--- Begin Message ---
Package: release.debian.org
Severity: normal
Tags: jessie
User: release.debian....@packages.debian.org
Usertags: pu
X-Debbugs-CC: Thomas Goirand <z...@debian.org>
Hi,
The attached debdiff fixes #816759 (minissdpd: CVE-2016-3178
CVE-2016-3179) for jessie. Both CVEs are taged 'no-DSA' by the security
team.
Thanks,
James
-- System Information:
Debian Release: stretch/sid
APT prefers unstable-debug
APT policy: (500, 'unstable-debug'), (500, 'unstable'), (500,
'testing'), (1, 'experimental-debug'), (1, 'experimental')
Architecture: amd64 (x86_64)
Kernel: Linux 4.7.0-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
diff -Nru minissdpd-1.2.20130907/debian/changelog
minissdpd-1.2.20130907/debian/changelog
--- minissdpd-1.2.20130907/debian/changelog 2014-07-14 08:02:57.000000000
+0100
+++ minissdpd-1.2.20130907/debian/changelog 2016-10-24 22:46:46.000000000
+0100
@@ -1,3 +1,15 @@
+minissdpd (1.2.20130907-3+deb8u1) jessie; urgency=high
+
+ * Non-maintainer upload.
+ * Fix CVE-2016-3178 and CVE-2016-3179. (Closes: #816759)
+ The minissdpd daemon contains a improper validation of array index
+ vulnerability (CWE-129) when processing requests sent to the Unix
+ socket at /var/run/minissdpd.sock the Unix socket can be accessed
+ by an unprivileged user to send invalid request causes an
+ out-of-bounds memory access that crashes the minissdpd daemon.
+
+ -- James Cowgill <jcowg...@debian.org> Mon, 24 Oct 2016 22:46:46 +0100
+
minissdpd (1.2.20130907-3) unstable; urgency=medium
* Removed $all from init.d script.
diff -Nru minissdpd-1.2.20130907/debian/patches/CVE-2016-3178.patch
minissdpd-1.2.20130907/debian/patches/CVE-2016-3178.patch
--- minissdpd-1.2.20130907/debian/patches/CVE-2016-3178.patch 1970-01-01
01:00:00.000000000 +0100
+++ minissdpd-1.2.20130907/debian/patches/CVE-2016-3178.patch 2016-10-24
22:43:23.000000000 +0100
@@ -0,0 +1,95 @@
+Description: Fix CVE-2016-3178
+ buffer overflow while handling negative length request
+Author: Salva Peiró <speir...@gmail.com>
+Origin: upstream,
https://github.com/miniupnp/miniupnp/commit/b238cade9a173c6f751a34acf8ccff838a62aa47
+Bug-Debian: https://bugs.debian.org/816759
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+--- a/minissdpd.c
++++ b/minissdpd.c
+@@ -555,7 +555,7 @@ void processRequest(struct reqelem * req
+ type = buf[0];
+ p = buf + 1;
+ DECODELENGTH_CHECKLIMIT(l, p, buf + n);
+- if(p+l > buf+n) {
++ if(l > (unsigned)(buf+n-p)) {
+ syslog(LOG_WARNING, "bad request (length encoding)");
+ goto error;
+ }
+@@ -661,7 +661,7 @@ void processRequest(struct reqelem * req
+ goto error;
+ }
+ DECODELENGTH_CHECKLIMIT(l, p, buf + n);
+- if(p+l > buf+n) {
++ if(l > (unsigned)(buf+n-p)) {
+ syslog(LOG_WARNING, "bad request (length encoding)");
+ goto error;
+ }
+@@ -679,7 +679,7 @@ void processRequest(struct reqelem * req
+ newserv->usn[l] = '\0';
+ p += l;
+ DECODELENGTH_CHECKLIMIT(l, p, buf + n);
+- if(p+l > buf+n) {
++ if(l > (unsigned)(buf+n-p)) {
+ syslog(LOG_WARNING, "bad request (length encoding)");
+ goto error;
+ }
+@@ -697,7 +697,7 @@ void processRequest(struct reqelem * req
+ newserv->server[l] = '\0';
+ p += l;
+ DECODELENGTH_CHECKLIMIT(l, p, buf + n);
