Skip to Content.
Sympa Menu

sm-commit - [SM-Commit] GIT changes to master grimoire by Vlad Glagolev (d91f8a39815a3819c4c5a4c6d9f0819a68967d4b)

sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

Chronological Thread  
  • From: Vlad Glagolev <scm AT sourcemage.org>
  • To: sm-commit AT lists.ibiblio.org
  • Subject: [SM-Commit] GIT changes to master grimoire by Vlad Glagolev (d91f8a39815a3819c4c5a4c6d9f0819a68967d4b)
  • Date: Wed, 10 Oct 2012 05:46:05 -0500

GIT changes to master grimoire by Vlad Glagolev <stealth AT sourcemage.org>:

kernels/linux/HISTORY | 3
kernels/linux/info/patches/maintenance_patches_3/patch-3.2.31 | 5 +
net/bind-tools/DETAILS | 4
net/bind-tools/HISTORY | 3
net/hostapd/DETAILS | 1
net/hostapd/HISTORY | 5 +
net/hostapd/PRE_BUILD | 2
net/hostapd/eap-tls.patch | 48
++++++++++
8 files changed, 69 insertions(+), 2 deletions(-)

New commits:
commit d91f8a39815a3819c4c5a4c6d9f0819a68967d4b
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

linux: => 3.2.31 (eol)

commit 35fd8313bebc4291a31aa3014dc9ea0b5bd104d4
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

hostapd: fixed CVE-2012-4445 (security)

commit be586192310f93a231837ceb28a16fdc1cfb4c7f
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

bind-tools: => 9.9.1-P4 (security)

diff --git a/kernels/linux/HISTORY b/kernels/linux/HISTORY
index f23ce16..ea4ad02 100644
--- a/kernels/linux/HISTORY
+++ b/kernels/linux/HISTORY
@@ -1,3 +1,6 @@
+2012-10-10 Vlad Glagolev <stealth AT sourcemage.org>
+ * info/patches/maintenance_patches_3/patch-3.2.31: added
+
2012-10-08 Vlad Glagolev <stealth AT sourcemage.org>
* info/patches/maintenance_patches_3/patch-3.5.6: added
* info/patches/maintenance_patches_3/patch-3.4.13: added
diff --git a/kernels/linux/info/patches/maintenance_patches_3/patch-3.2.31
b/kernels/linux/info/patches/maintenance_patches_3/patch-3.2.31
new file mode 100755
index 0000000..7ce5b22
--- /dev/null
+++ b/kernels/linux/info/patches/maintenance_patches_3/patch-3.2.31
@@ -0,0 +1,5 @@
+appliedkernels="3.2"
+patchversion="${appliedkernels}.31"
+source="patch-${patchversion}.bz2"
+source_url="${KERNEL_URL}/pub/linux/kernel/v3.x/${source}"
+sha1sum="f8a87eaeaf3c3976564e39449bd959023b6ead6f"
diff --git a/net/bind-tools/DETAILS b/net/bind-tools/DETAILS
index 2cc83da..07145c7 100755
--- a/net/bind-tools/DETAILS
+++ b/net/bind-tools/DETAILS
@@ -1,12 +1,12 @@
SPELL=bind-tools
- VERSION=9.9.1-P3
+ VERSION=9.9.1-P4
SOURCE=bind-$VERSION.tar.gz
SOURCE2=$SOURCE.sha512.asc
SOURCE_DIRECTORY="$BUILD_DIRECTORY/bind-$VERSION"
SOURCE_URL[0]=ftp://ftp.isc.org/isc/bind9/$VERSION/$SOURCE
SOURCE2_URL[0]=ftp://ftp.isc.org/isc/bind9/$VERSION/$SOURCE2
SOURCE2_IGNORE=signature
- SECURITY_PATCH=10
+ SECURITY_PATCH=11
SOURCE_GPG=isc.gpg:$SOURCE2:UPSTREAM_KEY
LICENSE[0]=ISC
KEYWORDS="net"
diff --git a/net/bind-tools/HISTORY b/net/bind-tools/HISTORY
index 1dc8802..f064c2d 100644
--- a/net/bind-tools/HISTORY
+++ b/net/bind-tools/HISTORY
@@ -1,3 +1,6 @@
+2012-10-10 Vlad Glagolev <stealth AT sourcemage.org>
+ * DETAILS: updated spell to 9.9.1-P4; SECURITY_PATCH++
+
2012-09-13 Vlad Glagolev <stealth AT sourcemage.org>
* DETAILS: updated spell to 9.9.1-P3; SECURITY_PATCH++

