diff options
author | Minjae Kim <flowergom@gmail.com> | 2021-12-17 22:08:23 -0800 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2021-12-30 16:59:16 +0000 |
commit | 1e13a3f9146b7ff8f660980c81574aa08843e4c5 (patch) | |
tree | a81053ad356258d58a74d83f5e172054afc90d2f /meta/recipes-connectivity/inetutils/inetutils/CVE-2021-40491.patch | |
parent | 9564dc31cb906f2c80746858eb9977b43886e723 (diff) | |
download | poky-1e13a3f9146b7ff8f660980c81574aa08843e4c5.tar.gz |
inetutils: fix CVE-2021-40491
The ftp client in GNU Inetutils before 2.2 does not validate addresses
returned by PASV/LSPV responses to make sure they match the server
address. This is similar to CVE-2020-8284 for curl.
References:
https://nvd.nist.gov/vuln/detail/CVE-2021-40491
Patch from:
https://git.savannah.gnu.org/cgit/inetutils.git/commit/?id=58cb043b190fd04effdaea7c9403416b436e50dd
(From OE-Core rev: 22de3b937dda28a6aa4113549f32f36d67b6751d)
Signed-off-by: Minjae Kim <flowergom@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-connectivity/inetutils/inetutils/CVE-2021-40491.patch')
-rw-r--r-- | meta/recipes-connectivity/inetutils/inetutils/CVE-2021-40491.patch | 67 |
1 files changed, 67 insertions, 0 deletions
diff --git a/meta/recipes-connectivity/inetutils/inetutils/CVE-2021-40491.patch b/meta/recipes-connectivity/inetutils/inetutils/CVE-2021-40491.patch new file mode 100644 index 0000000000..54252d6bc7 --- /dev/null +++ b/meta/recipes-connectivity/inetutils/inetutils/CVE-2021-40491.patch | |||
@@ -0,0 +1,67 @@ | |||
1 | From 4e355804d57d5686defc363c70f81e6f58cd08f0 Mon Sep 17 00:00:00 2001 | ||
2 | From: Simon Josefsson <simon@josefsson.org> | ||
3 | Date: Fri, 17 Dec 2021 21:52:18 -0800 | ||
4 | Subject: [PATCH] ftp: check that PASV/LSPV addresses match. | ||
5 | |||
6 | * NEWS: Mention change. | ||
7 | * ftp/ftp.c (initconn): Validate returned addresses. | ||
8 | |||
9 | CVE: CVE-2021-40491 | ||
10 | |||
11 | Upstream-Status: Backport | ||
12 | [https://git.savannah.gnu.org/cgit/inetutils.git/commit/?id=58cb043b190fd04effdaea7c9403416b436e50dd] | ||
13 | |||
14 | Signed-off-by: Minjae Kim <flowergom@gmail.com> | ||
15 | --- | ||
16 | ftp/ftp.c | 21 +++++++++++++++++++++ | ||
17 | 1 file changed, 21 insertions(+) | ||
18 | |||
19 | diff --git a/ftp/ftp.c b/ftp/ftp.c | ||
20 | index 9813586..7c72cb2 100644 | ||
21 | --- a/ftp/ftp.c | ||
22 | +++ b/ftp/ftp.c | ||
23 | @@ -1344,6 +1344,13 @@ initconn (void) | ||
24 | uint32_t *pu32 = (uint32_t *) &data_addr_sa4->sin_addr.s_addr; | ||
25 | pu32[0] = htonl ( (h[0] << 24) | (h[1] << 16) | (h[2] << 8) | h[3]); | ||
26 | } | ||
27 | + if (data_addr_sa4->sin_addr.s_addr | ||
28 | + != ((struct sockaddr_in *) &hisctladdr)->sin_addr.s_addr) | ||
29 | + { | ||
30 | + printf ("Passive mode address mismatch.\n"); | ||
31 | + (void) command ("ABOR"); /* Cancel any open connection. */ | ||
32 | + goto bad; | ||
33 | + } | ||
34 | } /* LPSV IPv4 */ | ||
35 | else /* IPv6 */ | ||
36 | { | ||
37 | @@ -1374,6 +1381,13 @@ initconn (void) | ||
38 | pu32[2] = htonl ( (h[8] << 24) | (h[9] << 16) | (h[10] << 8) | h[11]); | ||
39 | pu32[3] = htonl ( (h[12] << 24) | (h[13] << 16) | (h[14] << 8) | h[15]); | ||
40 | } | ||
41 | + if (data_addr_sa6->sin6_addr.s6_addr | ||
42 | + != ((struct sockaddr_in6 *) &hisctladdr)->sin6_addr.s6_addr) | ||
43 | + { | ||
44 | + printf ("Passive mode address mismatch.\n"); | ||
45 | + (void) command ("ABOR"); /* Cancel any open connection. */ | ||
46 | + goto bad; | ||
47 | + } | ||
48 | } /* LPSV IPv6 */ | ||
49 | } | ||
50 | else /* !EPSV && !LPSV */ | ||
51 | @@ -1394,6 +1408,13 @@ initconn (void) | ||
52 | | ((a2 & 0xff) << 8) | (a3 & 0xff) ); | ||
53 | data_addr_sa4->sin_port = | ||
54 | htons (((p0 & 0xff) << 8) | (p1 & 0xff)); | ||
55 | + if (data_addr_sa4->sin_addr.s_addr | ||
56 | + != ((struct sockaddr_in *) &hisctladdr)->sin_addr.s_addr) | ||
57 | + { | ||
58 | + printf ("Passive mode address mismatch.\n"); | ||
59 | + (void) command ("ABOR"); /* Cancel any open connection. */ | ||
60 | + goto bad; | ||
61 | + } | ||
62 | } /* PASV */ | ||
63 | else | ||
64 | { | ||
65 | -- | ||
66 | 2.25.1 | ||
67 | |||