Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-current.git;a=commitdiff;h=f5767617efbd95a87acd7b1a44607e8251e81fa0
commit f5767617efbd95a87acd7b1a44607e8251e81fa0 Author: kikadf <[email protected]> Date: Thu Sep 25 14:54:35 2014 +0200 krfb-4.14.1-2-x86_64 * Fix CVE-2014-6055 diff --git a/source/kde/krfb/CVE-2014-6055-1.patch b/source/kde/krfb/CVE-2014-6055-1.patch new file mode 100644 index 0000000..19a30fd --- /dev/null +++ b/source/kde/krfb/CVE-2014-6055-1.patch @@ -0,0 +1,30 @@ +From: Martin T. H. Sandsmark <[email protected]> +Date: Tue, 23 Sep 2014 20:46:27 +0000 +Subject: libvncserver: Check malloc() return value on client->server ClientCutText message. +X-Git-Url: http://quickgit.kde.org/?p=krfb.git&a=commitdiff&h=d931eafccf3140d740ac61e876dce72a23ade7f4 +--- +libvncserver: Check malloc() return value on client->server ClientCutText message. + +Client can send up to 2**32-1 bytes of text, and such a large allocation +is likely to fail in case of high memory pressure. This would in a +server crash (write at address 0). + +Upstream commit: 6037a9074d52b1963c97cb28ea1096c7c14cbf28 +--- + + +--- a/libvncserver/rfbserver.c ++++ b/libvncserver/rfbserver.c +@@ -2404,6 +2404,12 @@ + + str = (char *)malloc(msg.cct.length); + ++ if (str == NULL) { ++ rfbLogPerror("rfbProcessClientNormalMessage: not enough memory"); ++ rfbCloseClient(cl); ++ return; ++ } ++ + if ((n = rfbReadExact(cl, str, msg.cct.length)) <= 0) { + if (n != 0) + rfbLogPerror("rfbProcessClientNormalMessage: read"); diff --git a/source/kde/krfb/CVE-2014-6055-2.patch b/source/kde/krfb/CVE-2014-6055-2.patch new file mode 100644 index 0000000..4a376f3 --- /dev/null +++ b/source/kde/krfb/CVE-2014-6055-2.patch @@ -0,0 +1,39 @@ +From: Martin T. H. Sandsmark <[email protected]> +Date: Tue, 23 Sep 2014 20:43:38 +0000 +Subject: libnvcserver: Do not accept a scaling factor of zero. +X-Git-Url: http://quickgit.kde.org/?p=krfb.git&a=commitdiff&h=126a746dd7bee35840083e9bec7a52935a010346 +--- +libnvcserver: Do not accept a scaling factor of zero. + +This would cause a division by zero and crash the server. + +Upstream commit: 05a9bd41a8ec0a9d580a8f420f41718bdd235446 +--- + + +--- a/libvncserver/rfbserver.c ++++ b/libvncserver/rfbserver.c +@@ -2428,6 +2428,11 @@ + rfbCloseClient(cl); + return; + } ++ if (msg.ssc.scale == 0) { ++ rfbLogPerror("rfbProcessClientNormalMessage: will not accept a scale factor of zero"); ++ rfbCloseClient(cl); ++ return; ++ } + rfbStatRecordMessageRcvd(cl, msg.type, sz_rfbSetScaleMsg, sz_rfbSetScaleMsg); + rfbLog("rfbSetScale(%d)\n", msg.ssc.scale); + rfbScalingSetup(cl,cl->screen->width/msg.ssc.scale, cl->screen->height/msg.ssc.scale); +@@ -2441,6 +2446,11 @@ + sz_rfbSetScaleMsg - 1)) <= 0) { + if (n != 0) + rfbLogPerror("rfbProcessClientNormalMessage: read"); ++ rfbCloseClient(cl); ++ return; ++ } ++ if (msg.ssc.scale == 0) { ++ rfbLogPerror("rfbProcessClientNormalMessage: will not accept a scale factor of zero"); + rfbCloseClient(cl); + return; + } diff --git a/source/kde/krfb/CVE-2014-6055-3.patch b/source/kde/krfb/CVE-2014-6055-3.patch new file mode 100644 index 0000000..9e9137d --- /dev/null +++ b/source/kde/krfb/CVE-2014-6055-3.patch @@ -0,0 +1,134 @@ +From: Martin