rpms/cups
5
0
Fork 0
Code Issues Pull Requests Releases Activity

- Accept "Host: ::1" (bug #497393).

Browse Source 
- Accept Host: fields set to the ServerName value (bug #497301).
This commit is contained in:
Tim Waugh 2009-04-26 12:58:48 +00:00
parent 015b26e5e7
commit 30b0cd29ff
2 changed files with 74 additions and 67 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

65
cups-CVE-2009-0164.patch
View File

@ -1,6 +1,6 @@
diff -up cups-1.4b2-svn8404/CHANGES-1.3.txt.CVE-2009-0164 cups-1.4b2-svn8404/CHANGES-1.3.txt diff -up cups-1.4b2-svn8404/CHANGES-1.3.txt.CVE-2009-0164 cups-1.4b2-svn8404/CHANGES-1.3.txt
--- cups-1.4b2-svn8404/CHANGES-1.3.txt.CVE-2009-0164 2009-03-05 10:54:00.000000000 +0000 --- cups-1.4b2-svn8404/CHANGES-1.3.txt.CVE-2009-0164 2009-03-05 10:54:00.000000000 +0000
+++ cups-1.4b2-svn8404/CHANGES-1.3.txt 2009-04-17 16:47:18.000000000 +0100 +++ cups-1.4b2-svn8404/CHANGES-1.3.txt 2009-04-26 13:22:11.000000000 +0100
@@ -69,11 +69,6 @@ CHANGES IN CUPS V1.3.10 @@ -69,11 +69,6 @@ CHANGES IN CUPS V1.3.10
- The scheduler now rejects ATTR: messages with empty values. - The scheduler now rejects ATTR: messages with empty values.
- The scheduler could consume all CPU handling closed connections - The scheduler could consume all CPU handling closed connections
@ -15,7 +15,7 @@ diff -up cups-1.4b2-svn8404/CHANGES-1.3.txt.CVE-2009-0164 cups-1.4b2-svn8404/CHA
- The Epson sample driver PPDs contained errors (STR #2979) - The Epson sample driver PPDs contained errors (STR #2979)
diff -up cups-1.4b2-svn8404/cups/http-addr.c.CVE-2009-0164 cups-1.4b2-svn8404/cups/http-addr.c diff -up cups-1.4b2-svn8404/cups/http-addr.c.CVE-2009-0164 cups-1.4b2-svn8404/cups/http-addr.c
--- cups-1.4b2-svn8404/cups/http-addr.c.CVE-2009-0164 2009-02-17 17:45:27.000000000 +0000 --- cups-1.4b2-svn8404/cups/http-addr.c.CVE-2009-0164 2009-02-17 17:45:27.000000000 +0000
+++ cups-1.4b2-svn8404/cups/http-addr.c 2009-04-17 16:47:18.000000000 +0100 +++ cups-1.4b2-svn8404/cups/http-addr.c 2009-04-26 13:22:11.000000000 +0100
@@ -154,7 +154,7 @@ httpAddrLocalhost( @@ -154,7 +154,7 @@ httpAddrLocalhost(
#endif /* AF_LOCAL */ #endif /* AF_LOCAL */
@ -26,8 +26,8 @@ diff -up cups-1.4b2-svn8404/cups/http-addr.c.CVE-2009-0164 cups-1.4b2-svn8404/cu
return (0); return (0);
diff -up cups-1.4b2-svn8404/cups/http.c.CVE-2009-0164 cups-1.4b2-svn8404/cups/http.c diff -up cups-1.4b2-svn8404/cups/http.c.CVE-2009-0164 cups-1.4b2-svn8404/cups/http.c
--- cups-1.4b2-svn8404/cups/http.c.CVE-2009-0164 2009-04-17 16:47:18.000000000 +0100 --- cups-1.4b2-svn8404/cups/http.c.CVE-2009-0164 2009-04-26 13:22:11.000000000 +0100
+++ cups-1.4b2-svn8404/cups/http.c 2009-04-17 16:47:18.000000000 +0100 +++ cups-1.4b2-svn8404/cups/http.c 2009-04-26 13:22:11.000000000 +0100
@@ -1842,18 +1842,35 @@ httpSetField(http_t *http, /* I - @@ -1842,18 +1842,35 @@ httpSetField(http_t *http, /* I -
