rpms/amanda
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import amanda-3.5.1-14.el8_7

Browse Source
This commit is contained in:
CentOS Sources 2023-03-28 09:36:05 +00:00 committed by root
parent 4c15aed382
commit e175176730
4 changed files with 314 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

102
SOURCES/amanda-3.5.2-CVE-2022-37704-fixup.patch Normal file
View File

@ -0,0 +1,102 @@
diff --git a/client-src/rundump.c b/client-src/rundump.c
index bba569984..85962d11c 100644
--- a/client-src/rundump.c
+++ b/client-src/rundump.c
@@ -43,6 +43,16 @@ int main(int argc, char **argv);
static void validate_dump_option(int argc, char ** argv);
static void validate_xfsdump_options(int argc, char ** argv);
+/*
+ * Has USE_RUNDUMP been explicitly requsted?
+ * If not, we will not use rundump for DUMP,
+ * although we sill may need to use it for
+ * VDUMP or XFSDUMP
+ */
+#if defined(USE_RUNDUMP)
+# define USE_RUNDUMP_FOR_DUMP
+#endif
+
#if defined(VDUMP) || defined(XFSDUMP)
# undef USE_RUNDUMP
# define USE_RUNDUMP
@@ -138,9 +148,10 @@ main(
#ifdef XFSDUMP
- if (g_str_equal(argv[0], "xfsdump"))
+ if (g_str_equal(argv[0], "xfsdump")) {
dump_program = XFSDUMP;
- else /* strcmp(argv[0], "xfsdump") != 0 */
+ validate_xfsdump_options(argc, argv);
+ } else /* strcmp(argv[0], "xfsdump") != 0 */
#endif
@@ -160,9 +171,14 @@ main(
#endif
+ {
#if defined(DUMP)
+# if defined(USE_RUNDUMP_FOR_DUMP)
dump_program = DUMP;
validate_dump_option(argc, argv);
+# else
+ error("error [%s not running %s : run it directly]\n", get_pname(), DUMP);
+# endif
#else
# if defined(XFSDUMP)
dump_program = XFSDUMP;
@@ -176,6 +192,7 @@ main(
# endif
# endif
#endif
+ }
/*
@@ -197,6 +214,24 @@ main(
amfree(cmdline);
env = safe_env();
+ //Filter or Discard RSH Environmental variable
+ int env_count = 0;
+ for (int i = 0; env[i] != NULL; i++){
+ env_count++;
+ }
+ for (int i = 0; i < env_count; i++){
+ if (strncmp(env[i], "RSH=", 4) == 0){
+ // Remove RSH
+ g_free(env[i]);
+ // move array elements one step left - which are after "RSH"
+ for (int j = i; j < env_count; j++){
+ env[j] = env[j + 1];
+ }
+ //decrease the variable count
+ env[env_count-1] = NULL;
+ break;
+ }
+ }
execve(dump_program, argv, env);
free_env(env);
diff --git a/client-src/runtar.c b/client-src/runtar.c
index 499c7dfec..880068bc4 100644
--- a/client-src/runtar.c
+++ b/client-src/runtar.c
@@ -191,9 +191,13 @@ main(
g_str_has_prefix(argv[i],"--newer") ||
g_str_has_prefix(argv[i],"--exclude-from") ||
g_str_has_prefix(argv[i],"--files-from")) {
- good_option++;
+ if (strchr(argv[i], '=')) {
+ good_option++;
+ } else {
+ /* Accept theses options with the following argument */
+ good_option += 2;
+ }
} else if (argv[i][0] != '-') {
- /* argument values are accounted for here */
good_option++;
}
}