T. H. Sandsmark <[email protected]> +Date: Tue, 23 Sep 2014 20:40:17 +0000 +Subject: libvncserver: Fix multiple stack-based buffer overflows in file transfer feature +X-Git-Url: http://quickgit.kde.org/?p=krfb.git&a=commitdiff&h=2e211579455fd832fb21322482c005b6a85aa1bf +--- +libvncserver: Fix multiple stack-based buffer overflows in file transfer feature + +Upstream commit: 06ccdf016154fde8eccb5355613ba04c59127b2e + +CVE-2014-6055 +--- + + +--- a/libvncserver/rfbserver.c ++++ b/libvncserver/rfbserver.c +@@ -1175,12 +1175,20 @@ + #define RFB_FILE_ATTRIBUTE_TEMPORARY 0x100 + #define RFB_FILE_ATTRIBUTE_COMPRESSED 0x800 + +-rfbBool rfbFilenameTranslate2UNIX(rfbClientPtr cl, char *path, char *unixPath) ++rfbBool rfbFilenameTranslate2UNIX(rfbClientPtr cl, char *path, char *unixPath, size_t unixPathMaxLen) + { + int x; + char *home=NULL; + + FILEXFER_ALLOWED_OR_CLOSE_AND_RETURN("", cl, FALSE); ++ ++ /* ++ * Do not use strncpy() - truncating the file name would probably have undesirable side effects ++ * Instead check if destination buffer is big enough ++ */ ++ ++ if (strlen(path) >= unixPathMaxLen) ++ return FALSE; + + /* C: */ + if (path[0]=='C' && path[1]==':') +@@ -1190,6 +1198,10 @@ + home = getenv("HOME"); + if (home!=NULL) + { ++ /* Re-check buffer size */ ++ if ((strlen(path) + strlen(home) + 1) >= unixPathMaxLen) ++ return FALSE; ++ + strcpy(unixPath, home); + strcat(unixPath,"/"); + strcat(unixPath, path); +@@ -1227,7 +1239,9 @@ + FILEXFER_ALLOWED_OR_CLOSE_AND_RETURN("", cl, FALSE); + + /* Client thinks we are Winblows */ +- rfbFilenameTranslate2UNIX(cl, buffer, path); ++ if (!rfbFilenameTranslate2UNIX(cl, buffer, path, sizeof(path))) ++ return FALSE; ++ + + if (DB) rfbLog("rfbProcessFileTransfer() rfbDirContentRequest: rfbRDirContent: \"%s\"->\"%s\"\n",buffer, path); + +@@ -1504,7 +1518,12 @@ + /* add some space to the end of the buffer as we will be adding a timespec to it */ + if ((buffer = rfbProcessFileTransferReadBuffer(cl, length))==NULL) return FALSE; + /* The client requests a File */ +- rfbFilenameTranslate2UNIX(cl, buffer, filename1); ++ if (!rfbFilenameTranslate2UNIX(cl, buffer, filename1, sizeof(filename1))) ++ { ++ if (buffer!=NULL) free(buffer); ++ return FALSE; ++ } ++ + cl->fileTransfer.fd=open(filename1, O_RDONLY, 0744); + + /* +@@ -1620,7 +1639,12 @@ + } + sizeHtmp = Swap32IfLE(sizeHtmp); + +- rfbFilenameTranslate2UNIX(cl, buffer, filename1); ++ if (!rfbFilenameTranslate2UNIX(cl, buffer, filename1, sizeof(filename1))) ++ { ++ if (buffer!=NULL) free(buffer); ++ return FALSE; ++ } ++ + + /* If the file exists... We can send a rfbFileChecksums back to the client before we send an rfbFileAcceptHeader */ + /* TODO: Delta Transfer */ +@@ -1746,7 +1770,12 @@ + if ((buffer = rfbProcessFileTransferReadBuffer(cl, length))==NULL) return FALSE; + switch (contentParam) { + case rfbCDirCreate: /* Client requests the creation of a directory */ +- rfbFilenameTranslate2UNIX(cl, buffer, filename1); ++ if (!rfbFilenameTranslate2UNIX(cl, buffer, filename1, sizeof(filename1))) ++ { ++ if (buffer!=NULL) free(buffer); ++ return FALSE; ++ } ++ + retval = mkdir(filename1, 0755); + if (DB) rfbLog("rfbProcessFileTransfer() rfbCommand: rfbCDirCreate(\"%s\"->\"%s\") %s\n", buffer, filename1, (retval==-1?"Failed":"Success")); + /* +@@ -1755,7 +1784,11 @@ + if (buffer!