Bug#408612: Patch for NMU

[Neil McGovern]

Package: geoip
Severity: normal
Tags: patch

Please find attached patch for 1.3.17-1.1 nmu

Regards,
Neil

diff -u geoip-1.3.17/debian/changelog geoip-1.3.17/debian/changelog
--- geoip-1.3.17/debian/changelog
+++ geoip-1.3.17/debian/changelog
@@ -1,3 +1,14 @@
+geoip (1.3.17-1.1) unstable; urgency=high
+
+  * Non-maintainer upload by security team.
+  * Added patch for CVE-2007-0159: libgeoip1:
+    "GeoIP_update_database_general()" Remote Directory Traversal Vulnerability
+    (Closes: #406628)
+  * Removed automatically copying of config.status and config.sub - this
+    creates a bloated diff for security updates.
+
+ -- Neil McGovern <[EMAIL PROTECTED]>  Sat, 27 Jan 2007 10:23:23 +0000
+
 geoip (1.3.17-1) unstable; urgency=low
 
   * The latest upstream version
diff -u geoip-1.3.17/debian/rules geoip-1.3.17/debian/rules
--- geoip-1.3.17/debian/rules
+++ geoip-1.3.17/debian/rules
@@ -61,10 +61,10 @@
 
        # Add here commands to clean up after the build process.
        -$(MAKE) distclean
-       -test -r /usr/share/misc/config.sub && \
-         cp -f /usr/share/misc/config.sub config.sub
-       -test -r /usr/share/misc/config.guess && \
-         cp -f /usr/share/misc/config.guess config.guess
+#      -test -r /usr/share/misc/config.sub && \
+#        cp -f /usr/share/misc/config.sub config.sub
+#      -test -r /usr/share/misc/config.guess && \
+#        cp -f /usr/share/misc/config.guess config.guess
 
 
        dh_clean
only in patch2:
unchanged:
--- geoip-1.3.17.orig/libGeoIP/GeoIPUpdate.c
+++ geoip-1.3.17/libGeoIP/GeoIPUpdate.c
@@ -90,6 +90,8 @@
     return "Invalid userID";
   case GEOIP_PRODUCT_ID_INVALID_ERR:
     return "Invalid product ID or subscription expired";
+  case GEOIP_INVALID_SERVER_RESPONSE:
+    return "Server returned something unexpected";
   default:
     return "no error";
   }  
@@ -418,6 +420,10 @@
        buf[offset] = 0;
        offset = 0;
        tmpstr = strstr(buf, "\r\n\r\n") + 4;
+       if (tmpstr[0] == '.' || strchr(tmpstr, '/') != NULL) {
+               free(buf);
+               return GEOIP_INVALID_SERVER_RESPONSE;
+       }
        geoipfilename = _GeoIP_full_path_to(tmpstr);
        free(buf);
 
only in patch2:
unchanged:
--- geoip-1.3.17.orig/libGeoIP/GeoIPUpdate.h
+++ geoip-1.3.17/libGeoIP/GeoIPUpdate.h
@@ -43,7 +43,8 @@
        GEOIP_SANITY_LOOKUP_FAIL      = -22, /* Sanity check ip address lookup 
failed */
        GEOIP_RENAME_ERR              = -23, /* Rename error while installing 
db, check errno */
        GEOIP_USER_ID_INVALID_ERR     = -24, /* Invalid userID */
-       GEOIP_PRODUCT_ID_INVALID_ERR  = -25  /* Invalid product ID or 
subscription expired */
+       GEOIP_PRODUCT_ID_INVALID_ERR  = -25, /* Invalid product ID or 
subscription expired */
+       GEOIP_INVALID_SERVER_RESPONSE = -26
 } GeoIPUpdateCode;
 
 const char * GeoIP_get_error_message(int i);