Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-current.git;a=commitdiff;h=fb86b4024a49c01bd387ba981bf1b73a287c01e5
commit fb86b4024a49c01bd387ba981bf1b73a287c01e5 Author: kikadf <[email protected]> Date: Wed Apr 16 16:56:37 2014 +0200 openssh-6.1p1-2-x86_64 * Fix CVE-2013-4548, CVE-2014-2532, CVE-2014-2653 diff --git a/source/network/openssh/CVE-2013-4548.patch b/source/network/openssh/CVE-2013-4548.patch new file mode 100644 index 0000000..654e12c --- /dev/null +++ b/source/network/openssh/CVE-2013-4548.patch @@ -0,0 +1,17 @@ +Description: fix code execution via memory corruption when using an AES-GCM cipher +Origin: upstream, http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/monitor_wrap.c.diff?r1=1.76;r2=1.77 +Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=729029 + +Index: openssh-6.2p2/monitor_wrap.c +=================================================================== +--- openssh-6.2p2.orig/monitor_wrap.c 2013-11-08 07:39:37.000000000 -0500 ++++ openssh-6.2p2/monitor_wrap.c 2013-11-08 07:50:53.712922305 -0500 +@@ -498,7 +498,7 @@ + buffer_init(&b); + buffer_append(&b, blob, blen); + +- newkey = xmalloc(sizeof(*newkey)); ++ newkey = xcalloc(1, sizeof(*newkey)); + enc = &newkey->enc; + mac = &newkey->mac; + comp = &newkey->comp; diff --git a/source/network/openssh/CVE-2014-2532.patch b/source/network/openssh/CVE-2014-2532.patch new file mode 100644 index 0000000..409da83 --- /dev/null +++ b/source/network/openssh/CVE-2014-2532.patch @@ -0,0 +1,30 @@ +Description: fix AcceptEnv wildcard environment restrictions bypass +Origin: upstream, http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/session.c.diff?r1=1.270;r2=1.271 + +Index: openssh-6.2p2/session.c +=================================================================== +--- openssh-6.2p2.orig/session.c 2014-03-21 10:51:44.356050204 -0400 ++++ openssh-6.2p2/session.c 2014-03-21 10:57:33.044059541 -0400 +@@ -966,6 +966,11 @@ + *envsizep = 1; + } + ++ if (strchr(name, '=') != NULL) { ++ error("Invalid environment variable \"%.100s\"", name); ++ return; ++ } ++ + /* + * Find the slot where the value should be stored. If the variable + * already exists, we reuse the slot; otherwise we append a new slot +@@ -2194,8 +2199,8 @@ + char *name, *val; + u_int name_len, val_len, i; + +- name = packet_get_string(&name_len); +- val = packet_get_string(&val_len); ++ name = packet_get_cstring(&name_len); ++ val = packet_get_cstring(&val_len); + packet_check_eom(); + + /* Don't set too many environment variables */ diff --git a/source/network/openssh/CVE-2014-2653.patch b/source/network/openssh/CVE-2014-2653.patch new file mode 100644 index 0000000..2bf858a --- /dev/null +++ b/source/network/openssh/CVE-2014-2653.patch @@ -0,0 +1,74 @@ +Description: Attempt SSHFP lookup even if server presents a certificate + If an ssh server presents a certificate to the client, then the client does + not check the DNS for SSHFP records. This means that a malicious server can + essentially disable DNS-host-key-checking, which means the client will fall + back to asking the user (who will just say "yes" to the fingerprint, + sadly). + . + This is CVE-2014-2653. +Author: Damien Miller <[email protected]> +Reviewed-by: Matthew Vernon <[email protected]> +Bug-Debian: http://bugs.debian.org/742513 +Forwarded: not-needed +Last-Update: 2014-04-03 + +Index: b/sshconnect.c +=================================================================== +--- a/sshconnect.c ++++ b/sshconnect.c +@@ -1110,29 +1110,39 @@ + { + int flags = 0; + char *fp; ++ Key *plain = NULL; + + fp = key_fingerprint(host_key, SSH_FP_MD5, SSH_FP_HEX); + debug("Server host key: %s %s", key_type(host_key), fp); + xfree(fp); + +- /* XXX certs are not yet supported for DNS */ +- if (!key_is_cert(host_key) && options.verify_host_key_dns && +- verify_host_key_dns(host, hostaddr, host_key, &flags) == 0) { +- if (flags & DNS_VERIFY_FOUND) { +- +- if (options.verify_host_key_dns == 1 && +- flags & DNS_VERIFY_MATCH && +- flags & DNS_VERIFY_SECURE) +- return 0; +- +- if (flags & DNS_VERIFY_MATCH) { +- matching_host_key_dns = 1; +- } else { +- warn_changed_key(host_key); +- error("Update the SSHFP RR in DNS with the new " +- "host key to get rid of this message."); ++ if (options.verify_host_key_dns) { ++ /* ++ * XXX certs are not yet supported for DNS, so downgrade ++ * them and try the plain key. ++ */ ++ plain = key_from_private(host_key); ++ if (key_is_cert(plain)) ++ key_drop_cert(plain); ++ if (verify_host_key_dns(host, hostaddr, plain, &flags) == 0) { ++ if (flags & DNS_VERIFY_FOUND) { ++ if (options.verify_host_key_dns == 1 && ++ flags & DNS_VERIFY_MATCH && ++ flags & DNS_VERIFY_SECURE) { ++ key_free(plain); ++ return 0; ++ } ++ if (flags & DNS_VERIFY_MATCH) { ++ matching_host_key_dns = 1; ++ } else { ++ warn_changed_key(plain); ++ error("Update the SSHFP RR in DNS " ++ "with the new host key to get rid " ++ "of this message."); ++ } + } + } ++ key_free(plain); + } + + return check_host_key(host, hostaddr, options.port, host_key, RDRW, diff --git a/source/network/openssh/FrugalBuild b/source/network/openssh/FrugalBuild index 38abe7a..3e3eba9 100644 --- a/source/network/openssh/FrugalBuild +++ b/source/network/openssh/FrugalBuild @@ -4,7 +4,7 @@ pkgname=openssh pkgver=6.1p1 -pkgrel=1 +pkgrel=2 pkgdesc='Secure Shell daemon and clients' url="http://www.openssh.com/"; backup=('etc/ssh/ssh_config' 'etc/ssh/sshd_config') @@ -30,6 +30,13 @@ subrodepends=("openssh") subgroups=('xapps') subarchs=('x86_64 i686 arm') +# FSA fix *** +source=(${source[@]} CVE-2013-4548.patch CVE-2014-2532.patch CVE-2014-2653.patch) +sha1sums=(${sha1sums[@]} '8ff203e40c93b319e17d3598b51a908b30e5e04b' \ + 'ca0c9a7972adb8cdeab9b6019408a7e1e58dbb16' \ + '2ffe0cdfdccbd5c7d0b46694a2b2ca9fed2e0b21') +# *********** + build() { Fbuild --sysconfdir=/etc/ssh --datadir=/usr/share/openssh \ _______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