=NULL) free(buffer); + return retval; + case rfbCFileDelete: /* Client requests the deletion of a file */ +- rfbFilenameTranslate2UNIX(cl, buffer, filename1); ++ if (!rfbFilenameTranslate2UNIX(cl, buffer, filename1, sizeof(filename1))) ++ { ++ if (buffer!=NULL) free(buffer); ++ return FALSE; ++ } + if (stat(filename1,&statbuf)==0) + { + if (S_ISDIR(statbuf.st_mode)) +@@ -1773,8 +1806,17 @@ + { + /* Split into 2 filenames ('*' is a seperator) */ + *p = '\0'; +- rfbFilenameTranslate2UNIX(cl, buffer, filename1); +- rfbFilenameTranslate2UNIX(cl, p+1, filename2); ++ if (!rfbFilenameTranslate2UNIX(cl, buffer, filename1, sizeof(filename1))) ++ { ++ if (buffer!=NULL) free(buffer); ++ return FALSE; ++ } ++ ++ if (!rfbFilenameTranslate2UNIX(cl, p+1, filename2, sizeof(filename2))) ++ { ++ if (buffer!=NULL) free(buffer); ++ return FALSE; ++ } + retval = rename(filename1,filename2); + if (DB) rfbLog("rfbProcessFileTransfer() rfbCommand: rfbCFileRename(\"%s\"->\"%s\" -->> \"%s\"->\"%s\") %s\n", buffer, filename1, p+1, filename2, (retval==-1?"Failed":"Success")); + /* diff --git a/source/kde/krfb/CVE-2014-6055-4.patch b/source/kde/krfb/CVE-2014-6055-4.patch new file mode 100644 index 0000000..dc22d82 --- /dev/null +++ b/source/kde/krfb/CVE-2014-6055-4.patch @@ -0,0 +1,25 @@ +From: Martin T. H. Sandsmark <[email protected]> +Date: Tue, 23 Sep 2014 15:54:11 +0000 +Subject: libvncserver: Fix stack-based buffer overflow in rfbFileTransferOffer message, FileTime processing +X-Git-Url: http://quickgit.kde.org/?p=krfb.git&a=commitdiff&h=857c2b411ed806ef806116407612a2d2a40fab9c +--- +libvncserver: Fix stack-based buffer overflow in rfbFileTransferOffer message, FileTime processing + +Upstream commit: f528072216dec01cee7ca35d94e171a3b909e677 + +CVE-2014-6055 +--- + + +--- a/libvncserver/rfbserver.c ++++ b/libvncserver/rfbserver.c +@@ -1602,7 +1602,8 @@ + p = strrchr(buffer, ','); + if (p!=NULL) { + *p = '\0'; +- strcpy(szFileTime, p+1); ++ strncpy(szFileTime, p+1, sizeof(szFileTime)); ++ szFileTime[sizeof(szFileTime)-1] = '\x00'; /* ensure NULL terminating byte is present, even if copy overflowed */ + } else + szFileTime[0]=0; + diff --git a/source/kde/krfb/FrugalBuild b/source/kde/krfb/FrugalBuild index 51f7e78..0f84b65 100644 --- a/source/kde/krfb/FrugalBuild +++ b/source/kde/krfb/FrugalBuild @@ -4,7 +4,7 @@ options+=('asneeded') pkgname=krfb -pkgrel=1 +pkgrel=2 pkgdesc="KRfb is a RFB protocol server (VNC)." groups=('kde' 'kde-minimal') archs=('i686' 'x86_64') @@ -12,4 +12,14 @@ Finclude kde depends=("${depends[@]}" "libdnssd>=$_F_kde_ver" "telepathy-qt4") makedepends=("${makedepends[@]}" "kdelibs>=$_F_kde_ver" "kdelibs-compiletime>=$_F_kde_ver") + +# FSA fix *** +source=(${source[@]} CVE-2014-6055-1.patch CVE-2014-6055-2.patch CVE-2014-6055-3.patch + CVE-2014-6055-4.patch) +sha1sums=(${sha1sums[@]} '6556f54772be512f25082d814cdbd2a516aea183' \ + '5bee319759cebc95f8daad67e35277bcf83f5eb9' \ + '9ada7b3f4caaeba3b989e1725932826e1e3b0a13' \ + '359ee8d6ba8f187e586ee881558e8ef78bfc470b') +# *********** + # optimization OK _______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