strlcpy(http->fields[field], value, HTTP_MAX_VALUE); strlcpy(http->fields[field], value, HTTP_MAX_VALUE);
@ -71,7 +71,7 @@ diff -up cups-1.4b2-svn8404/cups/http.c.CVE-2009-0164 cups-1.4b2-svn8404/cups/ht
diff -up cups-1.4b2-svn8404/man/cupsd.conf.man.in.CVE-2009-0164 cups-1.4b2-svn8404/man/cupsd.conf.man.in diff -up cups-1.4b2-svn8404/man/cupsd.conf.man.in.CVE-2009-0164 cups-1.4b2-svn8404/man/cupsd.conf.man.in
--- cups-1.4b2-svn8404/man/cupsd.conf.man.in.CVE-2009-0164 2009-02-17 17:45:27.000000000 +0000 --- cups-1.4b2-svn8404/man/cupsd.conf.man.in.CVE-2009-0164 2009-02-17 17:45:27.000000000 +0000
+++ cups-1.4b2-svn8404/man/cupsd.conf.man.in 2009-04-17 16:47:18.000000000 +0100 +++ cups-1.4b2-svn8404/man/cupsd.conf.man.in 2009-04-26 13:22:11.000000000 +0100
@@ -617,6 +617,11 @@ ServerAdmin user@domain.com @@ -617,6 +617,11 @@ ServerAdmin user@domain.com
.br .br
Specifies the email address of the server administrator. Specifies the email address of the server administrator.
@ -86,7 +86,7 @@ diff -up cups-1.4b2-svn8404/man/cupsd.conf.man.in.CVE-2009-0164 cups-1.4b2-svn84
Specifies the directory where backends, CGIs, daemons, and filters may Specifies the directory where backends, CGIs, daemons, and filters may
diff -up cups-1.4b2-svn8404/scheduler/client.c.CVE-2009-0164 cups-1.4b2-svn8404/scheduler/client.c diff -up cups-1.4b2-svn8404/scheduler/client.c.CVE-2009-0164 cups-1.4b2-svn8404/scheduler/client.c
--- cups-1.4b2-svn8404/scheduler/client.c.CVE-2009-0164 2009-03-05 10:54:00.000000000 +0000 --- cups-1.4b2-svn8404/scheduler/client.c.CVE-2009-0164 2009-03-05 10:54:00.000000000 +0000
+++ cups-1.4b2-svn8404/scheduler/client.c 2009-04-17 16:47:48.000000000 +0100 +++ cups-1.4b2-svn8404/scheduler/client.c 2009-04-26 13:38:34.000000000 +0100
@@ -39,6 +39,7 @@ @@ -39,6 +39,7 @@
* is_path_absolute() - Is a path absolute and free of relative elements. * is_path_absolute() - Is a path absolute and free of relative elements.
* make_certificate() - Make a self-signed SSL/TLS certificate. * make_certificate() - Make a self-signed SSL/TLS certificate.
@ -138,7 +138,7 @@ diff -up cups-1.4b2-svn8404/scheduler/client.c.CVE-2009-0164 cups-1.4b2-svn8404/
{ {
unlink(seedfile); unlink(seedfile);
return (0); return (0);
@@ -4862,6 +4862,165 @@ pipe_command(cupsd_client_t *con, /* I - @@ -4862,6 +4862,166 @@ pipe_command(cupsd_client_t *con, /* I -
/* /*
@ -174,7 +174,8 @@ diff -up cups-1.4b2-svn8404/scheduler/client.c.CVE-2009-0164 cups-1.4b2-svn8404/
+ !strcmp(host, "127.0.0.1") || + !strcmp(host, "127.0.0.1") ||
+ !strncmp(host, "127.0.0.1:", 10) || + !strncmp(host, "127.0.0.1:", 10) ||
+ !strcmp(host, "[::1]") || + !strcmp(host, "[::1]") ||
+ !strncmp(host, "[::1]:", 6)); + !strncmp(host, "[::1]:", 6) ||
+ !strcmp(host, "::1"));
+ } + }
+ +
+#ifdef HAVE_DNSSD +#ifdef HAVE_DNSSD
