9650a9c8b6191d6feb99c01ba37b2e60f266e6e9 7SHA1 (patch-ab) = 9650a9c8b6191d6feb99c01ba37b2e60f266e6e9
8SHA1 (patch-ac) = 10884715858367214a562d7d631312c7f8ca1e0e 8SHA1 (patch-ac) = 10884715858367214a562d7d631312c7f8ca1e0e
9SHA1 (patch-ad) = c0beee554840aa80dba0e72bda21b4cf63ec2044 9SHA1 (patch-ad) = c0beee554840aa80dba0e72bda21b4cf63ec2044
10SHA1 (patch-ae) = fc6d5e11cd827cdfbe1bfc3a3c7ca9f5a71c17d7 10SHA1 (patch-ae) = fc6d5e11cd827cdfbe1bfc3a3c7ca9f5a71c17d7
11SHA1 (patch-af) = c9631743e3c93aee2aab5c8a370e9bebfc4084e5 11SHA1 (patch-af) = c9631743e3c93aee2aab5c8a370e9bebfc4084e5
12SHA1 (patch-ag) = 5da57455f36a2bd40e0f97db94e93249e90e0b8e 12SHA1 (patch-ag) = 5da57455f36a2bd40e0f97db94e93249e90e0b8e
13SHA1 (patch-ah) = 59a6bfc341a22234b38db406abe83b0d6d358a9f 13SHA1 (patch-ah) = 59a6bfc341a22234b38db406abe83b0d6d358a9f
14SHA1 (patch-ai) = 5b0f1ae222e50eb0eb3ed98c79188318ae0969b5 14SHA1 (patch-ai) = 5b0f1ae222e50eb0eb3ed98c79188318ae0969b5
15SHA1 (patch-aj) = 5c633571ea932ce349065cbb4c3bf482cc971675 15SHA1 (patch-aj) = 5c633571ea932ce349065cbb4c3bf482cc971675
16SHA1 (patch-ak) = 9d95372fd8edddbf0366e83a51d7a0b8a507f218 16SHA1 (patch-ak) = 9d95372fd8edddbf0366e83a51d7a0b8a507f218
17SHA1 (patch-al) = fb611fe47bd7c773d7baf11424e90cd3af70c422 17SHA1 (patch-al) = fb611fe47bd7c773d7baf11424e90cd3af70c422
18SHA1 (patch-am) = 050690479d75c5df6e89424bac594ab48ae98a8c 18SHA1 (patch-am) = 050690479d75c5df6e89424bac594ab48ae98a8c
19SHA1 (patch-an) = ccf76eecb4a0f3b4c7addd37ab8391dc831caa41 19SHA1 (patch-an) = ccf76eecb4a0f3b4c7addd37ab8391dc831caa41
20SHA1 (patch-ao) = 22f907ce8c6d66582523b05326a9e8d56ae28401 20SHA1 (patch-ao) = 22f907ce8c6d66582523b05326a9e8d56ae28401
21SHA1 (patch-ap) = c77a8f7bc35aa184e510bac576c12f55d5cfbf65 21SHA1 (patch-ap) = c77a8f7bc35aa184e510bac576c12f55d5cfbf65
22SHA1 (patch-aq) = 52429b712ca7a478caeb76fd165585c7aab7fa02 22SHA1 (patch-aq) = 52429b712ca7a478caeb76fd165585c7aab7fa02
23SHA1 (patch-ar) = 37807c14f03533aef8796ac90e5fac36ff98308a 23SHA1 (patch-ar) = 37807c14f03533aef8796ac90e5fac36ff98308a
24SHA1 (patch-as) = b155219fd512b59f698497af1bf6acf1ca4f4a34 24SHA1 (patch-as) = b155219fd512b59f698497af1bf6acf1ca4f4a34
25SHA1 (patch-at) = f5837580b496c454a35a3d8b955e5209074c267d 25SHA1 (patch-at) = f5837580b496c454a35a3d8b955e5209074c267d
26SHA1 (patch-au) = 238f497afd9ad129babc0b6c727eb23e9915536c 26SHA1 (patch-au) = 238f497afd9ad129babc0b6c727eb23e9915536c
27SHA1 (patch-av) = db0fce68f58307be4c359758f2c9b31d62ab8348 27SHA1 (patch-av) = db0fce68f58307be4c359758f2c9b31d62ab8348
28SHA1 (patch-aw) = 0e651b675d166e71f6543cbad8e29eece89d5b67 28SHA1 (patch-aw) = 0e651b675d166e71f6543cbad8e29eece89d5b67
29SHA1 (patch-ax) = d403c910211e48c6d1dc27cb2dd98d5f20cc688d 29SHA1 (patch-ax) = d403c910211e48c6d1dc27cb2dd98d5f20cc688d
30SHA1 (patch-ay) = 9f54c79c105d7baca3f1efa68a25f9b39dbf7683 30SHA1 (patch-ay) = 9f54c79c105d7baca3f1efa68a25f9b39dbf7683
31SHA1 (patch-az) = 79fd9cbbf34287b78d5c6c2faf72e147457f7f37 31SHA1 (patch-az) = 79fd9cbbf34287b78d5c6c2faf72e147457f7f37
32SHA1 (patch-ba) = b413b82de3248600beb003456cde811637d05206 32SHA1 (patch-ba) = b413b82de3248600beb003456cde811637d05206
