Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-1.9.git;a=commitdiff;h=1d1fbbe2557db52056ee1cbcf20099149ed6b642
commit 1d1fbbe2557db52056ee1cbcf20099149ed6b642 Author: kikadf <[email protected]> Date: Tue Aug 26 17:40:51 2014 +0200 ppp-2.4.5-4arcturus1-x86_64 * Fix CVE-2014-3158 diff --git a/source/base/ppp/CVE-2014-3158.patch b/source/base/ppp/CVE-2014-3158.patch new file mode 100644 index 0000000..8816362 --- /dev/null +++ b/source/base/ppp/CVE-2014-3158.patch @@ -0,0 +1,58 @@ +From 7658e8257183f062dc01f87969c140707c7e52cb Mon Sep 17 00:00:00 2001 +From: Paul Mackerras <[email protected]> +Date: Fri, 1 Aug 2014 16:05:42 +1000 +Subject: [PATCH] pppd: Eliminate potential integer overflow in option parsing + +When we are reading in a word from an options file, we maintain a count +of the length we have seen so far in 'len', which is an int. When len +exceeds MAXWORDLEN - 1 (i.e. 1023) we cease storing characters in the +buffer but we continue to increment len. Since len is an int, it will +wrap around to -2147483648 after it reaches 2147483647. At that point +our test of (len < MAXWORDLEN-1) will succeed and we will start writing +characters to memory again. + +This may enable an attacker to overwrite the heap and thereby corrupt +security-relevant variables. For this reason it has been assigned a +CVE identifier, CVE-2014-3158. + +This fixes the bug by ceasing to increment len once it reaches MAXWORDLEN. + +Reported-by: Lee Campbell <[email protected]> +Signed-off-by: Paul Mackerras <[email protected]> +--- + pppd/options.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/pppd/options.c b/pppd/options.c +index 45fa742..e9042d1 100644 +--- a/pppd/options.c ++++ b/pppd/options.c +@@ -1289,9 +1289,10 @@ getword(f, word, newlinep, filename) + /* + * Store the resulting character for the escape sequence. + */ +- if (len < MAXWORDLEN-1) ++ if (len < MAXWORDLEN) { + word[len] = value; +- ++len; ++ ++len; ++ } + + if (!got) + c = getc(f); +@@ -1329,9 +1330,10 @@ getword(f, word, newlinep, filename) + /* + * An ordinary character: store it in the word and get another. + */ +- if (len < MAXWORDLEN-1) ++ if (len < MAXWORDLEN) { + word[len] = c; +- ++len; ++ ++len; ++ } + + c = getc(f); + } +-- +1.8.3.1 + diff --git a/source/base/ppp/FrugalBuild b/source/base/ppp/FrugalBuild index 651dd4b..0c2e6b4 100644 --- a/source/base/ppp/FrugalBuild +++ b/source/base/ppp/FrugalBuild @@ -4,7 +4,7 @@ pkgname=ppp pkgver=2.4.5 -pkgrel=3 +pkgrel=4arcturus1 pkgdesc="The PPP (Point-to-Point Protocol) daemon" url="http://www.samba.org/ppp/"; groups=('base') @@ -18,10 +18,14 @@ sha1sums=('cb977b31584e3488e08a643aaa672fdb229d2e78' \ '09472529dfcf1f47d7e7f65067291f651c7ac476' \ '7c2ed3bcf34b750f6c29f95ddf43332d09a7a793') +# FSA fix *** +source=(${source[@]} CVE-2014-3158.patch) +sha1sums=(${sha1sums[@]} '23f51e6f45969f61c07fafbae076e1da5106fcdc') +# *********** + + build() { - Fcd - Fpatchall CFLAGS="$CFLAGS -D_GNU_SOURCE" _______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
