Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-1.9.git;a=commitdiff;h=5f70ddf93a1d7c5e1a7b5841f00060560863f32a
commit 5f70ddf93a1d7c5e1a7b5841f00060560863f32a Author: kikadf <[email protected]> Date: Fri Oct 31 08:58:32 2014 +0100 wget-1.13.4-3arcturus1-x86_64 * Fix CVE-2014-4877 diff --git a/source/network/wget/CVE-2014-4877.patch b/source/network/wget/CVE-2014-4877.patch new file mode 100644 index 0000000..cf97c22 --- /dev/null +++ b/source/network/wget/CVE-2014-4877.patch @@ -0,0 +1,114 @@ +Description: fix remote code execution via absolute path traversal + vulnerability in FTP +Origin: upstream, http://git.savannah.gnu.org/cgit/wget.git/commit/?id=18b0979357ed7dc4e11d4f2b1d7e0f5932d82aa7 +Origin: upstream, http://git.savannah.gnu.org/cgit/wget.git/commit/?id=69c45cba4382fcaabe3d86876bd5463dc34f442c +Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=766981 + +Index: wget-1.13.4/doc/wget.texi +=================================================================== +--- wget-1.13.4.orig/doc/wget.texi 2014-10-30 10:08:31.314744203 -0400 ++++ wget-1.13.4/doc/wget.texi 2014-10-30 10:08:31.310744077 -0400 +@@ -1739,17 +1739,18 @@ + + @cindex symbolic links, retrieving + @item --retr-symlinks +-Usually, when retrieving @sc{ftp} directories recursively and a symbolic +-link is encountered, the linked-to file is not downloaded. Instead, a +-matching symbolic link is created on the local filesystem. The +-pointed-to file will not be downloaded unless this recursive retrieval +-would have encountered it separately and downloaded it anyway. ++By default, when retrieving @sc{ftp} directories recursively and a symbolic link ++is encountered, the symbolic link is traversed and the pointed-to files are ++retrieved. Currently, Wget does not traverse symbolic links to directories to ++download them recursively, though this feature may be added in the future. + +-When @samp{--retr-symlinks} is specified, however, symbolic links are +-traversed and the pointed-to files are retrieved. At this time, this +-option does not cause Wget to traverse symlinks to directories and +-recurse through them, but in the future it should be enhanced to do +-this. ++When @samp{--retr-symlinks=no} is specified, the linked-to file is not ++downloaded. Instead, a matching symbolic link is created on the local ++filesystem. The pointed-to file will not be retrieved unless this recursive ++retrieval would have encountered it separately and downloaded it anyway. This ++option poses a security risk where a malicious FTP Server may cause Wget to ++write to files outside of the intended directories through a specially crafted ++@sc{.listing} file. + + Note that when retrieving a file (not a directory) because it was + specified on the command-line, rather than because it was recursed to, +Index: wget-1.13.4/src/ftp.c +=================================================================== +--- wget-1.13.4.orig/src/ftp.c 2014-10-30 10:08:31.314744203 -0400 ++++ wget-1.13.4/src/ftp.c 2014-10-30 10:08:31.310744077 -0400 +@@ -2012,6 +2012,29 @@ + return false; + } + ++/* Test if the file node is invalid. This can occur due to malformed or ++ * maliciously crafted listing files being returned by the server. ++ * ++ * Currently, this function only tests if there are multiple entries in the ++ * listing file by the same name. However this function can be expanded as more ++ * such illegal listing formats are discovered. */ ++static bool ++is_invalid_entry (struct fileinfo *f) ++{ ++ struct fileinfo *cur; ++ cur = f; ++ char *f_name = f->name; ++ /* If the node we're currently checking has a duplicate later, we eliminate ++ * the current node and leave the next one intact. */ ++ while (cur->next) ++ { ++ cur = cur->next; ++ if (strcmp(f_name, cur->name) == 0) ++ return true; ++ } ++ return false; ++} ++ + /* A near-top-level function to retrieve the files in a directory. + The function calls ftp_get_listing, to get a linked list of files. + Then it weeds out the file names that do not match the pattern. +@@ -2049,11 +2072,11 @@ + f = f->next; + } + } +- /* Remove all files with possible harmful names */ ++ /* Remove all files with possible harmful names or invalid entries. */ + f = start; + while (f) + { +- if (has_insecure_name_p (f->name)) ++ if (has_insecure_name_p (f->name) || is_invalid_entry (f)) + { + logprintf (LOG_VERBOSE, _("Rejecting %s.\n"), + quote (f->name)); +Index: wget-1.13.4/src/init.c +=================================================================== +--- wget-1.13.4.orig/src/init.c 2014-10-30 10:08:31.314744203 -0400 ++++ wget-1.13.4/src/init.c 2014-10-30 10:08:31.314744203 -0400 +@@ -332,6 +332,22 @@ + + opt.dns_cache = true; + opt.ftp_pasv = true; ++ /* 2014-09-07 Darshit Shah <[email protected]> ++ * opt.retr_symlinks is set to true by default. Creating symbolic links on the ++ * local filesystem pose a security threat by malicious FTP Servers that ++ * server a specially crafted .listing file akin to this: ++ * ++ * lrwxrwxrwx 1 root root 33 Dec 25 2012 JoCxl6d8rFU -> / ++ * drwxrwxr-x 15 1024 106 4096 Aug 28 02:02 JoCxl6d8rFU ++ * ++ * A .listing file in this fashion makes Wget susceptiple to a symlink attack ++ * wherein the attacker is able to create arbitrary files, directories and ++ * symbolic links on the target system and even set permissions. ++ * ++ * Hence, by default Wget attempts to retrieve the pointed-to files and does ++ * not create the symbolic links locally. ++ */ ++ opt.retr_symlinks = true; + + #ifdef HAVE_SSL + opt.check_cert = true; diff --git a/source/network/wget/FrugalBuild b/source/network/wget/FrugalBuild index 3c8dcb5..cd71570 100644 --- a/source/network/wget/FrugalBuild +++ b/source/network/wget/FrugalBuild @@ -4,7 +4,7 @@ pkgname=wget pkgver=1.13.4 -pkgrel=2 +pkgrel=3arcturus1 pkgdesc="A network utility to retrieve files from the Web" url="http://www.gnu.org/software/wget/wget.html"; depends=('openssl>=1.0.0' 'libidn') @@ -15,6 +15,12 @@ source=(ftp://ftp.gnu.org/pub/gnu/$pkgname/$pkgname-$pkgver.tar.gz gets.patch) Fconfopts="${Fconfopts[@]} --with-ssl=openssl" signatures=(${source[0]}.sig '') + +# FSA fix *** +source=(${source[@]} CVE-2014-4877.patch) +signatures=(${signatures[@]} '') +# *********** + build() { Fcd # Note : We do not build with --enable-nls, because there is a bug in wget causing _______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
