summaryrefslogtreecommitdiffstats
path: root/meta
diff options
context:
space:
mode:
authorRoy Li <rongqing.li@windriver.com>2015-05-26 17:21:03 +0800
committerRichard Purdie <richard.purdie@linuxfoundation.org>2015-06-28 09:44:13 +0100
commitbf28314e59f6d3087f308885a2a49163cca56c40 (patch)
treeabd267dd32e3b2f661849b88b6a11264209cfeb7 /meta
parent7606fba211869b3032a90932d9956ffdcb6d945c (diff)
downloadpoky-bf28314e59f6d3087f308885a2a49163cca56c40.tar.gz
ppp: Security Advisory - CVE-2015-3310
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3310 Buffer overflow in the rc_mksid function in plugins/radius/util.c in Paul's PPP Package (ppp) 2.4.6 and earlier, when the PID for pppd is greater than 65535, allows remote attackers to cause a denial of service (crash) via a start accounting message to the RADIUS server. oe-core is using ppp 2.4.7, and this CVE say ppp 2.4.7 was not effected, but I found this buggy codes are same between 2.4.6 and 2.4.7, and 2.4.7 should have this issue. (From OE-Core rev: 5b549c6d73e91fdbd0b618a752d618deb1449ef9) (From OE-Core rev: 5450caccd45a2ee35ee227cdd64e66a304909a0e) Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta')
-rw-r--r--meta/recipes-connectivity/ppp/ppp/fix-CVE-2015-3310.patch29
-rw-r--r--meta/recipes-connectivity/ppp/ppp_2.4.7.bb1
2 files changed, 30 insertions, 0 deletions
diff --git a/meta/recipes-connectivity/ppp/ppp/fix-CVE-2015-3310.patch b/meta/recipes-connectivity/ppp/ppp/fix-CVE-2015-3310.patch
new file mode 100644
index 0000000000..c9edb30597
--- /dev/null
+++ b/meta/recipes-connectivity/ppp/ppp/fix-CVE-2015-3310.patch
@@ -0,0 +1,29 @@
1ppp: Buffer overflow in radius plugin
2
3From: https://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;bug=782450
4
5Upstream-Status: Backport
6
7On systems with more than 65535 processes running, pppd aborts when
8sending a "start" accounting message to the RADIUS server because of a
9buffer overflow in rc_mksid.
10
11The process id is used in rc_mksid to generate a pseudo-unique string,
12assuming that the hex representation of the pid will be at most 4
13characters (FFFF). __sprintf_chk(), used when compiling with
14optimization levels greater than 0 and FORTIFY_SOURCE, detects the
15buffer overflow and makes pppd crash.
16
17The following patch fixes the problem.
18
19--- ppp-2.4.6.orig/pppd/plugins/radius/util.c
20+++ ppp-2.4.6/pppd/plugins/radius/util.c
21@@ -77,7 +77,7 @@ rc_mksid (void)
22 static unsigned short int cnt = 0;
23 sprintf (buf, "%08lX%04X%02hX",
24 (unsigned long int) time (NULL),
25- (unsigned int) getpid (),
26+ (unsigned int) getpid () % 65535,
27 cnt & 0xFF);
28 cnt++;
29 return buf;
diff --git a/meta/recipes-connectivity/ppp/ppp_2.4.7.bb b/meta/recipes-connectivity/ppp/ppp_2.4.7.bb
index 4219d45591..adc38e10b4 100644
--- a/meta/recipes-connectivity/ppp/ppp_2.4.7.bb
+++ b/meta/recipes-connectivity/ppp/ppp_2.4.7.bb
@@ -29,6 +29,7 @@ SRC_URI = "http://ppp.samba.org/ftp/ppp/ppp-${PV}.tar.gz \
29 file://provider \ 29 file://provider \
30 file://0001-ppp-Fix-compilation-errors-in-Makefile.patch \ 30 file://0001-ppp-Fix-compilation-errors-in-Makefile.patch \
31 file://ppp@.service \ 31 file://ppp@.service \
32 file://fix-CVE-2015-3310.patch \
32" 33"
33 34
34SRC_URI[md5sum] = "78818f40e6d33a1d1de68a1551f6595a" 35SRC_URI[md5sum] = "78818f40e6d33a1d1de68a1551f6595a"