33SHA1 (patch-bb) = 156d3341d1cf40cfbe5833f7ad68b5aec297d3fb 33SHA1 (patch-bb) = 156d3341d1cf40cfbe5833f7ad68b5aec297d3fb
34SHA1 (patch-bc) = 8b422991ca22903596cf157ea3603abb741c50a5 34SHA1 (patch-bc) = 8b422991ca22903596cf157ea3603abb741c50a5
35SHA1 (patch-bd) = 8cf0425d2fedea452f80fa599f3c4515e51d834c 35SHA1 (patch-bd) = 8cf0425d2fedea452f80fa599f3c4515e51d834c
36SHA1 (patch-be) = c4497d7b68cefd8109d615c2125d9dc7aa508e5d 36SHA1 (patch-be) = c4497d7b68cefd8109d615c2125d9dc7aa508e5d
37SHA1 (patch-bf) = 1e16b6cbe51a5aa07ac7c7c3c343e82bf16dcde6 37SHA1 (patch-bf) = 1e16b6cbe51a5aa07ac7c7c3c343e82bf16dcde6
38SHA1 (patch-bg) = fa70e00a2eb283782c9960a2c74a879862b979c5 38SHA1 (patch-bg) = fa70e00a2eb283782c9960a2c74a879862b979c5
39SHA1 (patch-bh) = 761ca395732d3f3eac0bc1fdbec0ad65aeea8df0 39SHA1 (patch-bh) = 761ca395732d3f3eac0bc1fdbec0ad65aeea8df0
40SHA1 (patch-bi) = ab91152460485ede492573ce379461e892196647 40SHA1 (patch-bi) = ab91152460485ede492573ce379461e892196647
41SHA1 (patch-bj) = d0deae92b8b4d9ad671c98ccb3debd7a4216f646 41SHA1 (patch-bj) = d0deae92b8b4d9ad671c98ccb3debd7a4216f646
42SHA1 (patch-bk) = 9bf37086a4e7661e8aacc2736d21f61db154263e 42SHA1 (patch-bk) = 9bf37086a4e7661e8aacc2736d21f61db154263e
43SHA1 (patch-bl) = d1239c8c8279680a97f7c555907ac1b4ccfca6b4 43SHA1 (patch-bl) = d1239c8c8279680a97f7c555907ac1b4ccfca6b4
44SHA1 (patch-bm) = d8e46f448fa4a51e3b8a42279cf1ab54b0598dd3 44SHA1 (patch-bm) = d8e46f448fa4a51e3b8a42279cf1ab54b0598dd3
45SHA1 (patch-bn) = 82c6f98474f31e1e231d3e89d6a24e20ec7fd123 45SHA1 (patch-bn) = 82c6f98474f31e1e231d3e89d6a24e20ec7fd123
46SHA1 (patch-bo) = dcfeab32537f8b89e3ed6a52a69601e3e7822e35 46SHA1 (patch-bo) = dcfeab32537f8b89e3ed6a52a69601e3e7822e35
47SHA1 (patch-bp) = 5308176a1229b5ac0d0f24eb2f657fdf48935f80 47SHA1 (patch-bp) = 5308176a1229b5ac0d0f24eb2f657fdf48935f80
48SHA1 (patch-bq) = 546e2b0260e4197b44f1f5a6f7a03f72125c768b 48SHA1 (patch-bq) = 546e2b0260e4197b44f1f5a6f7a03f72125c768b
49SHA1 (patch-br) = da7884aa9a1ba79e7e31416bf06f74bcc71b2c01 49SHA1 (patch-br) = da7884aa9a1ba79e7e31416bf06f74bcc71b2c01
50SHA1 (patch-bs) = b652562c4e545d41fbbfa6676b10b68823ebfbd8 50SHA1 (patch-bs) = b652562c4e545d41fbbfa6676b10b68823ebfbd8
51SHA1 (patch-bt) = 1398369698cc9c029957723c25dbdf53754cf373 51SHA1 (patch-bt) = 1398369698cc9c029957723c25dbdf53754cf373
52SHA1 (patch-bu) = bf0688bd703c3dcfa27934e0a6bc43230251512e 52SHA1 (patch-bu) = bf0688bd703c3dcfa27934e0a6bc43230251512e
53SHA1 (patch-bv) = b07fc44dcc577bffece1eb85f5f93e4c10a58e00 53SHA1 (patch-bv) = b07fc44dcc577bffece1eb85f5f93e4c10a58e00
54SHA1 (patch-bw) = ffdf13931306b15b9282863926f769f079ffe8f9 54SHA1 (patch-bw) = ffdf13931306b15b9282863926f769f079ffe8f9
55SHA1 (patch-bx) = d0e54b7e50f066c0680e982bb251c763e9104e24 55SHA1 (patch-bx) = d0e54b7e50f066c0680e982bb251c763e9104e24
 56SHA1 (patch-ca) = 93c234c007f2dafa0221d1bd1d3ed4953fc116c9
 57SHA1 (patch-cb) = 9d892ed2993178085dd7df565afb794fe18f0f06
 58SHA1 (patch-cc) = 6fe639b33da7756f6e9ad1a03e2f40d74ddb9c6d
 59SHA1 (patch-cd) = 8339ac4305865b8e540a0f1bb14c1f1478447c0b
File Added: pkgsrc/security/mit-krb5/patches/Attic/patch-ca
$NetBSD: patch-ca,v 1.1 2010/12/03 20:11:31 tez Exp $