+- if(p+l > buf+n) {
++ if(l > (unsigned)(buf+n-p)) {
+ syslog(LOG_WARNING, "bad request (length encoding)");
+ goto error;
+ }
+--- a/testminissdpd.c
++++ b/testminissdpd.c
+@@ -45,6 +45,23 @@ void printresponse(const unsigned char *
+ #define SENDCOMMAND(command, size) write(s, command, size); \
+ printf("Command written type=%u\n", (unsigned)command[0]);
+
++int connect_unix_socket(const char * sockpath)
++{
++ int s;
++ struct sockaddr_un addr;
++
++ s = socket(AF_UNIX, SOCK_STREAM, 0);
++ addr.sun_family = AF_UNIX;
++ strncpy(addr.sun_path, sockpath, sizeof(addr.sun_path));
++ if(connect(s, (struct sockaddr *)&addr, sizeof(struct sockaddr_un)) <
0) {
++ fprintf(stderr, "connecting to %s : ", addr.sun_path);
++ perror("connect");
++ exit(1);
++ }
++ printf("Connected to %s\n", addr.sun_path);
++ return s;
++}
++
+ /* test program for minissdpd */
+ int
+ main(int argc, char * * argv)
+@@ -52,6 +69,7 @@ main(int argc, char * * argv)
+ char command1[] =
"\x01\x00urn:schemas-upnp-org:device:InternetGatewayDevice";
+ char command2[] =
"\x02\x00uuid:fc4ec57e-b051-11db-88f8-0060085db3f6::upnp:rootdevice";
+ char command3[] = { 0x03, 0x00 };
++ const char bad_command4[] = { 0x04, 0x01, 0x60, 0x8f, 0xff, 0xff,
0xff, 0x7f};
+ struct sockaddr_un addr;
+ int s;
+ int i;
+@@ -89,6 +107,15 @@ main(int argc, char * * argv)
+ n = read(s, buf, sizeof(buf));
+ printf("Response received %d bytes\n", (int)n);
+ printresponse(buf, n);
++ if(n == 0) {
++ close(s);
++ s = connect_unix_socket(sockpath);
++ }
++
++ n = SENDCOMMAND(bad_command4, sizeof(bad_command4));
++ n = read(s, buf, sizeof(buf));
++ printf("Response received %d bytes\n", (int)n);
++ printresponse(buf, n);
+
+ close(s);
+ return 0;
diff -Nru minissdpd-1.2.20130907/debian/patches/CVE-2016-3179.patch
minissdpd-1.2.20130907/debian/patches/CVE-2016-3179.patch
--- minissdpd-1.2.20130907/debian/patches/CVE-2016-3179.patch 1970-01-01
01:00:00.000000000 +0100
+++ minissdpd-1.2.20130907/debian/patches/CVE-2016-3179.patch 2016-10-24
22:43:23.000000000 +0100
@@ -0,0 +1,17 @@
+Description: Fix CVE-2016-3179
+ freeing of uninitialized pointer
+Author: Salva Peiró <speir...@gmail.com>
+Origin: upstream,
https://github.com/miniupnp/miniupnp/commit/140ee8d2204b383279f854802b27bdb41c1d5d1a
+Bug-Debian: https://bugs.debian.org/816759
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+--- a/minissdpd.c
++++ b/minissdpd.c
+@@ -644,6 +644,7 @@ void processRequest(struct reqelem * req
+ syslog(LOG_ERR, "cannot allocate memory");
+ goto error;
+ }
++ memset(newserv, 0, sizeof(struct service)); /* set pointers
to NULL */
+ if(containsForbiddenChars(p, l)) {
+ syslog(LOG_ERR, "bad request (st contains forbidden
chars)");
+ goto error;
diff -Nru minissdpd-1.2.20130907/debian/patches/series
minissdpd-1.2.20130907/debian/patches/series
--- minissdpd-1.2.20130907/debian/patches/series 2014-07-14
08:02:57.000000000 +0100
+++ minissdpd-1.2.20130907/debian/patches/series 2016-10-24
22:43:23.000000000 +0100
@@ -1,2 +1,4 @@
link-with-lfreebsd-glue.patch
using-LDFLAGS-in-Makefile.patch
+CVE-2016-3178.patch
+CVE-2016-3179.patch
signature.asc
Description: OpenPGP digital signature
--- End Message ---