@ -305,8 +306,8 @@ diff -up cups-1.4b2-svn8404/scheduler/client.c.CVE-2009-0164 cups-1.4b2-svn8404/
*/ */
diff -up cups-1.4b2-svn8404/scheduler/conf.c.CVE-2009-0164 cups-1.4b2-svn8404/scheduler/conf.c diff -up cups-1.4b2-svn8404/scheduler/conf.c.CVE-2009-0164 cups-1.4b2-svn8404/scheduler/conf.c
--- cups-1.4b2-svn8404/scheduler/conf.c.CVE-2009-0164 2009-04-17 16:47:18.000000000 +0100 --- cups-1.4b2-svn8404/scheduler/conf.c.CVE-2009-0164 2009-04-26 13:22:11.000000000 +0100
+++ cups-1.4b2-svn8404/scheduler/conf.c 2009-04-17 16:47:18.000000000 +0100 +++ cups-1.4b2-svn8404/scheduler/conf.c 2009-04-26 13:43:59.000000000 +0100
@@ -14,13 +14,15 @@ @@ -14,13 +14,15 @@
* *
* Contents: * Contents:
@ -411,24 +412,23 @@ diff -up cups-1.4b2-svn8404/scheduler/conf.c.CVE-2009-0164 cups-1.4b2-svn8404/sc
{ {
cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to get hostname: %s", cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to get hostname: %s",
strerror(errno)); strerror(errno));
@@ -684,6 +731,50 @@ cupsdReadConfiguration(void) @@ -686,6 +733,54 @@ cupsdReadConfiguration(void)
cupsdSetString(&ServerName, temp);
} }
cupsdSetString(&ServerName, temp);
+
+ if (!ServerAlias) + if (!ServerAlias)
+ ServerAlias = cupsArrayNew(NULL, NULL); + ServerAlias = cupsArrayNew(NULL, NULL);
+ +
+ cupsdAddAlias(ServerAlias, temp); + cupsdAddAlias(ServerAlias, ServerName);
+ cupsdLogMessage(CUPSD_LOG_DEBUG, "Added auto ServerAlias %s", temp); + cupsdLogMessage(CUPSD_LOG_DEBUG, "Added auto ServerAlias %s", ServerName);
+ +
+ if (HostNameLookups || RemoteAccessEnabled) + if (HostNameLookups || RemoteAccessEnabled)
+ { + {
+ struct hostent *host; /* Host entry to get FQDN */ + struct hostent *host; /* Host entry to get FQDN */
+ +
+ if ((host = gethostbyname(temp)) != NULL) + if ((host = gethostbyname(ServerName)) != NULL)
+ { + {
+ if (strcasecmp(temp, host->h_name)) + if (strcasecmp(ServerName, host->h_name))
+ { + {
+ cupsdSetString(&ServerName, host->h_name); + cupsdSetString(&ServerName, host->h_name);
+ cupsdAddAlias(ServerAlias, host->h_name); + cupsdAddAlias(ServerAlias, host->h_name);
@ -439,7 +439,7 @@ diff -up cups-1.4b2-svn8404/scheduler/conf.c.CVE-2009-0164 cups-1.4b2-svn8404/sc
+ if (host->h_aliases) + if (host->h_aliases)
+ { + {
+ for (i = 0; host->h_aliases[i]; i ++) + for (i = 0; host->h_aliases[i]; i ++)
+ if (strcasecmp(temp, host->h_aliases[i])) + if (strcasecmp(ServerName, host->h_aliases[i]))
+ { + {
+ cupsdAddAlias(ServerAlias, host->h_aliases[i]); + cupsdAddAlias(ServerAlias, host->h_aliases[i]);
+ cupsdLogMessage(CUPSD_LOG_DEBUG, "Added auto ServerAlias %s", + cupsdLogMessage(CUPSD_LOG_DEBUG, "Added auto ServerAlias %s",
@ -453,16 +453,21 @@ diff -up cups-1.4b2-svn8404/scheduler/conf.c.CVE-2009-0164 cups-1.4b2-svn8404/sc
+ * Make sure we have the base hostname added as an alias, too! + * Make sure we have the base hostname added as an alias, too!
