diff options
author | Sona Sarmadi <sona.sarmadi@enea.com> | 2017-12-04 11:57:37 +0100 |
---|---|---|
committer | Adrian Dudau <adrian.dudau@enea.com> | 2017-12-06 11:34:56 +0100 |
commit | be2fdb1cf46dfb5b14b98378ce5a5360afc734a7 (patch) | |
tree | 85a13d8717921fbbde32ab7ee768bf161be651ff | |
parent | 0523369959a0858f2b3e017e10ffa2b4de428c8c (diff) | |
download | meta-nfv-access-common-be2fdb1cf46dfb5b14b98378ce5a5360afc734a7.tar.gz |
curl: Security fix for CVE-2017-1000254
FTP PWD response parser out of bounds read
References:
https://curl.haxx.se/docs/adv_20171004.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000254
Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Signed-off-by: Adrian Dudau <adrian.dudau@enea.com>
-rw-r--r-- | recipes-support/curl/curl/CVE-2017-1000254.patch | 139 | ||||
-rw-r--r-- | recipes-support/curl/curl_%.bbappend | 1 |
2 files changed, 140 insertions, 0 deletions
diff --git a/recipes-support/curl/curl/CVE-2017-1000254.patch b/recipes-support/curl/curl/CVE-2017-1000254.patch new file mode 100644 index 0000000..d37b859 --- /dev/null +++ b/recipes-support/curl/curl/CVE-2017-1000254.patch | |||
@@ -0,0 +1,139 @@ | |||
1 | From f3be14cc3f3c56f612a0ffe1706fca14fe9eaf53 Mon Sep 17 00:00:00 2001 | ||
2 | From: Sona Sarmadi <sona.sarmadi@enea.com> | ||
3 | Date: Mon, 4 Dec 2017 09:38:43 +0100 | ||
4 | Subject: [PATCH] curl: fix for CVE-2017-1000254 | ||
5 | |||
6 | FTP: zero terminate the entry path even on bad input | ||
7 | |||
8 | ... a single double quote could leave the entry path buffer without a zero | ||
9 | terminating byte. | ||
10 | |||
11 | CVE: CVE-2017-1000254 | ||
12 | Upstream-Status: Backport [https://curl.haxx.se/CVE-2017-1000254.patch] | ||
13 | |||
14 | Test 1152 added to verify. | ||
15 | |||
16 | Reported-by: Max Dymond | ||
17 | Bug: https://curl.haxx.se/docs/adv_20171004.html | ||
18 | Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> | ||
19 | --- | ||
20 | lib/ftp.c | 7 ++++-- | ||
21 | tests/data/Makefile.inc | 1 + | ||
22 | tests/data/test1152 | 61 +++++++++++++++++++++++++++++++++++++++++++++++++ | ||
23 | 3 files changed, 67 insertions(+), 2 deletions(-) | ||
24 | create mode 100644 tests/data/test1152 | ||
25 | |||
26 | diff --git a/lib/ftp.c b/lib/ftp.c | ||
27 | index aa4d5ac..cab3699 100644 | ||
28 | --- a/lib/ftp.c | ||
29 | +++ b/lib/ftp.c | ||
30 | @@ -2826,6 +2826,7 @@ static CURLcode ftp_statemach_act(struct connectdata *conn) | ||
31 | const size_t buf_size = CURL_BUFSIZE(data->set.buffer_size); | ||
32 | char *dir; | ||
33 | char *store; | ||
34 | + bool entry_extracted = FALSE; | ||
35 | |||
36 | dir = malloc(nread + 1); | ||
37 | if(!dir) | ||
38 | @@ -2857,7 +2858,7 @@ static CURLcode ftp_statemach_act(struct connectdata *conn) | ||
39 | } | ||
40 | else { | ||
41 | /* end of path */ | ||
42 | - *store = '\0'; /* zero terminate */ | ||
43 | + entry_extracted = TRUE; | ||
44 | break; /* get out of this loop */ | ||
45 | } | ||
46 | } | ||
47 | @@ -2866,7 +2867,9 @@ static CURLcode ftp_statemach_act(struct connectdata *conn) | ||
48 | store++; | ||
49 | ptr++; | ||
50 | } | ||
51 | - | ||
52 | + *store = '\0'; /* zero terminate */ | ||
53 | + } | ||
54 | + if(entry_extracted) { | ||
55 | /* If the path name does not look like an absolute path (i.e.: it | ||
56 | does not start with a '/'), we probably need some server-dependent | ||
