New commits:
commit 22566225b83cb0594e91916e920020a7b6b90527
Author: George Sherwood <gsherwood AT sourcemage.org>
Commit: Eric Sandall <sandalle@webex-d630.(none)>
firefox: Updated to version 2.0.0.7. SECURITY_PATCH++. New sig
not part of firefox.gpg. Added missing && in PRE_BUILD
commit 8a08f9c16494bdb5027316b46a7efa9c645f5c86
Author: Ladislav Hagara <ladislav.hagara AT unob.cz>
Commit: Eric Sandall <sandalle@webex-d630.(none)>
apache-mod_ssl 2.8.29-1.3.39, SECURITY_PATCH=1
commit e10e5e17865fb8cbe76e0d5e61d181edbc1aa31c
Author: Ladislav Hagara <ladislav.hagara AT unob.cz>
Commit: Eric Sandall <sandalle@webex-d630.(none)>
apache 1.3.39, SECURITY_PATCH=2
commit 7fb2aeea44a42f23759741f011ec223d35d3a034
Author: Ladislav Hagara <ladislav.hagara AT unob.cz>
Commit: Eric Sandall <sandalle@webex-d630.(none)>
apache22 2.2.6, SECURITY_PATCH=2
commit 39d0fc4632e384b98de4827183c7d0939cab0e6f
Author: Ladislav Hagara <ladislav.hagara AT unob.cz>
Commit: Eric Sandall <sandalle@webex-d630.(none)>
samba 3.0.26a, SECURITY_PATCH=4
commit 06e5615bfe1b1d54a26ea1879ccd4a2ac0f0f5d5
Author: Ladislav Hagara <ladislav.hagara AT unob.cz>
Commit: Eric Sandall <sandalle@webex-d630.(none)>
LICENSE[0]=http://web.mit.edu/kerberos/www/krb5-1.6/krb5-1.6/doc/krb5-install.html#Copyright
PATCHLEVEL=0
- SECURITY_PATCH=4
+ SECURITY_PATCH=5
KEYWORDS="security crypto"
SHORT="Kerberos 5 network security protocol"
cat << EOF
diff --git a/crypto/krb5/HISTORY b/crypto/krb5/HISTORY
index d445d3d..e228521 100644
--- a/crypto/krb5/HISTORY
+++ b/crypto/krb5/HISTORY
@@ -1,3 +1,7 @@
+2007-09-12 Ladislav Hagara <hgr AT vabo.cz>
+ * DETAILS: SECURITY_PATCH=5, CVE-2007-3999, CVE-2007-4000
+ * BUILD, MITKRB5-SA-2007-006.txt: added security patch
+
2007-07-17 Ladislav Hagara <hgr AT vabo.cz>
* DETAILS: 1.6.2
* BUILD, MITKRB5-SA-2007-00[45].txt: removed patches
diff --git a/crypto/krb5/MITKRB5-SA-2007-006.txt
b/crypto/krb5/MITKRB5-SA-2007-006.txt
new file mode 100644
index 0000000..979f9ed
--- /dev/null
+++ b/crypto/krb5/MITKRB5-SA-2007-006.txt
@@ -0,0 +1,294 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA1
+
+ MIT krb5 Security Advisory 2007-006
+
+Original release: 2007-09-04
+Last update: 2007-09-05
+
+Topic: kadmind RPC lib buffer overflow, uninitialized pointer
+
+[CVE-2007-3999/VU#883632]
+RPC library buffer overflow
+
+CVSSv2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:OF/RC:C
+
+CVSSv2 Base Score: 10
+
+Access Vector: Network
+Access Complexity: Low
+Authentication: None
+Confidentiality Impact: Complete
+Integrity Impact: Complete
+Availability Impact: Complete
+
+CVSSv2 Temporal Score: 7.8
+
+Exploitability: Proof-of-Concept
+Remediation Level: Official Fix
+Report Confidence: Confirmed
+
+[CVE-2007-4000/VU#377544]
+kadmind uninitialized pointer
+
+CVSSv2 Vector: AV:N/AC:H/Au:S/C:C/I:C/A:C/E:POC/RL:OF/RC:C
+
+See DETAILS for the expanded CVSSv2 metrics for this vulnerability.