CVE-2010-1323 fix

--- lib/crypto/keyed_checksum_types.c.orig	2010-12-03 11:36:00.476825900 -0600
+++ lib/crypto/keyed_checksum_types.c	2010-12-03 11:37:44.915328600 -0600
@@ -51,6 +51,15 @@
 {
     unsigned int i, c;
 
+    if (enctype == ENCTYPE_ARCFOUR_HMAC ||
+	enctype == ENCTYPE_ARCFOUR_HMAC_EXP) {
+	*count = 1;
+	if ((*cksumtypes = malloc(sizeof(krb5_cksumtype))) == NULL)
+	    return(ENOMEM);
+	(*cksumtypes)[0] = CKSUMTYPE_HMAC_MD5_ARCFOUR;
+	return(0);
+    }
+
     c = 0;
     for (i=0; i<krb5_cksumtypes_length; i++) {
 	if ((krb5_cksumtypes_list[i].keyhash &&
File Added: pkgsrc/security/mit-krb5/patches/Attic/patch-cb
$NetBSD: patch-cb,v 1.1 2010/12/03 20:11:31 tez Exp $

CVE-2010-1323 fix

--- lib/crypto/dk/derive.c.orig	2010-12-03 11:38:08.683111800 -0600
+++ lib/crypto/dk/derive.c	2010-12-03 11:38:50.395857000 -0600
@@ -40,6 +40,8 @@
     keybytes = enc->keybytes;
     keylength = enc->keylength;
 
+    if (blocksize == 1)
+	return(KRB5_BAD_ENCTYPE);
     if ((inkey->length != keylength) ||
 	(outkey->length != keylength))
 	return(KRB5_CRYPTO_INTERNAL);
File Added: pkgsrc/security/mit-krb5/patches/Attic/patch-cc
$NetBSD: patch-cc,v 1.1 2010/12/03 20:11:31 tez Exp $

CVE-2010-1323 fix

--- lib/krb5/krb/preauth2.c.orig	2010-12-03 11:39:40.124063600 -0600
+++ lib/krb5/krb/preauth2.c	2010-12-03 11:41:33.300010400 -0600
@@ -665,7 +665,9 @@
 
    cksum = sc2->sam_cksum;
    
-   while (*cksum) {
+   for (; *cksum; cksum++) {
+	if (!krb5_c_is_keyed_cksum((*cksum)->checksum_type))
+	    continue;
 	/* Check this cksum */
 	retval = krb5_c_verify_checksum(context, as_key,
 			KRB5_KEYUSAGE_PA_SAM_CHALLENGE_CKSUM,
@@ -679,7 +681,6 @@
 	}
 	if (valid_cksum)
 	   break;
-	cksum++;
    }
 
    if (!valid_cksum) {
File Added: pkgsrc/security/mit-krb5/patches/Attic/patch-cd
$NetBSD: patch-cd,v 1.1 2010/12/03 20:11:31 tez Exp $

CVE-2010-1323 fix

--- lib/krb5/krb/mk_safe.c.orig	2010-12-03 11:41:53.890970000 -0600
+++ lib/krb5/krb/mk_safe.c	2010-12-03 11:44:00.588325800 -0600
@@ -212,10 +212,29 @@
 	for (i = 0; i < nsumtypes; i++)
 		if (auth_context->safe_cksumtype == sumtypes[i])
 			break;
-	if (i == nsumtypes)
-		i = 0;
-	sumtype = sumtypes[i];
 	krb5_free_cksumtypes (context, sumtypes);
+	if (i < nsumtypes)
+	    sumtype = auth_context->safe_cksumtype;
+	else {
+	    switch (keyblock->enctype) {
+	    case ENCTYPE_DES_CBC_MD4:
+		sumtype = CKSUMTYPE_RSA_MD4_DES;
+		break;
+	    case ENCTYPE_DES_CBC_MD5:
+	    case ENCTYPE_DES_CBC_CRC:
+		sumtype = CKSUMTYPE_RSA_MD5_DES;
+		break;
+	    default:
+		retval = krb5int_c_mandatory_cksumtype(context,
+						       keyblock->enctype,
+						       &sumtype);
+		if (retval) {
+		    CLEANUP_DONE();
+		    goto error;
+		}
+		break;
+	    }
+	}
     }
     if ((retval = krb5_mk_safe_basic(context, userdata, keyblock, &replaydata, 
 				     plocal_fulladdr, premote_fulladdr,