57 | adjustments. For example, this is the case when connecting to | ||
58 | diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc | ||
59 | index 8251ab9..01ad40d 100644 | ||
60 | --- a/tests/data/Makefile.inc | ||
61 | +++ b/tests/data/Makefile.inc | ||
62 | @@ -121,6 +121,7 @@ test1120 test1121 test1122 test1123 test1124 test1125 test1126 test1127 \ | ||
63 | test1128 test1129 test1130 test1131 test1132 test1133 test1134 test1135 \ | ||
64 | test1136 test1137 test1138 test1139 test1140 test1141 test1142 test1143 \ | ||
65 | test1144 test1145 test1146 \ | ||
66 | +test1152 \ | ||
67 | test1200 test1201 test1202 test1203 test1204 test1205 test1206 test1207 \ | ||
68 | test1208 test1209 test1210 test1211 test1212 test1213 test1214 test1215 \ | ||
69 | test1216 test1217 test1218 test1219 \ | ||
70 | diff --git a/tests/data/test1152 b/tests/data/test1152 | ||
71 | new file mode 100644 | ||
72 | index 0000000..c55739d | ||
73 | --- /dev/null | ||
74 | +++ b/tests/data/test1152 | ||
75 | @@ -0,0 +1,61 @@ | ||
76 | +<testcase> | ||
77 | +<info> | ||
78 | +<keywords> | ||
79 | +FTP | ||
80 | +PASV | ||
81 | +LIST | ||
82 | +</keywords> | ||
83 | +</info> | ||
84 | +# | ||
85 | +# Server-side | ||
86 | +<reply> | ||
87 | +<servercmd> | ||
88 | +REPLY PWD 257 "just one | ||
89 | +</servercmd> | ||
90 | + | ||
91 | +# When doing LIST, we get the default list output hard-coded in the test | ||
92 | +# FTP server | ||
93 | +<data mode="text"> | ||
94 | +total 20 | ||
95 | +drwxr-xr-x 8 98 98 512 Oct 22 13:06 . | ||
96 | +drwxr-xr-x 8 98 98 512 Oct 22 13:06 .. | ||
97 | +drwxr-xr-x 2 98 98 512 May 2 1996 curl-releases | ||
98 | +-r--r--r-- 1 0 1 35 Jul 16 1996 README | ||
99 | +lrwxrwxrwx 1 0 1 7 Dec 9 1999 bin -> usr/bin | ||
100 | +dr-xr-xr-x 2 0 1 512 Oct 1 1997 dev | ||
101 | +drwxrwxrwx 2 98 98 512 May 29 16:04 download.html | ||
102 | +dr-xr-xr-x 2 0 1 512 Nov 30 1995 etc | ||
103 | +drwxrwxrwx 2 98 1 512 Oct 30 14:33 pub | ||
104 | +dr-xr-xr-x 5 0 1 512 Oct 1 1997 usr | ||
105 | +</data> | ||
106 | +</reply> | ||
107 | + | ||
108 | +# | ||
109 | +# Client-side | ||
110 | +<client> | ||
111 | +<server> | ||
112 | +ftp | ||
113 | +</server> | ||
114 | + <name> | ||
115 | +FTP with uneven quote in PWD response | ||
116 | + </name> | ||
117 | + <command> | ||
118 | +ftp://%HOSTIP:%FTPPORT/test-1152/ | ||
119 | +</command> | ||
120 | +</client> | ||
121 | + | ||
122 | +# | ||
123 | +# Verify data after the test has been "shot" | ||
124 | +<verify> | ||
125 | +<protocol> | ||
126 | +USER anonymous | ||
127 | +PASS ftp@example.com | ||
128 | +PWD | ||
129 | +CWD test-1152 | ||
130 | +EPSV | ||
131 | +TYPE A | ||
132 | +LIST | ||
133 | +QUIT | ||
134 | +</protocol> | ||
135 | +</verify> | ||
136 | +</testcase> | ||
137 | -- | ||
138 | 1.9.1 | ||
139 | |||
diff --git a/recipes-support/curl/curl_%.bbappend b/recipes-support/curl/curl_%.bbappend index ca548e8..82db0f7 100644 --- a/recipes-support/curl/curl_%.bbappend +++ b/recipes-support/curl/curl_%.bbappend | |||
@@ -4,4 +4,5 @@ FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:" | |||
4 | SRC_URI += "file://CVE-2017-7407.patch \ | 4 | SRC_URI += "file://CVE-2017-7407.patch \ |
5 | file://CVE-2017-7468.patch \ | 5 | file://CVE-2017-7468.patch \ |
6 | file://CVE-2017-9502.patch \ | 6 | file://CVE-2017-9502.patch \ |
7 | file://CVE-2017-1000254.patch \ | ||
7 | " | 8 | " |