From mboxrd@z Thu Jan 1 00:00:00 1970 From: Leo Famulari Subject: [PATCH 0/1] Cracklib security CVE-2016-6318 Date: Tue, 16 Aug 2016 22:49:54 -0400 Message-ID: Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:45806) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bZqvr-0002V2-41 for guix-devel@gnu.org; Tue, 16 Aug 2016 22:50:20 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bZqvm-0008Kh-L5 for guix-devel@gnu.org; Tue, 16 Aug 2016 22:50:18 -0400 Received: from out2-smtp.messagingengine.com ([66.111.4.26]:53863) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bZqvk-0008GD-9K for guix-devel@gnu.org; Tue, 16 Aug 2016 22:50:14 -0400 Received: from localhost.localdomain (c-73-188-17-148.hsd1.pa.comcast.net [73.188.17.148]) by mail.messagingengine.com (Postfix) with ESMTPA id 3A48BF285F for ; Tue, 16 Aug 2016 22:49:59 -0400 (EDT) List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: guix-devel@gnu.org A stack overflow in Cracklib that could potentially lead to arbitrary code execution was just disclosed: http://seclists.org/oss-sec/2016/q3/290 "When an application compiled against the cracklib libary, such as "passwd" is used to parse the GECOS field, it could cause the application to crash or execute arbitary code with the permissions of the user running such an application." The message recommends this patch: https://bugzilla.redhat.com/show_bug.cgi?id=1364944#c2 For us, cracklib is used by libpwquality, which is used in turn by gnome-control-center. Passwd is safe: $ guix build --check shadow [...] shadow will be compiled with the following features: auditing support: no CrackLib support: no PAM support: yes suid account management tools: yes SELinux support: no ACL support: no Extended Attributes support: no tcb support (incomplete): no shadow group support: yes S/Key support: no SHA passwords encryption: yes nscd support: yes subordinate IDs support: yes Leo Famulari (1): gnu: cracklib: Fix CVE-2016-6318. gnu/local.mk | 1 + gnu/packages/password-utils.scm | 2 + gnu/packages/patches/cracklib-CVE-2016-6318.patch | 95 +++++++++++++++++++++++ 3 files changed, 98 insertions(+) create mode 100644 gnu/packages/patches/cracklib-CVE-2016-6318.patch -- 2.9.3