From mboxrd@z Thu Jan 1 00:00:00 1970 From: Efraim Flashner Subject: Re: cracklib: Fix buffer overflow Date: Tue, 20 Sep 2016 12:32:02 +0300 Message-ID: <20160920093201.GB17906@macbook42.flashner.co.il> References: <20160915153646.GA31020@jasmine> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="5/uDoXvLw7AC5HRs" Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:52272) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bmHPS-0006eO-SR for guix-devel@gnu.org; Tue, 20 Sep 2016 05:32:16 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bmHPP-0008SS-CA for guix-devel@gnu.org; Tue, 20 Sep 2016 05:32:14 -0400 Received: from flashner.co.il ([178.62.234.194]:51971) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bmHPP-0008K3-0N for guix-devel@gnu.org; Tue, 20 Sep 2016 05:32:11 -0400 Content-Disposition: inline In-Reply-To: <20160915153646.GA31020@jasmine> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Leo Famulari Cc: guix-devel@gnu.org --5/uDoXvLw7AC5HRs Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Thu, Sep 15, 2016 at 11:36:46AM -0400, Leo Famulari wrote: > This patch cherry-picks an upstream commit to fix a buffer overflow in > cracklib. Please see the patch file for more information about the bug. > From 62f8f1763ba1766e92e8dc05686bd9353eaf2ad5 Mon Sep 17 00:00:00 2001 > From: Leo Famulari > Date: Thu, 15 Sep 2016 11:34:49 -0400 > Subject: [PATCH] gnu: cracklib: Fix buffer overflow. >=20 > * gnu/packages/patches/cracklib-fix-buffer-overflow.patch: New file. > * gnu/local.mk (dist_patch_DATA): Add it. > * gnu/packages/password-utils.scm (cracklib)[source]: Use it. > --- > gnu/local.mk | 1 + > gnu/packages/password-utils.scm | 3 +- > .../patches/cracklib-fix-buffer-overflow.patch | 39 ++++++++++++++++= ++++++ > 3 files changed, 42 insertions(+), 1 deletion(-) > create mode 100644 gnu/packages/patches/cracklib-fix-buffer-overflow.pat= ch >=20 > diff --git a/gnu/local.mk b/gnu/local.mk > index a7006cb..ab052af 100644 > --- a/gnu/local.mk > +++ b/gnu/local.mk > @@ -473,6 +473,7 @@ dist_patch_DATA =3D \ > %D%/packages/patches/cpio-CVE-2016-2037.patch \ > %D%/packages/patches/cpufrequtils-fix-aclocal.patch \ > %D%/packages/patches/cracklib-CVE-2016-6318.patch \ > + %D%/packages/patches/cracklib-fix-buffer-overflow.patch \ > %D%/packages/patches/crda-optional-gcrypt.patch \ > %D%/packages/patches/crossmap-allow-system-pysam.patch \ > %D%/packages/patches/csound-header-ordering.patch \ > diff --git a/gnu/packages/password-utils.scm b/gnu/packages/password-util= s.scm > index 7288da6..40ed933 100644 > --- a/gnu/packages/password-utils.scm > +++ b/gnu/packages/password-utils.scm > @@ -160,7 +160,8 @@ and vice versa.") > (uri (string-append "https://github.com/cracklib/cracklib/" > "releases/download/" name "-" version = "/" > name "-" version ".tar.gz")) > - (patches (search-patches "cracklib-CVE-2016-6318.patch")) > + (patches (search-patches "cracklib-CVE-2016-6318.patch" > + "cracklib-fix-buffer-overflow.pat= ch")) > (sha256 > (base32 > "0hrkb0prf7n92w6rxgq0ilzkk6rkhpys2cfqkrbzswp27na7dkqp"))= )) > diff --git a/gnu/packages/patches/cracklib-fix-buffer-overflow.patch b/gn= u/packages/patches/cracklib-fix-buffer-overflow.patch > new file mode 100644 > index 0000000..b1c990f > --- /dev/null > +++ b/gnu/packages/patches/cracklib-fix-buffer-overflow.patch > @@ -0,0 +1,39 @@ > +Fix buffer overflow processing long words in Mangle(). > + > +Patch adpated from upstream commit, omitting changes to 'NEWS': > + > +https://github.com/cracklib/cracklib/commit/33d7fa4585247cd2247a1ffa032a= d245836c6edb > + > +From 33d7fa4585247cd2247a1ffa032ad245836c6edb Mon Sep 17 00:00:00 2001 > +From: Jan Dittberner > +Date: Thu, 25 Aug 2016 17:17:53 +0200 > +Subject: [PATCH] Fix a buffer overflow processing long words > + > +A buffer overflow processing long words has been discovered. This commit > +applies the patch from > +https://build.opensuse.org/package/view_file/Base:System/cracklib/0004-o= verflow-processing-long-words.patch > +by Howard Guo. > + > +See https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=3D835386 and > +http://www.openwall.com/lists/oss-security/2016/08/23/8 > +--- > + src/NEWS | 1 + > + src/lib/rules.c | 5 ++--- > + 2 files changed, 3 insertions(+), 3 deletions(-) > + > +diff --git a/src/lib/rules.c b/src/lib/rules.c > +index d193cc0..3a2aa46 100644 > +--- a/lib/rules.c > ++++ b/lib/rules.c > +@@ -434,9 +434,8 @@ Mangle(input, control) /* returns a pointer to a co= ntrolled Mangle */ > + { > + int limit; > + register char *ptr; > +- static char area[STRINGSIZE]; > +- char area2[STRINGSIZE]; > +- area[0] =3D '\0'; > ++ static char area[STRINGSIZE * 2] =3D {0}; > ++ char area2[STRINGSIZE * 2] =3D {0}; > + strcpy(area, input); > +=20 > + for (ptr =3D control; *ptr; ptr++) > --=20 > 2.10.0 >=20 not having looked at the full source of lib/rules.c, is there a maximum value to STRINGSIZE to make sure STRINGSIZE * 2 doesn't wrap around? --=20 Efraim Flashner =D7=90=D7=A4=D7=A8=D7=99=D7=9D = =D7=A4=D7=9C=D7=A9=D7=A0=D7=A8 GPG key =3D A28B F40C 3E55 1372 662D 14F7 41AA E7DC CA3D 8351 Confidentiality cannot be guaranteed on emails sent or received unencrypted --5/uDoXvLw7AC5HRs Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCgAGBQJX4QIKAAoJEPTB05F+rO6T9B4P/25Sqxst4lep5cVYX6IWcWUB t2BhmZee7kqQ4mwTVz2MBlcVUcwJmPK/EVCsLMQ+fDbxYMYhj5+c2whbmC8m0UeJ rQmxrjYaZGSMp4UmYdYTNP2/81DhYXogDhXs0N0RoGvQ/th3ZoHVwflmRb9YiVvj C7mdUesAIWet5M1x31o9S0XpgHNp7Eqm7GWNevzgfv0d4OudazvgUKjIutwhZ/Lo zqofP1LPWo8EQZL7plUE/ofiHazeQ0QMx1enNjFsXTAwDLLKW65dbr0ByMioG7g3 y5O7G1FdBNI+rQ20bwnXRu3mVi+KhUUossak6dEvDF05tCC0ViKssSD1XXlvQ2dp 7S+usO0wwWJRMaLlSx60IM2gBhnMkcsTPS8DavQflEOAP4/rh8OVS9+A0vRM9jaG Id/Qv6NVFzm9OtbwZhV3NYb1dZegF9KeUMnpPWqPlScJtgzd2ErOVJueFu3undtl LymYWemaZDgjqqYCe9Ipt2BPpEiY9laSo7PFBto973gROoIaKPu87WdTYeEZha9O hkFyTxhMXXV+flb6HkKQwe+y8VDf/1QAygNeLprGAbrK6wT0HZsRDRTyaBTeNT6N sLikSbhcEjn9voay2w27hZV5I0Kk9zaSwl4x3ipoHaTJPz1Vwf2v//RFIbqHNkuw qJLUwZj6jF5M3bPs7h3z =/RG8 -----END PGP SIGNATURE----- --5/uDoXvLw7AC5HRs--