+
+SUMMARY
+=======
+
+This advisory concerns two vulnerabilities. CVE-2007-3999 is much
+easier to exploit than CVE-2007-4000.
+
+[CVE-2007-3999]
+
+The MIT krb5 Kerberos administration daemon (kadmind) is vulnerable to
+a stack buffer overflow in the RPCSEC_GSS authentication flavor of the
+RPC library. Third-party applications using the RPC library provided
+with MIT krb5 may also be affected.
+
+We have received a proof-of-concept exploit that does not appear to
+execute malicious code, and we believe that this exploit is not
+publicly circulated.
+
+This is a bug in the RPC library in MIT krb5. It is not a bug in the
+Kerberos protocol.
+
+[CVE-2007-4000]
+
+The MIT krb5 Kerberos administration daemon (kadmind) can write data
+through an uninitialized pointer. We know of no working exploit code
+for this vulnerability, and do not believe that any exploit code for
+this vulnerability is circulating.
+
+This is a bug in the kadmind in MIT krb5. It is not a bug in the
+Kerberos protocol.
+
+IMPACT
+======
+
+[CVE-2007-3999] An unauthenticated remote user may be able to cause a
+host running kadmind to execute arbitrary code.
+
+[CVE-2007-4000] An authenticated user with "modify policy" privilege
+may be able to cause a host running kadmind to execute arbitrary code.
+
+Successful exploitation of either vulnerability can compromise the
+Kerberos key database and host security on the KDC host. (kadmind
+typically runs as root.) Unsuccessful exploitation attempts will
+likely result in kadmind crashing.
+
+Third-party applications calling the RPC library provided with MIT
+krb5 may be vulnerable to CVE-2007-3999.
+
+AFFECTED SOFTWARE
+=================
+
+[CVE-2007-3999]
+
+* kadmind in MIT releases krb5-1.4 through krb5-1.6.2
+
+* third-party RPC server programs linked against the RPC library
+ included in MIT releases krb5-1.4 through krb5-1.6.2
+
+* MIT releases prior to krb5-1.4 did not contain the vulnerable code
+
+[CVE-2007-4000]
+
+* kadmind in MIT releases krb5-1.5 through krb5-1.6.2
+
+* MIT releases prior to krb5-1.5 did not contain the vulnerable code
+
+FIXES
+=====
+
+* The patch for CVE-2007-3999 has been revised; the patch originally
+ released for svc_auth_gss.c allowed a 32-byte overflow. Depending
+ on the compilation environment and machine architecture, this may or
+ may not be a significant continued vulnerability. The new patch
+ below correctly checks the buffer length.
+
+* The upcoming krb5-1.6.3 release, as well as the upcoming krb5-1.5.5
+ maintenance release, will contain fixes for this vulnerability.
+
+Prior to that release you may apply the following patch. Note that
+releases prior to krb5-1.5 will not need the svr_policy.c patch.
+
+*** src/lib/kadm5/srv/svr_policy.c (revision 20254)
+- --- src/lib/kadm5/srv/svr_policy.c (local)
+***************
+*** 211,218 ****
+ if((mask & KADM5_POLICY))
+ return KADM5_BAD_MASK;
+
+! ret = krb5_db_get_policy(handle->context, entry->policy, &p, &cnt);
+! if( ret && (cnt==0) )
+ return KADM5_UNK_POLICY;
+
+ if ((mask & KADM5_PW_MAX_LIFE))
+- --- 211,219 ----
+ if((mask & KADM5_POLICY))
+ return KADM5_BAD_MASK;
+
+! if ((ret = krb5_db_get_policy(handle->context, entry->policy, &p,
&cnt)))
+! return ret;
+! if (cnt != 1)
+ return KADM5_UNK_POLICY;
+
+ if ((mask & KADM5_PW_MAX_LIFE))
+*** src/lib/rpc/svc_auth_gss.c (revision 20474)
+- --- src/lib/rpc/svc_auth_gss.c (local)
+***************
+*** 355,360 ****
+- --- 355,369 ----
+ memset(rpchdr, 0, sizeof(rpchdr));
+
+ /* XXX - Reconstruct RPC header for signing (from xdr_callmsg). */
++ oa = &msg->rm_call.cb_cred;
++ if (oa->oa_length > MAX_AUTH_BYTES)
++ return (FALSE);
++
++ /* 8 XDR units from the IXDR macro calls. */
++ if (sizeof(rpchdr) < (8 * BYTES_PER_XDR_UNIT +
