fix CVE-2016-6318 - avoid overflows in GECOS handling and mangling password (#1364944)
This commit is contained in:
Tomas Mraz
parent
aff542331c
commit
345a730d45
144
cracklib-2.9.6-cve-2016-6318.patch
Normal file
144
cracklib-2.9.6-cve-2016-6318.patch
Normal file
@ -0,0 +1,144 @@
|
|||||||
|
diff -up cracklib-2.9.6/lib/fascist.c.overflow cracklib-2.9.6/lib/fascist.c
|
||||||
|
--- cracklib-2.9.6/lib/fascist.c.overflow 2015-10-23 16:58:38.403319225 +0200
|
||||||
|
+++ cracklib-2.9.6/lib/fascist.c 2016-12-08 17:28:41.490101358 +0100
|
||||||
|
@@ -515,7 +515,7 @@ FascistGecosUser(char *password, const c
|
||||||
|
char gbuffer[STRINGSIZE];
|
||||||
|
char tbuffer[STRINGSIZE];
|
||||||
|
char *uwords[STRINGSIZE];
|
||||||
|
- char longbuffer[STRINGSIZE * 2];
|
||||||
|
+ char longbuffer[STRINGSIZE];
|
||||||
|
|
||||||
|
if (gecos == NULL)
|
||||||
|
gecos = "";
|
||||||
|
@@ -596,38 +596,47 @@ FascistGecosUser(char *password, const c
|
||||||
|
{
|
||||||
|
for (i = 0; i < j; i++)
|
||||||
|
{
|
||||||
|
- strcpy(longbuffer, uwords[i]);
|
||||||
|
- strcat(longbuffer, uwords[j]);
|
||||||
|
-
|
||||||
|
- if (GTry(longbuffer, password))
|
||||||
|
+ if (strlen(uwords[i]) + strlen(uwords[j]) < STRINGSIZE)
|
||||||
|
{
|
||||||
|
- return _("it is derived from your password entry");
|
||||||
|
- }
|
||||||
|
-
|
||||||
|
- strcpy(longbuffer, uwords[j]);
|
||||||
|
- strcat(longbuffer, uwords[i]);
|
||||||
|
+ strcpy(longbuffer, uwords[i]);
|
||||||
|
+ strcat(longbuffer, uwords[j]);
|
||||||
|
|
||||||
|
- if (GTry(longbuffer, password))
|
||||||
|
- {
|
||||||
|
- return _("it's derived from your password entry");
|
||||||
|
+ if (GTry(longbuffer, password))
|
||||||
|
+ {
|
||||||
|
+ return _("it is derived from your password entry");
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ strcpy(longbuffer, uwords[j]);
|
||||||
|
+ strcat(longbuffer, uwords[i]);
|
||||||
|
+
|
||||||
|
+ if (GTry(longbuffer, password))
|
||||||
|
+ {
|
||||||
|
+ return _("it's derived from your password entry");
|
||||||
|
+ }
|
||||||
|
}
|
||||||
|
|
||||||
|
- longbuffer[0] = uwords[i][0];
|
||||||
|
- longbuffer[1] = '\0';
|
||||||
|
- strcat(longbuffer, uwords[j]);
|
||||||
|
-
|
||||||
|
- if (GTry(longbuffer, password))
|
||||||
|
+ if (strlen(uwords[j]) < STRINGSIZE - 1)
|
||||||
|
{
|
||||||
|
- return _("it is derivable from your password entry");
|
||||||
|
+ longbuffer[0] = uwords[i][0];
|
||||||
|
+ longbuffer[1] = '\0';
|
||||||
|
+ strcat(longbuffer, uwords[j]);
|
||||||
|
+
|
||||||
|
+ if (GTry(longbuffer, password))
|
||||||
|
+ {
|
||||||
|
+ return _("it is derivable from your password entry");
|
||||||
|
+ }
|
||||||
|
}
|
||||||
|
|
||||||
|
- longbuffer[0] = uwords[j][0];
|
||||||
|
- longbuffer[1] = '\0';
|
||||||
|
- strcat(longbuffer, uwords[i]);
|
||||||
|
-
|
||||||
|
- if (GTry(longbuffer, password))
|
||||||
|
+ if (strlen(uwords[i]) < STRINGSIZE - 1)
|
||||||
|
{
|
||||||
|
- return _("it's derivable from your password entry");
|
||||||
|
+ longbuffer[0] = uwords[j][0];
|
||||||
|
+ longbuffer[1] = '\0';
|
||||||
|
+ strcat(longbuffer, uwords[i]);
|
||||||
|
+
|
||||||
|
+ if (GTry(longbuffer, password))
|
||||||
|
+ {
|
||||||
|
+ return _("it's derivable from your password entry");
|
||||||
|
+ }
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
diff -up cracklib-2.9.6/lib/rules.c.overflow cracklib-2.9.6/lib/rules.c
|
||||||
|
--- cracklib-2.9.6/lib/rules.c.overflow 2015-10-23 16:58:38.000000000 +0200
|
||||||
|
+++ cracklib-2.9.6/lib/rules.c 2016-12-08 18:03:27.041941297 +0100
|
||||||
|
@@ -158,6 +158,8 @@ Pluralise(string, area) /* returns a po
|
||||||
|
register int length;
|
||||||
|
length = strlen(string);
|
||||||
|
strcpy(area, string);
|
||||||
|
+ if (length > STRINGSIZE - 3) /* we add 2 characters at worst */
|
||||||
|
+ return (area);
|
||||||
|
|
||||||
|
if (!Suffix(string, "ch") ||
|
||||||
|
!Suffix(string, "ex") ||
|
||||||
|
@@ -462,11 +464,11 @@ Mangle(input, control, area) /* returns
|
||||||
|
Pluralise(area2, area);
|
||||||
|
break;
|
||||||
|
case RULE_REFLECT:
|
||||||
|
