From mboxrd@z Thu Jan 1 00:00:00 1970 From: Leo Famulari Subject: [PATCH 1/1] gnu: libupnp: Fix CVE-2016-6255. Date: Thu, 6 Oct 2016 02:16:27 -0400 Message-ID: References: Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:50297) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bs1zL-0002G6-Oc for guix-devel@gnu.org; Thu, 06 Oct 2016 02:17:05 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bs1zH-0006Kw-DZ for guix-devel@gnu.org; Thu, 06 Oct 2016 02:17:03 -0400 Received: from out1-smtp.messagingengine.com ([66.111.4.25]:40298) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bs1zG-0006HG-3O for guix-devel@gnu.org; Thu, 06 Oct 2016 02:16:59 -0400 Received: from localhost.localdomain (c-73-188-17-148.hsd1.pa.comcast.net [73.188.17.148]) by mail.messagingengine.com (Postfix) with ESMTPA id 5CDA4F29D4 for ; Thu, 6 Oct 2016 02:16:49 -0400 (EDT) In-Reply-To: In-Reply-To: References: List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: guix-devel@gnu.org * gnu/packages/patches/libupnp-CVE-2016-6255.patch: New file. * gnu/local.mk (dist_patch_DATA): Add it. * gnu/packages/libupnp.scm (libupnp): Use it. --- gnu/local.mk | 1 + gnu/packages/libupnp.scm | 2 + gnu/packages/patches/libupnp-CVE-2016-6255.patch | 86 ++++++++++++++++++++++++ 3 files changed, 89 insertions(+) create mode 100644 gnu/packages/patches/libupnp-CVE-2016-6255.patch diff --git a/gnu/local.mk b/gnu/local.mk index 867946d..3352b19 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -656,6 +656,7 @@ dist_patch_DATA = \ %D%/packages/patches/libtiff-oob-write-in-nextdecode.patch \ %D%/packages/patches/libtool-skip-tests2.patch \ %D%/packages/patches/libunwind-CVE-2015-3239.patch \ + %D%/packages/patches/libupnp-CVE-2016-6255.patch \ %D%/packages/patches/libvpx-CVE-2016-2818.patch \ %D%/packages/patches/libwmf-CAN-2004-0941.patch \ %D%/packages/patches/libwmf-CVE-2006-3376.patch \ diff --git a/gnu/packages/libupnp.scm b/gnu/packages/libupnp.scm index 2f9a574..b9209bf 100644 --- a/gnu/packages/libupnp.scm +++ b/gnu/packages/libupnp.scm @@ -17,6 +17,7 @@ ;;; along with GNU Guix. If not, see . (define-module (gnu packages libupnp) + #:use-module (gnu packages) #:use-module (guix licenses) #:use-module (guix packages) #:use-module (guix download) @@ -31,6 +32,7 @@ (method url-fetch) (uri (string-append "mirror://sourceforge/pupnp/pupnp/libUPnP%20" version "/" name "-" version ".tar.bz2")) + (patches (search-patches "libupnp-CVE-2016-6255.patch")) (sha256 (base32 "0qrsdsb1qm85hc4jy04qph895613d148f0x1mmk6z99y3q43fdgf")))) diff --git a/gnu/packages/patches/libupnp-CVE-2016-6255.patch b/gnu/packages/patches/libupnp-CVE-2016-6255.patch new file mode 100644 index 0000000..27377b3 --- /dev/null +++ b/gnu/packages/patches/libupnp-CVE-2016-6255.patch @@ -0,0 +1,86 @@ +Fix CVE-2016-6255: + +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6255 +http://www.openwall.com/lists/oss-security/2016/07/18/13 + +Patch copied from upstream source repository: + +https://github.com/mrjimenez/pupnp/commit/d64d6a44906b5aa5306bdf1708531d698654dda5 + +From d64d6a44906b5aa5306bdf1708531d698654dda5 Mon Sep 17 00:00:00 2001 +From: Matthew Garrett +Date: Tue, 23 Feb 2016 13:53:20 -0800 +Subject: [PATCH] Don't allow unhandled POSTs to write to the filesystem by + default + +If there's no registered handler for a POST request, the default behaviour +is to write it to the filesystem. Several million deployed devices appear +to have this behaviour, making it possible to (at least) store arbitrary +data on them. Add a configure option that enables this behaviour, and change +the default to just drop POSTs that aren't directly handled. + +Signed-off-by: Marcelo Roberto Jimenez +(cherry picked from commit c91a8a3903367e1163765b73eb4d43be7d7927fa) +--- + configure.ac | 9 +++++++++ + upnp/inc/upnpconfig.h.in | 9 +++++++++ + upnp/src/genlib/net/http/webserver.c | 4 ++++ + 3 files changed, 22 insertions(+) + +diff --git a/configure.ac b/configure.ac +index 9548913..a8731b5 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -501,6 +501,15 @@ if test "x$enable_blocking_tcp_connections" = xyes ; then + AC_DEFINE(UPNP_ENABLE_BLOCKING_TCP_CONNECTIONS, 1, [see upnpconfig.h]) + fi + ++RT_BOOL_ARG_ENABLE([scriptsupport], [yes], [script support for IXML document tree, see ixml.h]) ++if test "x$enable_scriptsupport" = xyes ; then ++ AC_DEFINE(IXML_HAVE_SCRIPTSUPPORT, 1, [see upnpconfig.h]) ++fi ++ ++RT_BOOL_ARG_ENABLE([postwrite], [no], [write to the filesystem on otherwise unhandled POST requests]) ++if test "x$enable_postwrite" = xyes ; then ++ AC_DEFINE(UPNP_ENABLE_POST_WRITE, 1, [see upnpconfig.h]) ++fi + + RT_BOOL_ARG_ENABLE([samples], [yes], [compilation of upnp/sample/ code]) + +diff --git a/upnp/inc/upnpconfig.h.in b/upnp/inc/upnpconfig.h.in +index 7f4facc..5df8c5a 100644 +--- a/upnp/inc/upnpconfig.h.in ++++ b/upnp/inc/upnpconfig.h.in +@@ -131,5 +131,14 @@ + * header (i.e. configure --enable-unspecified_server) */ + #undef UPNP_ENABLE_UNSPECIFIED_SERVER + ++/** Defined to 1 if the library has been compiled with OpenSSL support ++ * (i.e. configure --enable-open_ssl) */ ++#undef UPNP_ENABLE_OPEN_SSL ++ ++/** Defined to 1 if the library has been compiled to support filesystem writes on POST ++ * (i.e. configure --enable-postwrite) */ ++#undef UPNP_ENABLE_POST_WRITE ++ ++ + #endif /* UPNP_CONFIG_H */ + +diff --git a/upnp/src/genlib/net/http/webserver.c b/upnp/src/genlib/net/http/webserver.c +index 26bf0f7..7ae8c1e 100644 +--- a/upnp/src/genlib/net/http/webserver.c ++++ b/upnp/src/genlib/net/http/webserver.c +@@ -1367,9 +1367,13 @@ static int http_RecvPostMessage( + if (Fp == NULL) + return HTTP_INTERNAL_SERVER_ERROR; + } else { ++#ifdef UPNP_ENABLE_POST_WRITE + Fp = fopen(filename, "wb"); + if (Fp == NULL) + return HTTP_UNAUTHORIZED; ++#else ++ return HTTP_NOT_FOUND; ++#endif + } + parser->position = POS_ENTITY; + do { -- 2.10.1