Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-1.9.git;a=commitdiff;h=016ad97fb939e6420a4880f7154ffa8022e52887
commit 016ad97fb939e6420a4880f7154ffa8022e52887 Author: kikadf <[email protected]> Date: Wed Dec 10 10:42:56 2014 +0100 libksba-1.2.0-2arcturus1-x86_64 * Fix CVE-2014-9087 diff --git a/source/lib/libksba/CVE-2014-9087.patch b/source/lib/libksba/CVE-2014-9087.patch new file mode 100644 index 0000000..4adb1de --- /dev/null +++ b/source/lib/libksba/CVE-2014-9087.patch @@ -0,0 +1,232 @@ +From f715b9e156dfa99ae829fc694e5a0abd23ef97d7 Mon Sep 17 00:00:00 2001 +From: Werner Koch <[email protected]> +Date: Tue, 25 Nov 2014 11:47:28 +0100 +Subject: [PATCH] Fix buffer overflow in ksba_oid_to_str. +MIME-Version: 1.0 +Content-Type: text/plain; charset=utf8 +Content-Transfer-Encoding: 8bit + +* src/oid.c (ksba_oid_to_str): Fix unsigned underflow. + +* tests/Makefile.am (noinst_PROGRAMS): Move t-oid to .. +(TESTS): here. +* tests/t-oid.c (test_oid_to_str): New. +(main): Run the new tests by default. The former functionality +requires the use of one of the new options. +-- + +The code has an obvious error by not considering invalid encoding for +arc-2. A first byte of 0x80 can be used to make a value of less then +80 and we then subtract 80 from that value as required by the OID +encoding rules. Due to the unsigned integer this results in a pretty +long value which won't fit anymore into the allocated buffer. + +The fix is obvious. Also added a few simple test cases. Note that we +keep on using sprintf instead of snprintf because managing the +remaining length of the buffer would probably be more error prone than +assuring that the buffer is large enough. Getting rid of sprintf +altogether by using direct conversion along with membuf_t like code +might be possible. + +Reported-by: Hanno Böck +Signed-off-by: Werner Koch <[email protected]> +--- + src/oid.c | 2 ++ + tests/Makefile.am | 4 +-- + tests/t-dnparser.c | 2 +- + tests/t-oid.c | 97 ++++++++++++++++++++++++++++++++++++++++++++++++++-- + 4 files changed, 99 insertions(+), 6 deletions(-) + +Index: libksba-1.2.0/src/oid.c +=================================================================== +--- libksba-1.2.0.orig/src/oid.c 2014-11-27 12:58:22.130623535 -0500 ++++ libksba-1.2.0/src/oid.c 2014-11-27 12:58:22.126623504 -0500 +@@ -83,6 +83,8 @@ + val <<= 7; + val |= buf[n] & 0x7f; + } ++ if (val < 80) ++ goto badoid; + val -= 80; + sprintf (p, "2.%lu", val); + p += strlen (p); +Index: libksba-1.2.0/tests/Makefile.am +=================================================================== +--- libksba-1.2.0.orig/tests/Makefile.am 2014-11-27 12:58:22.130623535 -0500 ++++ libksba-1.2.0/tests/Makefile.am 2014-11-27 12:58:22.126623504 -0500 +@@ -39,12 +39,12 @@ + BUILT_SOURCES = oidtranstbl.h + CLEANFILES = oidtranstbl.h + +-TESTS = cert-basic t-crl-parser t-dnparser ++TESTS = cert-basic t-crl-parser t-dnparser t-oid + + AM_CFLAGS = $(GPG_ERROR_CFLAGS) + + noinst_HEADERS = t-common.h +-noinst_PROGRAMS = $(TESTS) t-cms-parser t-crl-parser t-dnparser t-ocsp t-oid ++noinst_PROGRAMS = $(TESTS) t-cms-parser t-crl-parser t-dnparser t-ocsp + LDADD = ../src/libksba.la $(GPG_ERROR_LIBS) + + t_ocsp_SOURCES = t-ocsp.c sha1.c +Index: libksba-1.2.0/tests/t-dnparser.c +=================================================================== +--- libksba-1.2.0.orig/tests/t-dnparser.c 2014-11-27 12:58:22.130623535 -0500 ++++ libksba-1.2.0/tests/t-dnparser.c 2014-11-27 12:58:22.126623504 -0500 +@@ -144,7 +144,7 @@ + if (!feof (stdin)) + fail ("read error or input too large"); + +- fail ("no yet implemented"); ++ fail ("not yet implemented"); + + } + else if (argc == 2 && !strcmp (argv[1], "--to-der") ) +Index: libksba-1.2.0/tests/t-oid.c +=================================================================== +--- libksba-1.2.0.orig/tests/t-oid.c 2014-11-27 12:58:22.130623535 -0500 ++++ libksba-1.2.0/tests/t-oid.c 2014-11-27 12:58:22.126623504 -0500 +@@ -27,6 +27,9 @@ + + #include "../src/ksba.h" + ++#define PGM "t-oid" ++#define BADOID "1.3.6.1.4.1.11591.2.12242973" ++ + + static void * + read_into_buffer (FILE *fp, size_t *r_length) +@@ -68,23 +71,104 @@ + } + + ++static void ++test_oid_to_str (void) ++{ ++ struct { ++ unsigned int binlen; ++ unsigned char *bin; ++ char *str; ++ } tests[] = { ++ ++ { 7, "\x02\x82\x06\x01\x0A\x0C\x00", ++ "0.2.262.1.10.12.0" ++ }, ++ { 7, "\x02\x82\x06\x01\x0A\x0C\x01", ++ "0.2.262.1.10.12.1" ++ }, ++ { 7, "\x2A\x86\x48\xCE\x38\x04\x01", ++ "1.2.840.10040.4.1" ++ }, ++ { 7, "\x2A\x86\x48\xCE\x38\x04\x03", ++ "1.2.840.10040.4.3" ++ }, ++ { 10, "\x2B\x06\x01\x04\x01\xDA\x47\x02\x01\x01", ++ "1.3.6.1.4.1.11591.2.1.1" ++ }, ++ { 3, "\x55\x1D\x0E", ++ "2.5.29.14" ++ }, ++ { 9, "\x80\x02\x70\x50\x25\x46\xfd\x0c\xc0", ++ BADOID ++ }, ++ { 1, "\x80", ++ BADOID ++ }, ++ { 2, "\x81\x00", ++ "2.48" ++ }, ++ { 2, "\x81\x01", ++ "2.49" ++ }, ++ { 2, "\x81\x7f", ++ "2.175" ++ }, ++ { 2, "\x81\x80", /* legal encoding? */ ++ "2.48" ++ }, ++ { 2, "\x81\x81\x01", /* legal encoding? */ ++ "2.49" ++ }, ++ { 0, "", ++ "" ++ }, ++ ++ { 0, NULL, NULL } ++ }; ++ int tidx; ++ char *str; ++ ++ for (tidx=0; tests[tidx].bin; tidx++) ++ { ++ str = ksba_oid_to_str (tests[tidx].bin, tests[tidx].binlen); ++ if (!str) ++ { ++ perror ("ksba_oid_to_str failed"); ++ exit (1); ++ } ++ if (strcmp (tests[tidx].str, str)) ++ { ++ fprintf (stderr, "ksba_oid_to_str test %d failed\n", tidx); ++ fprintf (stderr, " got=%s\n", str); ++ fprintf (stderr, " want=%s\n", tests[tidx].str); ++ exit (1); ++ } ++ } ++} ++ + + int + main (int argc, char **argv) + { + gpg_error_t err; ++ + if (argc) + { + argc--; + argv++; + } + +- if (argc) ++ ++ if (!argc) ++ { ++ test_oid_to_str (); ++ } ++ else if (!strcmp (*argv, "--from-str")) + { + unsigned char *buffer; + size_t n, buflen; + +- for ( ;argc ; argc--, argv++) ++ for (argv++,argc-- ; argc; argc--, argv++) + { + err = ksba_oid_from_str (*argv, &buffer, &buflen); + if (err) +@@ -100,18 +184,25 @@ + free (buffer); + } + } +- else ++ else if (!strcmp (*argv, "--to-str")) + { + char *buffer; + size_t buflen; + char *result; + ++ argv++;argc--; ++ + buffer = read_into_buffer (stdin, &buflen); + result = ksba_oid_to_str (buffer, buflen); + free (buffer); + printf ("%s\n", result? result:"[malloc failed]"); + free (result); + } ++ else ++ { ++ fputs ("usage: "PGM" [--from-str|--to-str]\n", stderr); ++ return 1; ++ } + + return 0; + } diff --git a/source/lib/libksba/FrugalBuild b/source/lib/libksba/FrugalBuild index 70261c2..c59326f 100644 --- a/source/lib/libksba/FrugalBuild +++ b/source/lib/libksba/FrugalBuild @@ -3,7 +3,7 @@ pkgname=libksba pkgver=1.2.0 -pkgrel=1 +pkgrel=2arcturus1 pkgdesc="Libksba is a CMS and X.509 access library." url="http://www.gnupg.org/related_software/libksba/"; makedepends=('libgpg-error>=1.8') @@ -16,4 +16,10 @@ up2date="Flasttar ftp://ftp.gnupg.org/GnuPG/libksba/"; source=(ftp://ftp.gnupg.org/gcrypt/$pkgname/$pkgname-$pkgver.tar.bz2) signatures=($source.sig) +# FSA fix *** +source=(${source[@]} CVE-2014-9087.patch) +sha1sums=(${sha1sums[@]} '44a4b6d03b5bf30dde8a2d4f06f31c6f7cc71718') +# *********** + + # optimization OK
_______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
