[Bug 988520] Re: After failed auth, subsequent auths in same context fail

[Launchpad Bug Tracker]

This bug was fixed in the package krb5 - 1.10+dfsg~beta1-2ubuntu0.1

---------------
krb5 (1.10+dfsg~beta1-2ubuntu0.1) precise-proposed; urgency=low

  * debian/patches/preauth-context.patch: fix preauth context initialisation
    (LP: #988520).
 -- Robie Basak <robie.basak at ubuntu.com>   Tue, 15 May 2012 02:33:57 +0000

** Changed in: krb5 (Ubuntu Precise)
       Status: Fix Committed => Fix Released

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to krb5 in Ubuntu.
https://bugs.launchpad.net/bugs/988520

Title:
  After failed auth, subsequent auths in same context fail

Status in “krb5” package in Ubuntu:
  Fix Released
Status in “krb5” source package in Precise:
  Fix Released
Status in “krb5” package in Debian:
  Fix Released

Bug description:
  SRU Justification

  [Impact]

  If an authentication fails after preauth was requested, all subsequent
  preauth-required authentications in the same Kerberos context will
  also fail. This breaks password change when credentials have expired,
  and also breaks try_first_pass functionality in Kerberos PAM modules.

  [Development Fix]

  New upstream release. Updated in Debian. Synced in Ubuntu. Verified
  fixed on Quantal using test case below.

  [Stable Fix]

  Upstream patch cherry-picked. Debdiff attached.

  [Test Case]

  testcase.sh attached.

  [Regression Potential]

  Low: one line patch for missing initialisation written by upstream.


  Original report by Russ Allbery:

  MIT Kerberos 1.10 (including pre-releases and betas) exposed a bug in
  the tracking of preauth mechanisms such that, if an authentication
  fails after preauth was requested, all subsequent preauth-required
  authentications in the same Kerberos context will also fail.

  This breaks password change when credentials have expired, and also
  breaks try_first_pass functionality in Kerberos PAM modules.

  Upstream has fixed this problem in their mainline with commit 25822.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/krb5/+bug/988520/+subscriptions