diff options
author | Amarnath Valluri <amarnath.valluri@intel.com> | 2015-07-17 11:53:24 +0300 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2015-07-20 10:40:42 +0100 |
commit | 88dd997d9941b63ae9eead6690ecf2b785c0740c (patch) | |
tree | fe531585f3741dcb457bcf74683db6f60a0a2bce /meta/recipes-extended/pam/libpam/pam_timestamp-fix-potential-directory-traversal-issu.patch | |
parent | e9b9f8c0c5a208c02453839442099527fe6b13de (diff) | |
download | poky-88dd997d9941b63ae9eead6690ecf2b785c0740c.tar.gz |
libpam: Upgrade v1.1.6 -> v1.2.1
Dropped upstreamed patches(commit-id):
- add-checks-for-crypt-returning-NULL.patch(8dc056c)
- destdirfix.patch(d7e6b92)
- libpam-fix-for-CVE-2010-4708.patch(4c430f6)
Dropped backported patches(commit-id):
- pam_timestamp-fix-potential-directory-traversal-issu.patch(9dcead8)
- reflect-the-enforce_for_root-semantics-change-in-pam.patch(bd07ad3)
Forward ported patches:
- pam-unix-nullok-secure.patch
- crypt_configure.patch
(From OE-Core rev: 8683206f7ba85f693751415f896a0cc62931e3c4)
Signed-off-by: Amarnath Valluri <amarnath.valluri@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-extended/pam/libpam/pam_timestamp-fix-potential-directory-traversal-issu.patch')
-rw-r--r-- | meta/recipes-extended/pam/libpam/pam_timestamp-fix-potential-directory-traversal-issu.patch | 63 |
1 files changed, 0 insertions, 63 deletions
diff --git a/meta/recipes-extended/pam/libpam/pam_timestamp-fix-potential-directory-traversal-issu.patch b/meta/recipes-extended/pam/libpam/pam_timestamp-fix-potential-directory-traversal-issu.patch deleted file mode 100644 index 06cca13abe..0000000000 --- a/meta/recipes-extended/pam/libpam/pam_timestamp-fix-potential-directory-traversal-issu.patch +++ /dev/null | |||
@@ -1,63 +0,0 @@ | |||
1 | From 9dcead87e6d7f66d34e7a56d11a30daca367dffb Mon Sep 17 00:00:00 2001 | ||
2 | From: "Dmitry V. Levin" <ldv@altlinux.org> | ||
3 | Date: Wed, 26 Mar 2014 22:17:23 +0000 | ||
4 | Subject: [PATCH] pam_timestamp: fix potential directory traversal issue | ||
5 | (ticket #27) | ||
6 | |||
7 | commit 9dcead87e6d7f66d34e7a56d11a30daca367dffb upstream | ||
8 | |||
9 | pam_timestamp uses values of PAM_RUSER and PAM_TTY as components of | ||
10 | the timestamp pathname it creates, so extra care should be taken to | ||
11 | avoid potential directory traversal issues. | ||
12 | |||
13 | * modules/pam_timestamp/pam_timestamp.c (check_tty): Treat | ||
14 | "." and ".." tty values as invalid. | ||
15 | (get_ruser): Treat "." and ".." ruser values, as well as any ruser | ||
16 | value containing '/', as invalid. | ||
17 | |||
18 | Fixes CVE-2014-2583. | ||
19 | |||
20 | Reported-by: Sebastian Krahmer <krahmer@suse.de> | ||
21 | |||
22 | Upstream-Status: Backport | ||
23 | |||
24 | Signed-off-by: Yue Tao <Yue.Tao@windriver.com> | ||
25 | Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> | ||
26 | --- | ||
27 | modules/pam_timestamp/pam_timestamp.c | 13 ++++++++++++- | ||
28 | 1 files changed, 12 insertions(+), 1 deletions(-) | ||
29 | |||
30 | diff --git a/modules/pam_timestamp/pam_timestamp.c b/modules/pam_timestamp/pam_timestamp.c | ||
31 | index 5193733..b3f08b1 100644 | ||
32 | --- a/modules/pam_timestamp/pam_timestamp.c | ||
33 | +++ b/modules/pam_timestamp/pam_timestamp.c | ||
34 | @@ -158,7 +158,7 @@ check_tty(const char *tty) | ||
35 | tty = strrchr(tty, '/') + 1; | ||
36 | } | ||
37 | /* Make sure the tty wasn't actually a directory (no basename). */ | ||
38 | - if (strlen(tty) == 0) { | ||
39 | + if (!strlen(tty) || !strcmp(tty, ".") || !strcmp(tty, "..")) { | ||
40 | return NULL; | ||
41 | } | ||
42 | return tty; | ||
43 | @@ -243,6 +243,17 @@ get_ruser(pam_handle_t *pamh, char *ruserbuf, size_t ruserbuflen) | ||
44 | if (pwd != NULL) { | ||
45 | ruser = pwd->pw_name; | ||
46 | } | ||
47 | + } else { | ||
48 | + /* | ||
49 | + * This ruser is used by format_timestamp_name as a component | ||
50 | + * of constructed timestamp pathname, so ".", "..", and '/' | ||
51 | + * are disallowed to avoid potential path traversal issues. | ||
52 | + */ | ||
53 | + if (!strcmp(ruser, ".") || | ||
54 | + !strcmp(ruser, "..") || | ||
55 | + strchr(ruser, '/')) { | ||
56 | + ruser = NULL; | ||
57 | + } | ||
58 | } | ||
59 | if (ruser == NULL || strlen(ruser) >= ruserbuflen) { | ||
60 | *ruserbuf = '\0'; | ||
61 | -- | ||
62 | 1.7.5.4 | ||
63 | |||