On 07/18/15 at 04:55pm, Levente Polyak wrote:
> While loading each package ensure that the internal version matches the
> expected database version to avoid the possibility to circumvent the
> version check.
> This issue can be used by an attacker to trick the software into
> installing an older version. The behavior can be exploited by a
> man-in-the-middle attack through specially crafted database tarball
> containing a higher version, yet actually delivering an older and
> vulnerable version, which was previously shipped.
>
> Signed-off-by: Levente Polyak <[email protected]>
> Signed-off-by: Remi Gacogne <[email protected]>
> ---
> lib/libalpm/sync.c | 16 ++++++++++++++++
> 1 file changed, 16 insertions(+)
>
> diff --git a/lib/libalpm/sync.c b/lib/libalpm/sync.c
> index 888ae15..8504e02 100644
> --- a/lib/libalpm/sync.c
> +++ b/lib/libalpm/sync.c
> @@ -1212,6 +1212,7 @@ static int load_packages(alpm_handle_t *handle,
> alpm_list_t **data,
> EVENT(handle, &event);
>
> for(i = handle->trans->add; i; i = i->next, current++) {
> + int error = 0;
> alpm_pkg_t *spkg = i->data;
> char *filepath;
> int percent = (int)(((double)current_bytes / total_bytes) *
> 100);
> @@ -1232,6 +1233,21 @@ static int load_packages(alpm_handle_t *handle,
> alpm_list_t **data,
> spkg->name);
> alpm_pkg_t *pkgfile =_alpm_pkg_load_internal(handle, filepath,
> 1);
> if(!pkgfile) {
> + _alpm_log(handle, ALPM_LOG_DEBUG, "failed to load
> pkgfile internal\n");
> + error = 1;
> + } else {
> + if(strcmp(spkg->name, pkgfile->name) != 0) {
> + _alpm_log(handle, ALPM_LOG_DEBUG, "internal
> package name missmatch, expected: '%s', actual: '%s'\n",
s/missmatch/mismatch/. Also, we try to stay close to 80 columns,
please wrap these long lines.
> + spkg->name, pkgfile->name);
> + error = 1;
> + }
> + if(alpm_pkg_vercmp(spkg->version, pkgfile->version) !=
> 0) {
I don't think there's any reason to support different version strings
even if they are equivalent, an ordinary strcmp should suffice.
> + _alpm_log(handle, ALPM_LOG_DEBUG, "internal
> package version mismatch, expected: '%s', actual: '%s'\n",
> + spkg->version,
> pkgfile->version);
Same as above.
> + error = 1;
> + }
> + }
> + if(error != 0) {
> errors++;
> *data = alpm_list_add(*data, strdup(spkg->filename));
> free(filepath);
> --
> 2.4.6
