Skip to Content.
Sympa Menu

sm-commit - [SM-Commit] GIT changes to stable-0.4 grimoire by Jaka Kranjc (2cdb0859e343a3ff9e6b206476ce7b82f9b3a7c1)

sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

Chronological Thread  
  • From: Jaka Kranjc <scm AT mail.sourcemage.org>
  • To: sm-commit AT lists.ibiblio.org
  • Subject: [SM-Commit] GIT changes to stable-0.4 grimoire by Jaka Kranjc (2cdb0859e343a3ff9e6b206476ce7b82f9b3a7c1)
  • Date: Mon, 1 Jan 2007 15:27:16 -0600

GIT changes to stable-0.4 grimoire by Jaka Kranjc
<lynxlynxlynx AT sourcemage.org>:

crypto/krb5/2006-001-patch_1.5.txt | 268
+++++++++++++++++++++++++++++++++++++
crypto/krb5/BUILD | 3
crypto/krb5/DETAILS | 1
crypto/krb5/HISTORY | 4
4 files changed, 276 insertions(+)

New commits:
commit 2cdb0859e343a3ff9e6b206476ce7b82f9b3a7c1
Author: Jaka Kranjc <lynxlynxlynx AT sourcemage.org>
Commit: Jaka Kranjc <lynxlynxlynx AT sourcemage.org>

krb5: added security patch [Bug 13019]

Conflicts:

crypto/krb5/DETAILS
crypto/krb5/HISTORY

diff --git a/crypto/krb5/2006-001-patch_1.5.txt
b/crypto/krb5/2006-001-patch_1.5.txt
new file mode 100644
index 0000000..cc47dec
--- /dev/null
+++ b/crypto/krb5/2006-001-patch_1.5.txt
@@ -0,0 +1,268 @@
+Index: appl/gssftp/ftpd/ftpd.c
+===================================================================
+*** appl/gssftp/ftpd/ftpd.c (revision 18440)
+--- appl/gssftp/ftpd/ftpd.c (working copy)
+***************
+*** 1367,1373 ****
+ goto bad;
+ sleep(tries);
+ }
+! (void) krb5_seteuid((uid_t)pw->pw_uid);
+ #ifdef IP_TOS
+ #ifdef IPTOS_THROUGHPUT
+ on = IPTOS_THROUGHPUT;
+--- 1367,1375 ----
+ goto bad;
+ sleep(tries);
+ }
+! if (krb5_seteuid((uid_t)pw->pw_uid)) {
+! fatal("seteuid user");
+! }
+ #ifdef IP_TOS
+ #ifdef IPTOS_THROUGHPUT
+ on = IPTOS_THROUGHPUT;
+***************
+*** 1377,1383 ****
+ #endif
+ return (fdopen(s, fmode));
+ bad:
+! (void) krb5_seteuid((uid_t)pw->pw_uid);
+ (void) close(s);
+ return (NULL);
+ }
+--- 1379,1387 ----
+ #endif
+ return (fdopen(s, fmode));
+ bad:
+! if (krb5_seteuid((uid_t)pw->pw_uid)) {
+! fatal("seteuid user");
+! }
+ (void) close(s);
+ return (NULL);
+ }
+***************
+*** 2186,2192 ****
+ (void) krb5_seteuid((uid_t)pw->pw_uid);
+ goto pasv_error;
+ }
+! (void) krb5_seteuid((uid_t)pw->pw_uid);
+ len = sizeof(pasv_addr);
+ if (getsockname(pdata, (struct sockaddr *) &pasv_addr, &len) < 0)
+ goto pasv_error;
+--- 2190,2198 ----
+ (void) krb5_seteuid((uid_t)pw->pw_uid);
+ goto pasv_error;
+ }
+! if (krb5_seteuid((uid_t)pw->pw_uid)) {
+! fatal("seteuid user");
+! }
+ len = sizeof(pasv_addr);
+ if (getsockname(pdata, (struct sockaddr *) &pasv_addr, &len) < 0)
+ goto pasv_error;
+Index: appl/bsd/v4rcp.c
+===================================================================
+*** appl/bsd/v4rcp.c (revision 18440)
+--- appl/bsd/v4rcp.c (working copy)
+***************
+*** 436,442 ****
+ kstream_set_buffer_mode (krem, 0);
+ #endif /* KERBEROS && !NOENCRYPTION */
+ (void) response();
+! (void) setuid(userid);
+ source(--argc, ++argv);
+ exit(errs);
+
+--- 436,445 ----
+ kstream_set_buffer_mode (krem, 0);
+ #endif /* KERBEROS && !NOENCRYPTION */
+ (void) response();
+! if (setuid(userid)) {
+! error("rcp: can't setuid(user)\n");
+! exit(1);
+! }
+ source(--argc, ++argv);
+ exit(errs);
+
+***************
+*** 452,458 ****
+ krem = kstream_create_from_fd (rem, 0, 0);
+ kstream_set_buffer_mode (krem, 0);
+ #endif /* KERBEROS && !NOENCRYPTION */
+! (void) setuid(userid);
+ sink(--argc, ++argv);
+ exit(errs);
+
+--- 455,464 ----
+ krem = kstream_create_from_fd (rem, 0, 0);
+ kstream_set_buffer_mode (krem, 0);
+ #endif /* KERBEROS && !NOENCRYPTION */
+! if (setuid(userid)) {
+! error("rcp: can't setuid(user)\n");
+! exit(1);
+! }
+ sink(--argc, ++argv);
+ exit(errs);
+
+Index: appl/bsd/krcp.c
+===================================================================
+*** appl/bsd/krcp.c (revision 18440)
+--- appl/bsd/krcp.c (working copy)
+***************
+*** 620,626 ****
+
+ euid = geteuid();
+ if (euid == 0) {
+! (void) setuid(0);
+ if(krb5_seteuid(userid)) {
+ perror("rcp seteuid user"); errs++; exit(errs);
+ }
+--- 620,628 ----
+
+ euid = geteuid();
+ if (euid == 0) {
+! if (setuid(0)) {
+! perror("rcp setuid 0"); errs++; exit(errs);
+! }
+ if(krb5_seteuid(userid)) {
+ perror("rcp seteuid user"); errs++; exit(errs);
+ }
+***************
+*** 638,648 ****
+ continue;
+ rcmd_stream_init_normal();
+ #ifdef HAVE_SETREUID
+! (void) setreuid(0, userid);
+ sink(1, argv+argc-1);
+! (void) setreuid(userid, 0);
+ #else
+! (void) setuid(0);
+ if(seteuid(userid)) {
+ perror("rcp seteuid user"); errs++; exit(errs);
+ }
+--- 640,656 ----
+ continue;
+ rcmd_stream_init_normal();
+ #ifdef HAVE_SETREUID
+! if (setreuid(0, userid)) {
+! perror("rcp setreuid 0,user"); errs++; exit(errs);
+! }
+ sink(1, argv+argc-1);
+! if (setreuid(userid, 0)) {
+! perror("rcp setreuid user,0"); errs++; exit(errs);
+! }
+ #else
+! if (setuid(0)) {
+! perror("rcp setuid 0"); errs++; exit(errs);
+! }
+ if(seteuid(userid)) {
+ perror("rcp seteuid user"); errs++; exit(errs);
+ }
+Index: appl/bsd/login.c
+===================================================================
+*** appl/bsd/login.c (revision 18440)
+--- appl/bsd/login.c (working copy)
+***************
+*** 1648,1654 ****
+ }
+ #endif /* HAVE_SETLUID */
+ #ifdef _IBMR2
+! setuidx(ID_LOGIN, pwd->pw_uid);
+ #endif
+
+ /* This call MUST succeed */
+--- 1648,1657 ----
+ }
+ #endif /* HAVE_SETLUID */
+ #ifdef _IBMR2
+! if (setuidx(ID_LOGIN, pwd->pw_uid) < 0) {
+! perror("setuidx");
+! sleepexit(1);
+! };
+ #endif
+
+ /* This call MUST succeed */
+Index: appl/bsd/krshd.c
+===================================================================
+*** appl/bsd/krshd.c (revision 18440)
+--- appl/bsd/krshd.c (working copy)
+***************
+*** 1403,1411 ****
+ * If we're on a system which keeps track of login uids, then
+ * set the login uid.
+ */
+! setluid((uid_t) pwd->pw_uid);
+ #endif /* HAVE_SETLUID */
+! (void) setuid((uid_t)pwd->pw_uid);
+ /* if TZ is set in the parent, drag it in */
+ {
+ char **findtz = environ;
+--- 1403,1417 ----
+ * If we're on a system which keeps track of login uids, then
+ * set the login uid.
+ */
+! if (setluid((uid_t) pwd->pw_uid) < 0) {
+! perror("setluid");
+! _exit(1);
+! }
+ #endif /* HAVE_SETLUID */
+! if (setuid((uid_t)pwd->pw_uid) < 0) {
+! perror("setuid");
+! _exit(1);
+! }
+ /* if TZ is set in the parent, drag it in */
+ {
+ char **findtz = environ;
+Index: clients/ksu/main.c
+===================================================================
+*** clients/ksu/main.c (revision 18440)
+--- clients/ksu/main.c (working copy)
+***************
+*** 893,900 ****
+ struct stat st_temp;
+
+ krb5_seteuid(0);
+! krb5_seteuid(target_uid);
+!
+ cc_name = krb5_cc_get_name(context, cc);
+ if ( ! stat(cc_name, &st_temp)){
+ if ((retval = krb5_cc_destroy(context, cc))){
+--- 893,904 ----
+ struct stat st_temp;
+
+ krb5_seteuid(0);
+! if (krb5_seteuid(target_uid) < 0) {
+! com_err(prog_name, errno,
+! "while changing to target uid for destroying ccache");
+! exit(1);
+! }
+!
+ cc_name = krb5_cc_get_name(context, cc);
+ if ( ! stat(cc_name, &st_temp)){
+ if ((retval = krb5_cc_destroy(context, cc))){
+Index: lib/krb4/kuserok.c
+===================================================================
+*** lib/krb4/kuserok.c (revision 18440)
+--- lib/krb4/kuserok.c (working copy)
+***************
+*** 159,167 ****
+ */
+ if(getuid() == 0) {
+ uid_t old_euid = geteuid();
+! seteuid(pwd->pw_uid);
+ fp = fopen(pbuf, "r");
+! seteuid(old_euid);
+ if ((fp) == NULL) {
+ return(NOTOK);
+ }
+--- 159,169 ----
+ */
+ if(getuid() == 0) {
+ uid_t old_euid = geteuid();
+! if (seteuid(pwd->pw_uid) < 0)
+! return NOTOK;
+ fp = fopen(pbuf, "r");
+! if (seteuid(old_euid) < 0)
+! return NOTOK;
+ if ((fp) == NULL) {
+ return(NOTOK);
+ }
diff --git a/crypto/krb5/BUILD b/crypto/krb5/BUILD
index 14d1206..f828bc4 100755
--- a/crypto/krb5/BUILD
+++ b/crypto/krb5/BUILD
@@ -6,6 +6,9 @@ fi