diff --git a/net/hostapd/DETAILS b/net/hostapd/DETAILS
index 9529ff5..ff82790 100755
--- a/net/hostapd/DETAILS
+++ b/net/hostapd/DETAILS
@@ -1,5 +1,6 @@
SPELL=hostapd
VERSION=1.0
+ SECURITY_PATCH=1
SOURCE=$SPELL-$VERSION.tar.gz
SOURCE_GPG=gurus.gpg:$SOURCE.sig:WORKS_FOR_ME
SOURCE_DIRECTORY="$BUILD_DIRECTORY/$SPELL-$VERSION"
diff --git a/net/hostapd/HISTORY b/net/hostapd/HISTORY
index 7a610d3..2cb45aa 100644
--- a/net/hostapd/HISTORY
+++ b/net/hostapd/HISTORY
@@ -1,3 +1,8 @@
+2012-10-10 Vlad Glagolev <stealth AT sourcemage.org>
+ * DETAILS: SECURITY_PATCH=1
+ * PRE_BUILD: apply the patch
+ * eap-tls.patch: added, to fix CVE-2012-4445
+
2012-07-05 Vlad Glagolev <stealth AT sourcemage.org>
* DETAILS, {PRE_,}BUILD, CONFIGURE, DEPENDS, FINAL, INSTALL,
init.d/hostapd{,.conf}: spell created
diff --git a/net/hostapd/PRE_BUILD b/net/hostapd/PRE_BUILD
index 8053703..0d06435 100755
--- a/net/hostapd/PRE_BUILD
+++ b/net/hostapd/PRE_BUILD
@@ -1,6 +1,8 @@
default_pre_build &&
cd "$SOURCE_DIRECTORY" &&

+patch -p1 < "$SPELL_DIRECTORY/eap-tls.patch" &&
+
# /etc/hostapd.* -> /etc/hostapd/hostapd.*
sedit "s:/etc/hostapd:/etc/hostapd/hostapd:g" hostapd/hostapd.conf &&

diff --git a/net/hostapd/eap-tls.patch b/net/hostapd/eap-tls.patch
new file mode 100644
index 0000000..bda92cf
--- /dev/null
+++ b/net/hostapd/eap-tls.patch
@@ -0,0 +1,48 @@
+From 586c446e0ff42ae00315b014924ec669023bd8de Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <j AT w1.fi>
+Date: Sun, 7 Oct 2012 20:06:29 +0300
+Subject: [PATCH] EAP-TLS server: Fix TLS Message Length validation
+
+EAP-TLS/PEAP/TTLS/FAST server implementation did not validate TLS
+Message Length value properly and could end up trying to store more
+information into the message buffer than the allocated size if the first
+fragment is longer than the indicated size. This could result in hostapd
+process terminating in wpabuf length validation. Fix this by rejecting
+messages that have invalid TLS Message Length value.
+
+This would affect cases that use the internal EAP authentication server
+in hostapd either directly with IEEE 802.1X or when using hostapd as a
+RADIUS authentication server and when receiving an incorrectly
+constructed EAP-TLS message. Cases where hostapd uses an external
+authentication are not affected.
+
+Thanks to Timo Warns for finding and reporting this issue.
+
+Signed-hostap: Jouni Malinen <j AT w1.fi>
+intended-for: hostap-1
+---
+ src/eap_server/eap_server_tls_common.c | 8 ++++++++
+ 1 files changed, 8 insertions(+), 0 deletions(-)
+
+diff --git a/src/eap_server/eap_server_tls_common.c
b/src/eap_server/eap_server_tls_common.c
+index 31be2ec..46f282b 100644
+--- a/src/eap_server/eap_server_tls_common.c
++++ b/src/eap_server/eap_server_tls_common.c
+@@ -228,6 +228,14 @@ static int eap_server_tls_process_fragment(struct
eap_ssl_data *data,
+ return -1;
+ }
+
++ if (len > message_length) {
++ wpa_printf(MSG_INFO, "SSL: Too much data (%d bytes)
in "
++ "first fragment of frame (TLS Message "
++ "Length %d bytes)",
++ (int) len, (int) message_length);
++ return -1;
++ }
++
+ data->tls_in = wpabuf_alloc(message_length);
+ if (data->tls_in == NULL) {
+ wpa_printf(MSG_DEBUG, "SSL: No memory for message");
+--
+1.7.4-rc1
+



  • [SM-Commit] GIT changes to master grimoire by Vlad Glagolev (d91f8a39815a3819c4c5a4c6d9f0819a68967d4b), Vlad Glagolev, 10/10/2012

Archive powered by MHonArc 2.6.24.

Top of Page