++ RNDUP(oa->oa_length)))
++ return (FALSE);
++
+ buf = (int32_t *)(void *)rpchdr;
+ IXDR_PUT_LONG(buf, msg->rm_xid);
+ IXDR_PUT_ENUM(buf, msg->rm_direction);
+***************
+*** 362,368 ****
+ IXDR_PUT_LONG(buf, msg->rm_call.cb_prog);
+ IXDR_PUT_LONG(buf, msg->rm_call.cb_vers);
+ IXDR_PUT_LONG(buf, msg->rm_call.cb_proc);
+- - oa = &msg->rm_call.cb_cred;
+ IXDR_PUT_ENUM(buf, oa->oa_flavor);
+ IXDR_PUT_LONG(buf, oa->oa_length);
+ if (oa->oa_length) {
+- --- 371,376 ----
+
+ This patch is also available at
+
+ http://web.mit.edu/kerberos/advisories/2007-006-patch.txt
+
+ A PGP-signed patch is available at
+
+ http://web.mit.edu/kerberos/advisories/2007-006-patch.txt.asc
+
+REFERENCES
+==========
+
+This announcement is posted at:
+
+ http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2007-006.txt
+
+This announcement and related security advisories may be found on the
+MIT Kerberos security advisory page at:
+
+ http://web.mit.edu/kerberos/advisories/index.html
+
+The main MIT Kerberos web page is at:
+
+ http://web.mit.edu/kerberos/index.html
+
+CVSSv2:
+
+ http://www.first.org/cvss/cvss-guide.html
+ http://nvd.nist.gov/cvss.cfm?calculator&adv&version=2
+
+CVE: CVE-2007-3999
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3999
+
+CERT: VU#883632
+http://www.kb.cert.org/vuls/id/883632
+
+CVE: CVE-2007-4000
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4000
+
+CERT: VU#377544
+http://www.kb.cert.org/vuls/id/377544
+
+ACKNOWLEDGMENTS
+===============
+
+Thanks to Kevin Coffman (UMich), Will Fiveash (Sun), and Nico Williams
+(Sun) for discovering the bug in the initial CVE-2007-3999 patch and
+for help with developing the revised patch for CVE-2007-3999.
+
+CVE-2007-3999 was discovered by Tenable Network Security and reported
+to MIT Kerberos Team by the Zero Day Initiative (ZDI) of the
+TippingPoint division of 3Com.
+
+CVE-2007-4000 was discovered by Garrett Wollman of MIT CSAIL.
+
+DETAILS
+=======
+
+[CVE-2007-3999]
+
+The implementation of the RPCSEC_GSS authentication flavor copies
+untrusted data having an inadequately-validated length into a buffer
+on the stack. In the function svcauth_gss_validate() in
+src/lib/rpc/svc_auth_gss.c, which authenticates the incoming RPC
+message, a memcpy() invocation copies a number of bytes into the
+128-byte stack buffer "rpchdr". The length provided to this memcpy()
+invocation comes from the RPC header and may be maliciously chosen.
+The invocation of xdr_callmsg(), which provides the decoded rpc_msg
+structure used by svcauth_gss_validate(), ensures that the provided
+length does not exceed MAX_AUTH_BYTES, which is 400, but destination
+buffer is smaller than this size, and can be trivially overflowed.
+
+The vulnerable code executes prior to the completion of authentication
+of the RPC message, and therefore requires no authentication to
+exploit.
+
+Exploitation of stack buffer overflows is trivial on many platforms.
+
+[CVE-2007-4000]
+
+CVSSv2 Vector: AV:N/AC:H/Au:S/C:C/I:C/A:C/E:POC/RL:OF/RC:C
+
+CVSSv2 Base Score: 7.1
+
+Access Vector: Network
+Access Complexity: High
+Authentication: Single
+Confidentiality Impact: Complete
+Integrity Impact: Complete
+Availability Impact: Complete
+
+CVSSv2 Temporal Score: 5.6
+
+Exploitability: Proof-of-Concept
+Remediation Level: Official Fix
+Report Confidence: Confirmed
+
+The function kadm5_modify_policy_internal() in
+src/lib/kadm5/srv/svr_policy.c, does not check return values from
+krb5_db_get_policy() correctly. When the policy does not exist,
+krb5_db_get_policy() returns zero but sets the count retrieved records
+to zero without initializing the output pointer. Subsequent code in
+kadm5_modify_policy_internal() can attempt to write data through this
+pointer, causing memory corruption.