cd $SPELL-$VERSION/src &&

+# MIT krb5 Security Advisory 2006-001
+patch -p0 < $SCRIPT_DIRECTORY/2006-001-patch_1.5.txt &&
+
./configure --enable-dns-for-kdc \
--enable-dns-for-realm \
--infodir=/usr/share/info \
diff --git a/crypto/krb5/DETAILS b/crypto/krb5/DETAILS
index 2935736..2d35f91 100755
--- a/crypto/krb5/DETAILS
+++ b/crypto/krb5/DETAILS
@@ -10,6 +10,7 @@ SOURCE_DIRECTORY=$BUILD_DIRECTORY/$SPELL
UPDATED=20050714

LICENSE[0]=http://web.mit.edu/kerberos/www/krb5-1.4/krb5-1.4/doc/krb5-install.html#Copyright
BUILD_API=2
+ SECURITY_PATCH=1
SHORT="Kerberos 5 network security protocol"
cat << EOF
Kerberos was created by MIT as a solution to network security problems.
diff --git a/crypto/krb5/HISTORY b/crypto/krb5/HISTORY
index b05e09c..319ffd0 100644
--- a/crypto/krb5/HISTORY
+++ b/crypto/krb5/HISTORY
@@ -1,3 +1,7 @@
+2006-08-22 Ladislav Hagara <hgr AT vabo.cz>
+ * BUILD, 2006-001-patch_1.5.txt: added security patch [Bug 13019]
+ * DETAILS: SECURITY_PATCH=1
+
2006-01-13 Ladislav Hagara <hgr AT vabo.cz>
* DETAILS: 1.4.3




  • [SM-Commit] GIT changes to stable-0.4 grimoire by Jaka Kranjc (2cdb0859e343a3ff9e6b206476ce7b82f9b3a7c1), Jaka Kranjc, 01/01/2007

Archive powered by MHonArc 2.6.24.

Top of Page