On Tue, 31 May 2011, Adam D. Barratt wrote: > Something very much like that, yes. :-) Please go ahead with the stable > upload; thanks. (Ugh at the debian-changes auto-patch, but that's not > a regression from the current squeeze package, so never mind.)
thanks, stable klibc-1.5.20-1+squeeze1 uploaded. sorry for the debian-changes auto-patch, no idea how that happens. (looks wrong to me too) for oldstable the upload would only target the outstanding ipconfig security issue, see belows debdiff. -- maks diff -Nru klibc-1.5.12/debian/changelog klibc-1.5.12/debian/changelog --- klibc-1.5.12/debian/changelog 2011-06-01 10:33:42.000000000 +0200 +++ klibc-1.5.12/debian/changelog 2011-06-01 10:33:42.000000000 +0200 @@ -1,3 +1,9 @@ +klibc (1.5.12-2lenny1) oldstable; urgency=low + + * ipconfig: Escape DHCP options. (CVE-2011-1930) + + -- maximilian attems <[email protected]> Wed, 01 Jun 2011 10:20:28 +0200 + klibc (1.5.12-2) unstable; urgency=medium * Add backport 11_klibc-Default-signal-3-to-bsd_signal-3.patch. diff -Nru klibc-1.5.12/debian/patches/12_ipconfig-Escape-DHCP-options-written-to-tm.patch klibc-1.5.12/debian/patches/12_ipconfig-Escape-DHCP-options-written-to-tm.patch --- klibc-1.5.12/debian/patches/12_ipconfig-Escape-DHCP-options-written-to-tm.patch 1970-01-01 01:00:00.000000000 +0100 +++ klibc-1.5.12/debian/patches/12_ipconfig-Escape-DHCP-options-written-to-tm.patch 2011-06-01 10:33:42.000000000 +0200 @@ -0,0 +1,97 @@ +From 881498e5141db5bc694522de0622553dc2a6e7bf Mon Sep 17 00:00:00 2001 +From: Maximilian Attems <[email protected]> +Date: Wed, 1 Jun 2011 10:29:01 +0200 +Subject: [PATCH] [klibc] ipconfig: Escape DHCP options written to /tmp/net-$DEVCICE.conf + +DHCP options like domain-name or hostname are written to +/tmp/net-$DEVICE.conf which is typically later used by other scripts to +determine the network configuration. This is done by sourcing the +/tmp/net-$DEVICE.conf file to get all defined variables. + +This patch escapes the DHCP options written to /tmp/net-$DEVICE.conf +to prevent arbitrary code execution. + +Signed-off-by: Ulrich Dangel <[email protected]> +Reviewed-by: H. Peter Anvin <[email protected]> +[ trivial backport to 1.5.12 -maks ] +Signed-off-by: maximilian attems <[email protected]> +--- + usr/kinit/ipconfig/main.c | 55 +++++++++++++++++++++++++++++++------------- + 1 files changed, 39 insertions(+), 16 deletions(-) + +diff --git a/usr/kinit/ipconfig/main.c b/usr/kinit/ipconfig/main.c +index 2ded0f3..3e7f9a7 100644 +--- a/usr/kinit/ipconfig/main.c ++++ b/usr/kinit/ipconfig/main.c +@@ -96,6 +96,25 @@ static void configure_device(struct netdev *dev) + dev->hostname, dev->name); + } + ++static void write_option(FILE* f, const char* name, const char* chr) ++{ ++ ++ fprintf(f, "%s='", name); ++ while (*chr) { ++ switch (*chr) { ++ case '!': ++ case '\'': ++ fprintf(f, "'\\%c'", *chr); ++ break; ++ default: ++ fprintf(f, "%c", *chr); ++ break; ++ } ++ ++chr; ++ } ++ fprintf(f, "'\n"); ++} ++ + static void dump_device_config(struct netdev *dev) + { + char fn[40]; +@@ -104,22 +123,26 @@ static void dump_device_config(struct netdev *dev) + snprintf(fn, sizeof(fn), "/tmp/net-%s.conf", dev->name); + f = fopen(fn, "w"); + if (f) { +- fprintf(f, "DEVICE=%s\n", dev->name); +- fprintf(f, "IPV4ADDR=%s\n", my_inet_ntoa(dev->ip_addr)); +- fprintf(f, "IPV4BROADCAST=%s\n", +- my_inet_ntoa(dev->ip_broadcast)); +- fprintf(f, "IPV4NETMASK=%s\n", my_inet_ntoa(dev->ip_netmask)); +- fprintf(f, "IPV4GATEWAY=%s\n", my_inet_ntoa(dev->ip_gateway)); +- fprintf(f, "IPV4DNS0=%s\n", +- my_inet_ntoa(dev->ip_nameserver[0])); +- fprintf(f, "IPV4DNS1=%s\n", +- my_inet_ntoa(dev->ip_nameserver[1])); +- fprintf(f, "HOSTNAME=%s\n", dev->hostname); +- fprintf(f, "DNSDOMAIN=%s\n", dev->dnsdomainname); +- fprintf(f, "NISDOMAIN=%s\n", dev->nisdomainname); +- fprintf(f, "ROOTSERVER=%s\n", my_inet_ntoa(dev->ip_server)); +- fprintf(f, "ROOTPATH=%s\n", dev->bootpath); +- fprintf(f, "filename=\"%s\"\n", dev->filename); ++ write_option(f, "DEVICE", dev->name); ++ write_option(f, "IPV4ADDR", ++ my_inet_ntoa(dev->ip_addr)); ++ write_option(f, "IPV4BROADCAST", ++ my_inet_ntoa(dev->ip_broadcast)); ++ write_option(f, "IPV4NETMASK", ++ my_inet_ntoa(dev->ip_netmask)); ++ write_option(f, "IPV4GATEWAY", ++ my_inet_ntoa(dev->ip_gateway)); ++ write_option(f, "IPV4DNS0", ++ my_inet_ntoa(dev->ip_nameserver[0])); ++ write_option(f, "IPV4DNS1", ++ my_inet_ntoa(dev->ip_nameserver[1])); ++ write_option(f, "HOSTNAME", dev->hostname); ++ write_option(f, "DNSDOMAIN", dev->dnsdomainname); ++ write_option(f, "NISDOMAIN", dev->nisdomainname); ++ write_option(f, "ROOTSERVER", ++ my_inet_ntoa(dev->ip_server)); ++ write_option(f, "ROOTPATH", dev->bootpath); ++ write_option(f, "filename", dev->filename); + fclose(f); + } + } +-- +1.5.6.5 +
signature.asc
Description: Digital signature