+
+This vulnerability was not present in MIT releases prior to krb5-1.5.
+In the krb5-1.5 release, changes related to the implementation of the
+Database Abstraction Layer introduced this vulnerability.
+
+REVISION HISTORY
+================
+
+2007-09-05 CVE-2007-3999 patch revised due to 32-byte overflow
+2007-09-04 original release
+
+Copyright (C) 2007 Massachusetts Institute of Technology
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v1.4.6 (SunOS)
+
+iQCVAwUBRt8QzKbDgE/zdoE9AQKdeAQAsXljmcOJpFHYISth3PZcVWQrrWI4u9PH
+F4CAC+3z9xd5KnOHAqqmxpK5XSDX0P9MCdibOYA/WG46U410pCNAkqV0RapUnivO
+fcU82CvXLDGoz4Z2+ldZpUYmL3mZ6ydTLutBAsz1XkkAILYfaP14+x0OXyyiMgeM
+tH18QwV9ccI=
+=TRxx
+-----END PGP SIGNATURE-----
diff --git a/http/apache-mod_ssl/DETAILS b/http/apache-mod_ssl/DETAILS
index 82ab85a..3968309 100755
--- a/http/apache-mod_ssl/DETAILS
+++ b/http/apache-mod_ssl/DETAILS
@@ -1,13 +1,14 @@
SPELL=apache-mod_ssl
- VERSION=2.8.28-1.3.37
+ VERSION=2.8.29-1.3.39
+ SECURITY_PATCH=1
SOURCE=mod_ssl-$VERSION.tar.gz
SOURCE2_BASE=apache_${VERSION##*-}
SOURCE2=$SOURCE2_BASE.tar.gz
SOURCE_DIRECTORY=$BUILD_DIRECTORY/$SPELL
SOURCE_URL=http://www.modssl.org/source/$SOURCE
SOURCE2_URL=http://www.apache.org/dist/httpd/$SOURCE2
-
SOURCE_HASH=sha512:17347e190b24a447ac295e0ec7ee737bfc953df58e6aa441017046db4f250b9b0ffe5bcbebd11e2c141b89296295b78fc21a6fea500017e45c6580e927072d8e
-
SOURCE2_HASH=sha512:471b83d7701c42bf21dff0b7dac242ed519c8517dddebc78b148ee2dbfdb6e9ad244c00a290294427c4ebdfbce19b01f30c0fdc32a4ac6f5b8cf473d69e377a8
+
SOURCE_HASH=sha512:ce3b4c00cdc43490b0c251f569c2721c28f946c96fbadd70bfb7b907c396bd61ed2a81b20905fc8345e66058a206ca9b87b756f393d629daff9dd807f5dea95c
+
SOURCE2_HASH=sha512:fdffb3ed167d7beae0162f341c36cbb5f0a9be63c898442534b217e0ce7c5f87dffe6a9223873fc336848261ea3424a7e692c3de1b4a4cf9ae43e9f75d8827d9
WEB_SITE=http://www.modssl.org/
ENTERED=20011219
LICENSE[0]=BSD
diff --git a/http/apache-mod_ssl/HISTORY b/http/apache-mod_ssl/HISTORY
index ca42de0..1f387d5 100644
--- a/http/apache-mod_ssl/HISTORY
+++ b/http/apache-mod_ssl/HISTORY
@@ -1,3 +1,7 @@
+2007-09-10 Ladislav Hagara <hgr AT vabo.cz>
+ * DETAILS: 2.8.29-1.3.39, SECURITY_PATCH=1
+ CVE-2006-5752, CVE-2007-3304
+
2006-12-02 George Sherwood <george AT beernabeer.com>
* DETAILS: Updated to version 2.8.28-1.3.37 & Removed UPDATED
http://www.mozilla.org/projects/security/known-vulnerabilities.html#firefox2.0.0.6
diff --git a/http/firefox/PRE_BUILD b/http/firefox/PRE_BUILD
index 042d15f..2e12dbe 100755
--- a/http/firefox/PRE_BUILD
+++ b/http/firefox/PRE_BUILD
@@ -25,7 +25,7 @@ FIREFOX_TARBALL=firefox-1.0+.tar.bz2 &&
