From 3a0ad5dc35d5cff379cdfc736b9cae856416fe6a Mon Sep 17 00:00:00 2001 From: root Date: Tue, 8 Oct 2013 02:34:09 -0700 Subject: Tue Oct 8 02:32:53 PDT 2013 --- extra/cyrus-sasl/CVE-2013-4122.patch | 116 +++++++++++++++++++++++++++++++++++ extra/cyrus-sasl/PKGBUILD | 45 ++++++++------ 2 files changed, 142 insertions(+), 19 deletions(-) create mode 100644 extra/cyrus-sasl/CVE-2013-4122.patch (limited to 'extra/cyrus-sasl') diff --git a/extra/cyrus-sasl/CVE-2013-4122.patch b/extra/cyrus-sasl/CVE-2013-4122.patch new file mode 100644 index 000000000..d6b9800e6 --- /dev/null +++ b/extra/cyrus-sasl/CVE-2013-4122.patch @@ -0,0 +1,116 @@ +From dedad73e5e7a75d01a5f3d5a6702ab8ccd2ff40d Mon Sep 17 00:00:00 2001 +From: mancha +Date: Thu, 11 Jul 2013 09:08:07 +0000 +Subject: Handle NULL returns from glibc 2.17+ crypt() + +Starting with glibc 2.17 (eglibc 2.17), crypt() fails with EINVAL +(w/ NULL return) if the salt violates specifications. Additionally, +on FIPS-140 enabled Linux systems, DES/MD5-encrypted passwords +passed to crypt() fail with EPERM (w/ NULL return). + +When using glibc's crypt(), check return value to avoid a possible +NULL pointer dereference. + +Patch by mancha1@hush.com. +--- +diff --git a/pwcheck/pwcheck_getpwnam.c b/pwcheck/pwcheck_getpwnam.c +index 4b34222..400289c 100644 +--- a/pwcheck/pwcheck_getpwnam.c ++++ b/pwcheck/pwcheck_getpwnam.c +@@ -32,6 +32,7 @@ char *userid; + char *password; + { + char* r; ++ char* crpt_passwd; + struct passwd *pwd; + + pwd = getpwnam(userid); +@@ -41,7 +42,7 @@ char *password; + else if (pwd->pw_passwd[0] == '*') { + r = "Account disabled"; + } +- else if (strcmp(pwd->pw_passwd, crypt(password, pwd->pw_passwd)) != 0) { ++ else if (!(crpt_passwd = crypt(password, pwd->pw_passwd)) || strcmp(pwd->pw_passwd, (const char *)crpt_passwd) != 0) { + r = "Incorrect password"; + } + else { +diff --git a/pwcheck/pwcheck_getspnam.c b/pwcheck/pwcheck_getspnam.c +index 2b11286..6d607bb 100644 +--- a/pwcheck/pwcheck_getspnam.c ++++ b/pwcheck/pwcheck_getspnam.c +@@ -32,13 +32,15 @@ char *userid; + char *password; + { + struct spwd *pwd; ++ char *crpt_passwd; + + pwd = getspnam(userid); + if (!pwd) { + return "Userid not found"; + } + +- if (strcmp(pwd->sp_pwdp, crypt(password, pwd->sp_pwdp)) != 0) { ++ crpt_passwd = crypt(password, pwd->sp_pwdp); ++ if (!crpt_passwd || strcmp(pwd->sp_pwdp, (const char *)crpt_passwd) != 0) { + return "Incorrect password"; + } + else { +diff --git a/saslauthd/auth_getpwent.c b/saslauthd/auth_getpwent.c +index fc8029d..d4ebe54 100644 +--- a/saslauthd/auth_getpwent.c ++++ b/saslauthd/auth_getpwent.c +@@ -77,6 +77,7 @@ auth_getpwent ( + { + /* VARIABLES */ + struct passwd *pw; /* pointer to passwd file entry */ ++ char *crpt_passwd; /* encrypted password */ + int errnum; + /* END VARIABLES */ + +@@ -105,7 +106,8 @@ auth_getpwent ( + } + } + +- if (strcmp(pw->pw_passwd, (const char *)crypt(password, pw->pw_passwd))) { ++ crpt_passwd = crypt(password, pw->pw_passwd); ++ if (!crpt_passwd || strcmp(pw->pw_passwd, (const char *)crpt_passwd)) { + if (flags & VERBOSE) { + syslog(LOG_DEBUG, "DEBUG: auth_getpwent: %s: invalid password", login); + } +diff --git a/saslauthd/auth_shadow.c b/saslauthd/auth_shadow.c +index 677131b..1988afd 100644 +--- a/saslauthd/auth_shadow.c ++++ b/saslauthd/auth_shadow.c +@@ -210,8 +210,8 @@ auth_shadow ( + RETURN("NO Insufficient permission to access NIS authentication database (saslauthd)"); + } + +- cpw = strdup((const char *)crypt(password, sp->sp_pwdp)); +- if (strcmp(sp->sp_pwdp, cpw)) { ++ cpw = crypt(password, sp->sp_pwdp); ++ if (!cpw || strcmp(sp->sp_pwdp, (const char *)cpw)) { + if (flags & VERBOSE) { + /* + * This _should_ reveal the SHADOW_PW_LOCKED prefix to an +@@ -221,10 +221,8 @@ auth_shadow ( + syslog(LOG_DEBUG, "DEBUG: auth_shadow: pw mismatch: '%s' != '%s'", + sp->sp_pwdp, cpw); + } +- free(cpw); + RETURN("NO Incorrect password"); + } +- free(cpw); + + /* + * The following fields will be set to -1 if: +@@ -286,7 +284,7 @@ auth_shadow ( + RETURN("NO Invalid username"); + } + +- if (strcmp(upw->upw_passwd, crypt(password, upw->upw_passwd)) != 0) { ++ if (!(cpw = crypt(password, upw->upw_passwd)) || (strcmp(upw->upw_passwd, (const char *)cpw) != 0)) { + if (flags & VERBOSE) { + syslog(LOG_DEBUG, "auth_shadow: pw mismatch: %s != %s", + password, upw->upw_passwd); +-- +cgit v0.9.2 diff --git a/extra/cyrus-sasl/PKGBUILD b/extra/cyrus-sasl/PKGBUILD index 49976813d..c00711749 100644 --- a/extra/cyrus-sasl/PKGBUILD +++ b/extra/cyrus-sasl/PKGBUILD @@ -1,4 +1,4 @@ -# $Id: PKGBUILD 187053 2013-06-03 11:16:18Z allan $ +# $Id: PKGBUILD 195995 2013-10-07 10:32:45Z jgc $ # Maintainer: Jan de Groot # This package spans multiple repositories. @@ -8,7 +8,7 @@ pkgbase=('cyrus-sasl') pkgname=('cyrus-sasl' 'cyrus-sasl-gssapi' 'cyrus-sasl-ldap' 'cyrus-sasl-sql') #pkgname=libsasl pkgver=2.1.26 -pkgrel=4 +pkgrel=6 pkgdesc="Cyrus Simple Authentication Service Layer (SASL) library" arch=('i686' 'x86_64') url="http://cyrusimap.web.cmu.edu/" @@ -25,7 +25,8 @@ source=(ftp://ftp.cyrusimap.org/cyrus-sasl/cyrus-sasl-${pkgver}.tar.gz 0030-dont_use_la_files_for_opening_plugins.patch saslauthd.service saslauthd.conf.d - tmpfiles.conf) + tmpfiles.conf + CVE-2013-4122.patch) md5sums=('a7f4e5e559a0e37b3ffc438c9456e425' '79b8a5e8689989e2afd4b7bda595a7b1' 'f45aa8c42b32e0569ab3d14a83485b37' @@ -36,21 +37,27 @@ md5sums=('a7f4e5e559a0e37b3ffc438c9456e425' '8e7106f32e495e9ade69014fd1b3352a' '3499dcd610ad1ad58e0faffde2aa7a23' '49219af5641150edec288a3fdb65e7c1' - '45bb0192d2f188066240b9a66ee6365f') + '45bb0192d2f188066240b9a66ee6365f' + 'c5f0ec88c584a75c14d7f402eaeed7ef') + +prepare() { + cd cyrus-sasl-$pkgver + patch -Np1 -i ../cyrus-sasl-2.1.22-qa.patch + patch -Np1 -i ../cyrus-sasl-2.1.26-size_t.patch + patch -Np1 -i ../0010_maintainer_mode.patch + patch -Np1 -i ../0011_saslauthd_ac_prog_libtool.patch + patch -Np1 -i ../0025_ld_as_needed.patch + patch -Np1 -i ../0026_drop_krb5support_dependency.patch + patch -Np1 -i ../0030-dont_use_la_files_for_opening_plugins.patch + patch -Np1 -i ../CVE-2013-4122.patch + + sed 's/AM_CONFIG_HEADER/AC_CONFIG_HEADERS/' -i configure.in +} build() { export CFLAGS="$CFLAGS -fPIC" + cd cyrus-sasl-$pkgver - cd "${srcdir}/cyrus-sasl-${pkgver}" - patch -Np1 -i "${srcdir}/cyrus-sasl-2.1.22-qa.patch" - patch -Np1 -i "${srcdir}/cyrus-sasl-2.1.26-size_t.patch" - patch -Np1 -i "${srcdir}/0010_maintainer_mode.patch" - patch -Np1 -i "${srcdir}/0011_saslauthd_ac_prog_libtool.patch" - patch -Np1 -i "${srcdir}/0025_ld_as_needed.patch" - patch -Np1 -i "${srcdir}/0026_drop_krb5support_dependency.patch" - patch -Np1 -i "${srcdir}/0030-dont_use_la_files_for_opening_plugins.patch" - - sed 's/AM_CONFIG_HEADER/AC_CONFIG_HEADERS/' -i configure.in rm -f config/config.guess config/config.sub rm -f config/ltconfig config/ltmain.sh config/libtool.m4 rm -fr autom4te.cache @@ -109,7 +116,7 @@ package_libsasl() { depends=('openssl') conflicts=('cyrus-sasl-plugins') - cd "${srcdir}/cyrus-sasl-${pkgver}" + cd cyrus-sasl-$pkgver for dir in include lib sasldb plugins utils; do pushd ${dir} make DESTDIR="${pkgdir}" install @@ -128,7 +135,7 @@ package_cyrus-sasl() { pkgdesc="Cyrus saslauthd SASL authentication daemon" backup=('etc/conf.d/saslauthd') - cd "${srcdir}/cyrus-sasl-${pkgver}/saslauthd" + cd cyrus-sasl-$pkgver/saslauthd make DESTDIR="${pkgdir}" install install -Dm644 "${srcdir}/saslauthd.conf.d" "${pkgdir}/etc/conf.d/saslauthd" install -Dm644 "${srcdir}/saslauthd.service" "${pkgdir}/usr/lib/systemd/system/saslauthd.service" @@ -143,7 +150,7 @@ package_cyrus-sasl-gssapi() { depends=("libsasl=${pkgver}" 'krb5') replaces=('cyrus-sasl-plugins') - cd "${srcdir}/cyrus-sasl-${pkgver}/plugins" + cd cyrus-sasl-$pkgver/plugins install -m755 -d "${pkgdir}/usr/lib/sasl2" cp -a .libs/libgssapiv2.so* "${pkgdir}/usr/lib/sasl2/" cp -a .libs/libgs2.so* "${pkgdir}/usr/lib/sasl2/" @@ -157,7 +164,7 @@ package_cyrus-sasl-ldap() { depends=("libsasl=${pkgver}" 'libldap') replaces=('cyrus-sasl-plugins') - cd "${srcdir}/cyrus-sasl-${pkgver}/plugins" + cd cyrus-sasl-$pkgver/plugins install -m755 -d "${pkgdir}/usr/lib/sasl2" cp -a .libs/libldapdb.so* "${pkgdir}/usr/lib/sasl2/" @@ -170,7 +177,7 @@ package_cyrus-sasl-sql() { depends=("libsasl=${pkgver}" 'postgresql-libs' 'libmariadbclient' 'sqlite2') replaces=('cyrus-sasl-plugins') - cd "${srcdir}/cyrus-sasl-${pkgver}/plugins" + cd cyrus-sasl-$pkgver/plugins install -m755 -d "${pkgdir}/usr/lib/sasl2" cp -a .libs/libsql.so* "${pkgdir}/usr/lib/sasl2/" -- cgit v1.2.3-54-g00ecf