The enclosed bug was filed by Leafnode upstream. I believe this patch contains the relevant fix:
diff -urN leafnode-1.11.2.rel/artutil.c leafnode-1.11.3.rel/artutil.c
--- leafnode-1.11.2.rel/artutil.c 2004-03-16 02:54:43.000000000 +0000
+++ leafnode-1.11.3.rel/artutil.c 2005-06-08 14:53:24.000000000 +0100
@@ -37,7 +37,7 @@
rewind(f);
debug = 0;
hdr = NULL;
- while ((p = getfoldedline(f)) && *p) {
+ while ((p = getfoldedline(f, getaline)) && *p) {
/* read only headers */
char *q = p;
if ((strncasecmp(q, header, hlen) == 0)) {
diff -urN leafnode-1.11.2.rel/fetchnews.c leafnode-1.11.3.rel/fetchnews.c
--- leafnode-1.11.2.rel/fetchnews.c 2005-05-04 11:01:44.000000000 +0100
+++ leafnode-1.11.3.rel/fetchnews.c 2005-06-08 14:53:12.000000000 +0100
@@ -1166,7 +1166,7 @@
}
c = NULL;
n = 9; /* "other" header */
- while ((l = getfoldedline(nntpin)) && *l && strcmp(l, ".")) {
+ while ((l = getfoldedline(nntpin, mgetaline)) && *l && strcmp(l, ".")) {
/* regexp pattern matching */
if (filterfile && dofilter(l)) {
killed++;
diff -urN leafnode-1.11.2.rel/getfoldedline.c
leafnode-1.11.3.rel/getfoldedline.c
--- leafnode-1.11.2.rel/getfoldedline.c 2003-10-19 23:12:22.000000000 +0100
+++ leafnode-1.11.3.rel/getfoldedline.c 2005-06-08 14:56:13.000000000 +0100
@@ -8,7 +8,7 @@
#include <string.h>
/[EMAIL PROTECTED]@*/ /[EMAIL PROTECTED]@*/ char *
-getfoldedline(FILE * f)
+getfoldedline(FILE * f, char *(*reader)(FILE *))
{
/* what characters are considered whitespace that marks the beginning of
continuation lines.
@@ -18,7 +18,7 @@
int c;
size_t len, oldlen;
- l1 = getaline(f);
+ l1 = reader(f);
if (!l1)
return NULL;
l2 = (char *)critmalloc((len = strlen(l1)) + 1, "getfoldedline");
@@ -33,7 +33,7 @@
ungetc(c, f);
if (strchr(white, c)) {
/* join */
- l1 = getaline(f);
+ l1 = reader(f);
if (l1) {
oldlen = len;
len += strlen(l1) + 1;
@@ -60,7 +60,7 @@
main()
{
char *f;
- while ((f = getfoldedline(stdin))) {
+ while ((f = getfoldedline(stdin, getaline))) {
puts(f);
free(f);
}
diff -urN leafnode-1.11.2.rel/leafnode.h leafnode-1.11.3.rel/leafnode.h
--- leafnode-1.11.2.rel/leafnode.h 2005-04-05 16:56:08.000000000 +0100
+++ leafnode-1.11.3.rel/leafnode.h 2005-06-08 15:06:15.000000000 +0100
@@ -3,7 +3,7 @@
* conditions.
*/
-/* $Id: leafnode.h,v 1.92 2005/04/05 15:56:08 emma Exp $ */
+/* $Id: leafnode.h,v 1.93 2005/06/08 14:06:15 emma Exp $ */
#ifndef LEAFNODE_H
#define LEAFNODE_H
@@ -353,7 +353,7 @@
/* from getfoldedline.c */
/[EMAIL PROTECTED]@*/ /[EMAIL PROTECTED]@*/
-char *getfoldedline(FILE * f);
+char *getfoldedline(FILE * f, char *(*reader)(FILE *));
/* reads one line, regardless of length, returns malloc()ed string! */
/* from writes.c (ln-2) */
--
"You grabbed my hand and we fell into it, like a daydream - or a fever."
--- Begin Message ---Package: leafnode Version: 1.11.2.rel-1 Severity: grave Tags: security upstream confirmed fixed-upstream Leafnode 1.11.2 contains a denial of service bug, fixed in subsequent versions. Find below the full security announcement. Please fix. Thank you, -- Matthias ----------------------------------------------------------------------- leafnode-SA-2005:02.fetchnews-hangs-on-header Topic: potential denial of service in leafnode Announcement: leafnode-SA-2005:02 Author: Matthias Andree Version: 1.00 Announced: 2005-06-08 Category: main Type: potential denial of service Impact: fetchnews hangs, no new fetchnews/texpire processes can be started Credits: Adam Funk (bug report) Danger: medium: - no build-up of memory consumption - no privilege escalation through this bug - malicious upstream server can be unlisted CVE Name: CVE-2005-1911 URL: http://leafnode.sourceforge.net/leafnode-SA-2005-02.txt http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1911 Affects: leafnode versions up to and including 1.11.2 Not affected: leafnode 1.11.3 Default install: affected. Corrected: 2005-06-08 14:06 UTC (CVS) - committed corrected version 2005-06-08 leafnode 1.11.3 released 0. Release history 2005-06-08 1.00 initial announcement 1. Background leafnode is a store-and-forward proxy for Usenet news, is uses the network news transfer protocol (NNTP). It consists of several collaborating programs, the server part is usually started by inetd, xinetd or tcpserver, the client part is usually started by cron, a PPP post-connect script or manually. This security announcement pertains to leafnode-1, the stable branch. The leafnode-2 development branch is not subject to security announcements. 2. Problem description A vulnerability was found in the fetchnews program (the NNTP client) that may under some circumstances cause a wait for input that never arrives, fetchnews "hangs". This hang does not cost CPU. 3. Impact As only one fetchnews program can run at a time, subsequently started fetchnews and texpire programs will terminate. This means that the news database will no longer be updated, older articles will no longer expire, until the hanging fetchnews process gets unstuck, usually through a manual "kill" command or a reboot. 4. Workaround Comment out all configuration pertaining to the malicious server. Note that this is not a full solution as transient network errors can also cause delays in querying other network servers, and it requires manual intervention to find out which server is malicious. 5. Solution Upgrade your leafnode package to version 1.11.3. leafnode 1.11.3 is available from SourceForge: <http://sourceforge.net/project/showfiles.php?group_id=57767> Leafnode 1.X versions are deemed stable, and it is usually best to go for the latest released 1.X version to have all the other bug fixes as well. A. References leafnode home page: <http://leafnode.sourceforge.net/> B. Copyright and License (C) Copyright 2005 by Matthias Andree, <[EMAIL PROTECTED]>. Some rights reserved. This work is licensed under the Creative Commons Attribution-NonCommercial-NoDerivs German License. To view a copy of this license, visit http://creativecommons.org/licenses/by-nc-nd/2.0/de/ or send a letter to Creative Commons; 559 Nathan Abbott Way; Stanford, California 94305; USA. END OF leafnode-SA-2005:02.fetchnews-hangs-on-header
--- End Message ---
signature.asc
Description: Digital signature