+ */ + */
+ +
+ if ((slash = strchr(temp, '.')) != NULL) + if ((slash = strchr(ServerName, '.')) != NULL)
+ { + {
+ *slash = '\0'; + size_t n = slash - ServerName;
+ if (n > sizeof(temp) - 1)
+ n = sizeof(temp) - 1;
+ memcpy (temp, ServerName, n);
+ temp[n] = '\0';
+ cupsdAddAlias(ServerAlias, temp); + cupsdAddAlias(ServerAlias, temp);
+ cupsdLogMessage(CUPSD_LOG_DEBUG, "Added auto ServerAlias %s", temp); + cupsdLogMessage(CUPSD_LOG_DEBUG, "Added auto ServerAlias %s", temp);
+ } + }
} +
for (slash = ServerName; isdigit(*slash & 255) || *slash == '.'; slash ++); for (slash = ServerName; isdigit(*slash & 255) || *slash == '.'; slash ++);
@@ -3278,6 +3369,13 @@ read_configuration(cups_file_t *fp) /* I
ServerNameIsIP = !*slash;
@@ -3278,6 +3373,13 @@ read_configuration(cups_file_t *fp) /* I
break; break;
} }
} }
@ -477,8 +482,8 @@ diff -up cups-1.4b2-svn8404/scheduler/conf.c.CVE-2009-0164 cups-1.4b2-svn8404/sc
{ {
/* /*
diff -up cups-1.4b2-svn8404/scheduler/conf.h.CVE-2009-0164 cups-1.4b2-svn8404/scheduler/conf.h diff -up cups-1.4b2-svn8404/scheduler/conf.h.CVE-2009-0164 cups-1.4b2-svn8404/scheduler/conf.h
--- cups-1.4b2-svn8404/scheduler/conf.h.CVE-2009-0164 2009-04-17 16:47:18.000000000 +0100 --- cups-1.4b2-svn8404/scheduler/conf.h.CVE-2009-0164 2009-04-26 13:22:11.000000000 +0100
+++ cups-1.4b2-svn8404/scheduler/conf.h 2009-04-17 16:47:18.000000000 +0100 +++ cups-1.4b2-svn8404/scheduler/conf.h 2009-04-26 13:22:11.000000000 +0100
@@ -82,6 +82,17 @@ typedef enum @@ -82,6 +82,17 @@ typedef enum
@ -520,8 +525,8 @@ diff -up cups-1.4b2-svn8404/scheduler/conf.h.CVE-2009-0164 cups-1.4b2-svn8404/sc
#ifdef HAVE_GSSAPI #ifdef HAVE_GSSAPI
extern int cupsdLogGSSMessage(int level, int major_status, extern int cupsdLogGSSMessage(int level, int major_status,
diff -up cups-1.4b2-svn8404/scheduler/dirsvc.c.CVE-2009-0164 cups-1.4b2-svn8404/scheduler/dirsvc.c diff -up cups-1.4b2-svn8404/scheduler/dirsvc.c.CVE-2009-0164 cups-1.4b2-svn8404/scheduler/dirsvc.c
--- cups-1.4b2-svn8404/scheduler/dirsvc.c.CVE-2009-0164 2009-04-17 16:47:18.000000000 +0100 --- cups-1.4b2-svn8404/scheduler/dirsvc.c.CVE-2009-0164 2009-04-26 13:22:11.000000000 +0100
+++ cups-1.4b2-svn8404/scheduler/dirsvc.c 2009-04-17 16:47:18.000000000 +0100 +++ cups-1.4b2-svn8404/scheduler/dirsvc.c 2009-04-26 13:22:11.000000000 +0100
@@ -38,6 +38,7 @@ @@ -38,6 +38,7 @@
* cupsdUpdateLDAPBrowse() - Scan for new printers via LDAP... * cupsdUpdateLDAPBrowse() - Scan for new printers via LDAP...
* cupsdUpdateSLPBrowse() - Get browsing information via SLP. * cupsdUpdateSLPBrowse() - Get browsing information via SLP.
@ -582,7 +587,7 @@ diff -up cups-1.4b2-svn8404/scheduler/dirsvc.c.CVE-2009-0164 cups-1.4b2-svn8404/
*/ */
diff -up cups-1.4b2-svn8404/scheduler/dirsvc.h.CVE-2009-0164 cups-1.4b2-svn8404/scheduler/dirsvc.h diff -up cups-1.4b2-svn8404/scheduler/dirsvc.h.CVE-2009-0164 cups-1.4b2-svn8404/scheduler/dirsvc.h
--- cups-1.4b2-svn8404/scheduler/dirsvc.h.CVE-2009-0164 2009-02-17 17:45:27.000000000 +0000 --- cups-1.4b2-svn8404/scheduler/dirsvc.h.CVE-2009-0164 2009-02-17 17:45:27.000000000 +0000
+++ cups-1.4b2-svn8404/scheduler/dirsvc.h 2009-04-17 16:47:18.000000000 +0100 +++ cups-1.4b2-svn8404/scheduler/dirsvc.h 2009-04-26 13:22:11.000000000 +0100
@@ -4,7 +4,7 @@ @@ -4,7 +4,7 @@
* Directory services definitions for the Common UNIX Printing System * Directory services definitions for the Common UNIX Printing System
* (CUPS) scheduler. * (CUPS) scheduler.