message "Moving $FIREFOX_TARBALL to/var/spool/sorcery${DEFAULT_COLOR}"
&&
mv -v $FIREFOX_TARBALL $SOURCE_CACHE/
else
- default_pre_build
+ default_pre_build &&
cd $SOURCE_DIRECTORY &&
patch -p0 < $SCRIPT_DIRECTORY/x-lib.patch
fi &&
diff --git a/http/firefox/firefox-config.patch
b/http/firefox/firefox-config.patch
index 179fc5f..6a3f0dd 100644
--- a/http/firefox/firefox-config.patch
+++ b/http/firefox/firefox-config.patch
@@ -14,8 +14,8 @@
exit 0
;;
--cflags)
-- if test "/usr/local/include/firefox-2.0.0.6" != /usr/include ; then
-- includes="-I/usr/local/include/firefox-2.0.0.6"
+- if test "/usr/local/include/firefox-2.0.0.7" != /usr/include ; then
+- includes="-I/usr/local/include/firefox-2.0.0.7"
+ if test "/usr/include/firefox" != /usr/include ; then
+ includes="-I/usr/include/firefox"
fi
@@ -25,14 +25,14 @@
if test "$echo_cflags" = "yes"; then
nspr_cflags="-I/usr/include/nspr"
for n in $echo_components; do
-- component_includes="$component_includes
-I/usr/local/include/firefox-2.0.0.6/$n"
+- component_includes="$component_includes
-I/usr/local/include/firefox-2.0.0.7/$n"
+ component_includes="$component_includes -I/usr/include/firefox/$n"
done
echo $component_includes $includes $nspr_cflags
fi
if test "$echo_idlflags" = "yes"; then
-- echo "-I/usr/local/share/idl/firefox-2.0.0.6"
+- echo "-I/usr/local/share/idl/firefox-2.0.0.7"
+ echo "-I/usr/share/idl/firefox"
fi
@@ -41,6 +41,6 @@
;;
esac
done
-- echo -L/usr/local/lib/firefox-2.0.0.6 $libs
+- echo -L/usr/local/lib/firefox-2.0.0.7 $libs
+ echo -L/usr/lib $libs
fi
diff --git a/mail/sylpheed/DETAILS b/mail/sylpheed/DETAILS
index e582e47..d374c75 100755
--- a/mail/sylpheed/DETAILS
+++ b/mail/sylpheed/DETAILS
@@ -3,8 +3,9 @@ if [ "$SYLPHEED_GTK2" == "n" ]; then
VERSION=1.0.5
SOURCE_HASH=sha512:060b9ad6f829edaef8dd67c05237fd73bb24216daedc668e5e442b280730b205b64d8efe56e0f215bd7716a30734cfc6e8fd53252de1220b74c3f3d0d8eb5622
else
- VERSION=2.4.4
-
SOURCE_HASH=sha512:532a8aca3bdd8c812dab6bb9769039d1d67a0b48ce731ca19a97f3e9c795da34f583856a8574026ff655035540011c2fc2503837efc88810288c5d19d67e48ae
+ VERSION=2.4.5
+
SOURCE_HASH=sha512:da8c2f6019c315c4833c6ecda0a814c0d672f7238e8f18ac9a74c03e3c39378e4182c2124071800d142b092a55ef22fd8e7237f885e9e73b2914604bb16636ae
+ SECURITY_PATCH=1
fi
SOURCE=$SPELL-$VERSION.tar.bz2
SOURCE_DIRECTORY=$BUILD_DIRECTORY/$SPELL-$VERSION
diff --git a/mail/sylpheed/HISTORY b/mail/sylpheed/HISTORY
index d0c4cfb..1cea818 100644
--- a/mail/sylpheed/HISTORY
+++ b/mail/sylpheed/HISTORY
@@ -1,3 +1,6 @@
+2007-08-31 Ladislav Hagara <hgr AT vabo.cz>
+ * DETAILS: 2.4.5, SECURITY_PATCH=1, SA26550
+
2007-07-20 Ladislav Hagara <hgr AT vabo.cz>
* DETAILS: 2.4.4