Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-1.9.git;a=commitdiff;h=64cd605dde2df74674f7398cb942324c912a975d
commit 64cd605dde2df74674f7398cb942324c912a975d Author: kikadf <[email protected]> Date: Thu Feb 6 09:23:23 2014 +0100 curl-7.26.0-2arcturus2-x86_64 * Fix CVE-2014-0015 diff --git a/source/network/curl/CVE-2014-0015.patch b/source/network/curl/CVE-2014-0015.patch new file mode 100644 index 0000000..8bfb51a --- /dev/null +++ b/source/network/curl/CVE-2014-0015.patch @@ -0,0 +1,30 @@ +From 8ae35102c43d8d06572c3a1292eb6e27e663c78d Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg <[email protected]> +Date: Tue, 7 Jan 2014 09:33:54 +0100 +Subject: [PATCH] ConnectionExists: fix NTLM check for new connection + +When the requested authentication bitmask includes NTLM, we cannot +re-use a connection for another username/password as we then risk +re-using NTLM (connection-based auth). + +This has the unfortunate downside that if you include NTLM as a possible +auth, you cannot re-use connections for other usernames/passwords even +if NTLM doesn't end up the auth type used. + +Reported-by: Paras S +Patched-by: Paras S +Bug: http://curl.haxx.se/mail/lib-2014-01/0046.html + +--- ./lib/url.c.orig 2014-01-14 16:21:29.832088000 +0200 ++++ ./lib/url.c 2014-01-14 16:32:43.074018000 +0200 +@@ -3103,8 +3103,8 @@ ConnectionExists(struct SessionHandle *d + } + if((needle->handler->protocol & CURLPROTO_FTP) || + ((needle->handler->protocol & CURLPROTO_HTTP) && +- ((data->state.authhost.want==CURLAUTH_NTLM) || +- (data->state.authhost.want==CURLAUTH_NTLM_WB)))) { ++ ((data->state.authhost.want & CURLAUTH_NTLM) || ++ (data->state.authhost.want & CURLAUTH_NTLM_WB)))) { + /* This is FTP or HTTP+NTLM, verify that we're using the same name + and password as well */ + if(!strequal(needle->user, check->user) || diff --git a/source/network/curl/FrugalBuild b/source/network/curl/FrugalBuild index e2cee60..a818f32 100644 --- a/source/network/curl/FrugalBuild +++ b/source/network/curl/FrugalBuild @@ -7,7 +7,7 @@ options+=('asneeded') pkgname=curl pkgver=7.26.0 -pkgrel=2arcturus1 +pkgrel=2arcturus2 pkgdesc="A command line tool for transferring data specified with URL syntax." url="http://curl.haxx.se"; makedepends=('groff') @@ -21,8 +21,8 @@ signatures=($source.asc) # FSA fix *** source=(${source[@]} CVE-2013-0249.patch CVE-2013-2174.patch CVE-2013-6422.patch - CVE-2013-1944.patch CVE-2013-4545.patch) -signatures=(${signatures[@]} '' '' '' '' '') + CVE-2013-1944.patch CVE-2013-4545.patch CVE-2014-0015.patch) +signatures=(${signatures[@]} '' '' '' '' '' '') # *********** _______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