- strcat(area, Reverse(area, area2));
|
||||||
|
+ strncat(area, Reverse(area, area2), STRINGSIZE - strlen(area) - 1);
|
||||||
|
break;
|
||||||
|
case RULE_DUPLICATE:
|
||||||
|
strcpy(area2, area);
|
||||||
|
- strcat(area, area2);
|
||||||
|
+ strncat(area, area2, STRINGSIZE - strlen(area) - 1);
|
||||||
|
break;
|
||||||
|
case RULE_GT:
|
||||||
|
if (!ptr[1])
|
||||||
|
@@ -514,7 +516,8 @@ Mangle(input, control, area) /* returns
|
||||||
|
} else
|
||||||
|
{
|
||||||
|
area2[0] = *(++ptr);
|
||||||
|
- strcpy(area2 + 1, area);
|
||||||
|
+ strncpy(area2 + 1, area, STRINGSIZE - 2);
|
||||||
|
+ area2[STRINGSIZE - 1] = '\0';
|
||||||
|
strcpy(area, area2);
|
||||||
|
}
|
||||||
|
break;
|
||||||
|
@@ -528,8 +531,10 @@ Mangle(input, control, area) /* returns
|
||||||
|
register char *string;
|
||||||
|
string = area;
|
||||||
|
while (*(string++));
|
||||||
|
- string[-1] = *(++ptr);
|
||||||
|
- *string = '\0';
|
||||||
|
+ if (string < area + STRINGSIZE) {
|
||||||
|
+ string[-1] = *(++ptr);
|
||||||
|
+ *string = '\0';
|
||||||
|
+ }
|
||||||
|
}
|
||||||
|
break;
|
||||||
|
case RULE_EXTRACT:
|
||||||
|
@@ -600,6 +605,10 @@ Mangle(input, control, area) /* returns
|
||||||
|
}
|
||||||
|
p1 = area;
|
||||||
|
p2 = area2;
|
||||||
|
+ if (strlen(p1) > STRINGSIZE - 2) {
|
||||||
|
+ /* truncate */
|
||||||
|
+ p1[STRINGSIZE - 2] = '\0';
|
||||||
|
+ }
|
||||||
|
while (i && *p1)
|
||||||
|
{
|
||||||
|
i--;
|
||||||
@ -5,7 +5,7 @@
|
|||||||
Summary: A password-checking library
|
Summary: A password-checking library
|
||||||
Name: cracklib
|
Name: cracklib
|
||||||
Version: 2.9.6
|
Version: 2.9.6
|
||||||
Release: 3%{?dist}
|
Release: 4%{?dist}
|
||||||
Group: System Environment/Libraries
|
Group: System Environment/Libraries
|
||||||
Source0: https://github.com/cracklib/cracklib/releases/download/cracklib-%{version}/cracklib-%{version}.tar.gz
|
Source0: https://github.com/cracklib/cracklib/releases/download/cracklib-%{version}/cracklib-%{version}.tar.gz
|
||||||
Source1: https://github.com/cracklib/cracklib/releases/download/cracklib-%{version}/cracklib-words-%{version}.gz
|
Source1: https://github.com/cracklib/cracklib/releases/download/cracklib-%{version}/cracklib-words-%{version}.gz
|
||||||
@ -25,6 +25,7 @@ Patch2: cracklib-2.9.0-python-gzdicts.patch
|
|||||||
Patch4: cracklib-2.9.6-packlib-reentrant.patch
|
Patch4: cracklib-2.9.6-packlib-reentrant.patch
|
||||||
Patch6: cracklib-2.9.6-simplistic.patch
|
Patch6: cracklib-2.9.6-simplistic.patch
|
||||||
Patch7: cracklib-2.9.6-translation-updates.patch
|
Patch7: cracklib-2.9.6-translation-updates.patch
|
||||||
|
Patch8: cracklib-2.9.6-cve-2016-6318.patch
|
||||||
URL: http://sourceforge.net/projects/cracklib/
|
URL: http://sourceforge.net/projects/cracklib/
|
||||||
License: LGPLv2+
|
License: LGPLv2+
|
||||||
Buildroot: %{_tmppath}/%{name}-%{version}-root
|
Buildroot: %{_tmppath}/%{name}-%{version}-root
|
||||||
@ -97,6 +98,7 @@ install -p -m 644 %{SOURCE3} po/zh_CN.po
|
|||||||
%patch4 -p1 -b .reentrant
|
%patch4 -p1 -b .reentrant
|
||||||
%patch6 -p1 -b .simplistic
|
%patch6 -p1 -b .simplistic
|
||||||
%patch7 -p1 -b .translations
|
%patch7 -p1 -b .translations
|
||||||
|
%patch8 -p1 -b .overflow
|
||||||
|
|
||||||
mkdir cracklib-dicts
|
mkdir cracklib-dicts
|
||||||
for dict in %{SOURCE10} %{SOURCE1}
|
for dict in %{SOURCE10} %{SOURCE1}
|
||||||
@ -219,6 +221,9 @@ EOF
|
|||||||
%{_libdir}/python*/site-packages/*.py*
|
%{_libdir}/python*/site-packages/*.py*
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Thu Dec 8 2016 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.9.6-4
|
||||||
|
- fix CVE-2016-6318 - avoid overflows in GECOS handling and mangling password (#1364944)
|
||||||
|
|
||||||
* Tue Jul 19 2016 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.9.6-3
|
* Tue Jul 19 2016 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.9.6-3
|
||||||
- https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages
|
- https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages
|
||||||
|
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user