@ -603,7 +608,7 @@ diff -up cups-1.4b2-svn8404/scheduler/dirsvc.h.CVE-2009-0164 cups-1.4b2-svn8404/
VAR cups_array_t *DNSSDPrinters VALUE(NULL); VAR cups_array_t *DNSSDPrinters VALUE(NULL);
diff -up cups-1.4b2-svn8404/scheduler/network.c.CVE-2009-0164 cups-1.4b2-svn8404/scheduler/network.c diff -up cups-1.4b2-svn8404/scheduler/network.c.CVE-2009-0164 cups-1.4b2-svn8404/scheduler/network.c
--- cups-1.4b2-svn8404/scheduler/network.c.CVE-2009-0164 2009-02-05 10:57:28.000000000 +0000 --- cups-1.4b2-svn8404/scheduler/network.c.CVE-2009-0164 2009-02-05 10:57:28.000000000 +0000
+++ cups-1.4b2-svn8404/scheduler/network.c 2009-04-17 16:47:18.000000000 +0100 +++ cups-1.4b2-svn8404/scheduler/network.c 2009-04-26 13:22:11.000000000 +0100
@@ -101,6 +101,7 @@ cupsdNetIFUpdate(void) @@ -101,6 +101,7 @@ cupsdNetIFUpdate(void)
struct ifaddrs *addrs, /* Interface address list */ struct ifaddrs *addrs, /* Interface address list */
*addr; /* Current interface address */ *addr; /* Current interface address */
@ -633,7 +638,7 @@ diff -up cups-1.4b2-svn8404/scheduler/network.c.CVE-2009-0164 cups-1.4b2-svn8404
if (addr->ifa_addr->sa_family == AF_INET) if (addr->ifa_addr->sa_family == AF_INET)
diff -up cups-1.4b2-svn8404/scheduler/network.h.CVE-2009-0164 cups-1.4b2-svn8404/scheduler/network.h diff -up cups-1.4b2-svn8404/scheduler/network.h.CVE-2009-0164 cups-1.4b2-svn8404/scheduler/network.h
--- cups-1.4b2-svn8404/scheduler/network.h.CVE-2009-0164 2008-12-03 15:39:53.000000000 +0000 --- cups-1.4b2-svn8404/scheduler/network.h.CVE-2009-0164 2008-12-03 15:39:53.000000000 +0000
+++ cups-1.4b2-svn8404/scheduler/network.h 2009-04-17 16:47:18.000000000 +0100 +++ cups-1.4b2-svn8404/scheduler/network.h 2009-04-26 13:22:11.000000000 +0100
@@ -4,7 +4,7 @@ @@ -4,7 +4,7 @@
* Network interface definitions for the Common UNIX Printing System * Network interface definitions for the Common UNIX Printing System
* (CUPS) scheduler. * (CUPS) scheduler.

6
cups.spec
View File

@ -8,7 +8,7 @@
Summary: Common Unix Printing System Summary: Common Unix Printing System
Name: cups Name: cups
Version: 1.4 Version: 1.4
Release: 0.%{pre}.14%{?dist} Release: 0.%{pre}.15%{?dist}
License: GPLv2 License: GPLv2
Group: System Environment/Daemons Group: System Environment/Daemons
Source: ftp://ftp.easysw.com/pub/cups/test//cups-%{version}%{?pre}%{?svn}-source.tar.bz2 Source: ftp://ftp.easysw.com/pub/cups/test//cups-%{version}%{?pre}%{?svn}-source.tar.bz2
@ -478,7 +478,9 @@ rm -rf $RPM_BUILD_ROOT
%{_libdir}/php/modules/*.so %{_libdir}/php/modules/*.so
%changelog %changelog
* Tue Apr 21 2009 Tim Waugh <twaugh@redhat.com> * Sun Apr 26 2009 Tim Waugh <twaugh@redhat.com> 1:1.4-0.b2.15
- Accept "Host: ::1" (bug #497393).
- Accept Host: fields set to the ServerName value (bug #497301).
- Specify that we want poppler's pdftops (not ghostscript) for the - Specify that we want poppler's pdftops (not ghostscript) for the
pdftops wrapper when calling configure. pdftops wrapper when calling configure.