Date: Wednesday, February 17, 2016 @ 08:00:31 Author: foutrelis Revision: 259883
Remove old patch Deleted: pacman/trunk/ensure-matching-database-and-package-version.patch ----------------------------------------------------+ ensure-matching-database-and-package-version.patch | 60 ------------------- 1 file changed, 60 deletions(-) Deleted: ensure-matching-database-and-package-version.patch =================================================================== --- ensure-matching-database-and-package-version.patch 2016-02-17 05:29:13 UTC (rev 259882) +++ ensure-matching-database-and-package-version.patch 2016-02-17 07:00:31 UTC (rev 259883) @@ -1,60 +0,0 @@ -From deac9731884a83ad91eab9f27b288f406f56c87b Mon Sep 17 00:00:00 2001 -From: Levente Polyak <[email protected]> -Date: Sat, 18 Jul 2015 17:58:23 +0200 -Subject: [PATCH] ensure matching database and package version - -While loading each package ensure that the internal version matches the -expected database version to avoid the possibility to circumvent the -version check. -This issue can be used by an attacker to trick the software into -installing an older version. The behavior can be exploited by a -man-in-the-middle attack through specially crafted database tarball -containing a higher version, yet actually delivering an older and -vulnerable version, which was previously shipped. - -Signed-off-by: Levente Polyak <[email protected]> -Signed-off-by: Remi Gacogne <[email protected]> -Signed-off-by: Allan McRae <[email protected]> ---- - lib/libalpm/sync.c | 18 ++++++++++++++++++ - 1 file changed, 18 insertions(+) - -diff --git a/lib/libalpm/sync.c b/lib/libalpm/sync.c -index 888ae15..e843b07 100644 ---- a/lib/libalpm/sync.c -+++ b/lib/libalpm/sync.c -@@ -1212,6 +1212,7 @@ static int load_packages(alpm_handle_t *handle, alpm_list_t **data, - EVENT(handle, &event); - - for(i = handle->trans->add; i; i = i->next, current++) { -+ int error = 0; - alpm_pkg_t *spkg = i->data; - char *filepath; - int percent = (int)(((double)current_bytes / total_bytes) * 100); -@@ -1232,6 +1233,23 @@ static int load_packages(alpm_handle_t *handle, alpm_list_t **data, - spkg->name); - alpm_pkg_t *pkgfile =_alpm_pkg_load_internal(handle, filepath, 1); - if(!pkgfile) { -+ _alpm_log(handle, ALPM_LOG_DEBUG, "failed to load pkgfile internal\n"); -+ error = 1; -+ } else { -+ if(strcmp(spkg->name, pkgfile->name) != 0) { -+ _alpm_log(handle, ALPM_LOG_DEBUG, -+ "internal package name mismatch, expected: '%s', actual: '%s'\n", -+ spkg->name, pkgfile->name); -+ error = 1; -+ } -+ if(strcmp(spkg->version, pkgfile->version) != 0) { -+ _alpm_log(handle, ALPM_LOG_DEBUG, -+ "internal package version mismatch, expected: '%s', actual: '%s'\n", -+ spkg->version, pkgfile->version); -+ error = 1; -+ } -+ } -+ if(error != 0) { - errors++; - *data = alpm_list_add(*data, strdup(spkg->filename)); - free(filepath); --- -2.4.6 -