175
SOURCES/amanda-3.5.2-CVE-2022-37704.patch Normal file
View File

@ -0,0 +1,175 @@
From e890d08e16ea0621966a7ae35cce53ccb44a472e Mon Sep 17 00:00:00 2001
From: seetharaman-rajagopal <seetharaman.chn@gmail.com>
Date: Mon, 13 Feb 2023 08:14:04 +0000
Subject: [PATCH] CVE-2022-37704 - privilege escaltion form amandabackup user
to root -fix
---
client-src/rundump.c | 135 +++++++++++++++++++++++++++++++++++++++++++
1 file changed, 135 insertions(+)
diff --git a/client-src/rundump.c b/client-src/rundump.c
index 0b354d70bf..bba5699847 100644
--- a/client-src/rundump.c
+++ b/client-src/rundump.c
@@ -40,6 +40,8 @@
#include "conffile.h"
int main(int argc, char **argv);
+static void validate_dump_option(int argc, char ** argv);
+static void validate_xfsdump_options(int argc, char ** argv);
#if defined(VDUMP) || defined(XFSDUMP)
# undef USE_RUNDUMP
@@ -160,14 +162,17 @@ main(
#if defined(DUMP)
dump_program = DUMP;
+ validate_dump_option(argc, argv);
#else
# if defined(XFSDUMP)
dump_program = XFSDUMP;
+ validate_xfsdump_options(argc, argv);
# else
# if defined(VXDUMP)
dump_program = VXDUMP;
# else
dump_program = "dump";
+ validate_dump_option(argc, argv);
# endif
# endif
#endif
@@ -203,3 +208,133 @@ main(
return 1;
#endif /* } */
}
+
+void validate_dump_option(int argc, char ** argv)
+{
+ int c;
+ int numargs = argc;
+ while (numargs > 0)
+ {
+ c = getopt(argc, argv, "0123456789ab:cd:e:f:h:j:kmnqs:uvwyz:A:B:D:I:L:MQ:ST:W");
+ switch (c) {
+ case -1:
+ optind++;
+ break;
+ case '?':
+ //option is not valid
+ error("error [%s invalid option: %s]\n", get_pname(), argv[optind-1]);
+ break;
+ // All this options takes another argument
+ case 'b':
+ case 'd':
+ case 'e':
+ case 'f':
+ case 'h':
+ case 'j':
+ case 's':
+ case 'z':
+ case 'A':
+ case 'B':
+ case 'D':
+ case 'I':
+ case 'L':
+ case 'Q':
+ case 'T':
+ {
+ // get optarg and check it against NULL. If it is null, then return error.
+ if (optarg == NULL) {
+ error ("error [%s additional parameter is missing for option: %c]\n", get_pname(), c);
+ }
+ break;
+ }
+ case '0':
+ case '1':
+ case '2':
+ case '3':
+ case '4':
+ case '5':
+ case '6':
+ case '7':
+ case '8':
+ case '9':
+ case 'a':
+ case 'c':
+ case 'k':
+ case 'm':
+ case 'n':
+ case 'q':
+ case 'u':
+ case 'v':
+ case 'w':
+ case 'y':
+ case 'M':
+ case 'S':
+ case 'W':
+ {
+ break;
+ }
+ default:
+ error ("error [%s invalid option: %c]\n", get_pname(), c);
+ break;
+ }
+ numargs--;
+ }
+}
+
+void validate_xfsdump_options(int argc, char ** argv)
+{
+ int c;
+ int numargs = argc;
+ while (numargs > 0)
+ {
+ c = getopt(argc, argv, "ab:d:ef:l:mop:qs:t:v:z:AB:DFI:JL:M:RT");
+ switch (c) {
+ case -1:
+ optind++;
+ break;
+ case '?':
+ //option is not valid
+ error ("error [%s invalid option: %s]\n", get_pname(), argv[optind-1]);
+ break;
+ // All this options takes another argument
+ case 'b':
+ case 'd':
+ case 'f':
+ case 'l':
+ case 'p':
+ case 's':
+ case 't':
+ case 'v':
+ case 'z':
+ case 'B':
+ case 'I':
+ case 'L':
+ case 'M':
+ {
+ // get optarg and check it against NULL. If it is null, then return error.
+ if (optarg == NULL) {
+ error ("error [%s additional parameter is missing for option: %c]\n", get_pname(), c);
+ }
+ break;
+ }
+ case 'a':
+ case 'e':
+ case 'm':
+ case 'o':
+ case 'q':
+ case 'A':
+ case 'D':
+ case 'F':
+ case 'J':
+ case 'R':
+ case 'T':
+ {
+ break;
+ }
+ default:
+ error ("error [%s invalid option: %c]\n", get_pname(), c);
+ break;
+ }
+ numargs--;
+ }
+}

26
SOURCES/amanda-3.5.2-CVE-2022-37705.patch Normal file
View File

@ -0,0 +1,26 @@
From ed37ddf8421e34a255eaedfc1e9c3a3f9d454b95 Mon Sep 17 00:00:00 2001
From: Prajwal T R <prajwaltr93@gmail.com>
Date: Thu, 22 Dec 2022 10:37:30 -0700
Subject: [PATCH] fix : fix increment logic for good_option
- for arguements of type --file=x or --file x, fixed logic while incrementing value.
---
client-src/runtar.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/client-src/runtar.c b/client-src/runtar.c
index d04a1385f6..499c7dfecb 100644
--- a/client-src/runtar.c
+++ b/client-src/runtar.c
@@ -191,9 +191,9 @@ main(
g_str_has_prefix(argv[i],"--newer") ||
g_str_has_prefix(argv[i],"--exclude-from") ||
g_str_has_prefix(argv[i],"--files-from")) {
- /* Accept theses options with the following argument */
- good_option += 2;
+ good_option++;
} else if (argv[i][0] != '-') {
+ /* argument values are accounted for here */
good_option++;
}
}

12
SPECS/amanda.spec
View File

@ -10,7 +10,7 @@
Summary: A network-capable tape backup solution
Name: amanda
Version: 3.5.1
Release: 13%{?dist}
Release: 14%{?dist}
Source: http://downloads.sourceforge.net/amanda/amanda-%{version}.tar.gz
Source1: amanda.crontab
Source4: disklist
@ -30,6 +30,9 @@ Patch3: amanda-3.2.0-config-dir.patch
Patch4: amanda-3.4.5-no-xinetd.patch
# Support tirpc
Patch5: patch-tirpc
Patch20: amanda-3.5.2-CVE-2022-37705.patch
Patch21: amanda-3.5.2-CVE-2022-37704.patch
Patch22: amanda-3.5.2-CVE-2022-37704-fixup.patch
License: BSD and GPLv3+ and GPLv2+ and GPLv2
URL: http://www.amanda.org
@ -432,6 +435,13 @@ make check
%changelog
* Mon Feb 27 2023 Pavel Cahyna <pcahyna@redhat.com> - 3.5.1-14
- Apply upstream patch for CVE-2022-37705
- Apply upstream patch for CVE-2022-37704
- Add my fixups for CVE-2022-37704 and CVE-2022-37705, the upstream changes broke
legitimate usage of xfsdump and tar, while leaving xfsdump and dump vulnerable.
One of the fixups submitted as PR205.
* Thu Aug 02 2018 Vaclav Dolezal <vdolezal@redhat.com> - 3.5.1-13
- fix permissions for log directory (#1572696)