From 4501b5f9f001794ca87849f240d4af149b6f1b15 Mon Sep 17 00:00:00 2001 From: Lars Wendler Date: Mon, 2 Mar 2020 14:59:31 +0100 Subject: net-ftp/pure-ftpd: Security revbump for CVE-2020-9365 Bug: https://bugs.gentoo.org/711124 Package-Manager: Portage-2.3.91, Repoman-2.3.20 Signed-off-by: Lars Wendler --- ...d-1.0.49-diraliases_uninitialized_pointer.patch | 31 +++++ .../pure-ftpd-1.0.49-pure_strcmp_OOB_read.patch | 27 ++++ net-ftp/pure-ftpd/pure-ftpd-1.0.49-r2.ebuild | 152 +++++++++++++++++++++ 3 files changed, 210 insertions(+) create mode 100644 net-ftp/pure-ftpd/files/pure-ftpd-1.0.49-diraliases_uninitialized_pointer.patch create mode 100644 net-ftp/pure-ftpd/files/pure-ftpd-1.0.49-pure_strcmp_OOB_read.patch create mode 100644 net-ftp/pure-ftpd/pure-ftpd-1.0.49-r2.ebuild (limited to 'net-ftp') diff --git a/net-ftp/pure-ftpd/files/pure-ftpd-1.0.49-diraliases_uninitialized_pointer.patch b/net-ftp/pure-ftpd/files/pure-ftpd-1.0.49-diraliases_uninitialized_pointer.patch new file mode 100644 index 000000000000..7e29934caf5d --- /dev/null +++ b/net-ftp/pure-ftpd/files/pure-ftpd-1.0.49-diraliases_uninitialized_pointer.patch @@ -0,0 +1,31 @@ +From 8d0d42542e2cb7a56d645fbe4d0ef436e38bcefa Mon Sep 17 00:00:00 2001 +From: Frank Denis +Date: Tue, 18 Feb 2020 18:36:58 +0100 +Subject: [PATCH] diraliases: always set the tail of the list to NULL + +Spotted and reported by Antonio Norales from GitHub Security Labs. +Thanks! +--- + src/diraliases.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/diraliases.c b/src/diraliases.c +index 4002a36..fb70273 100644 +--- a/src/diraliases.c ++++ b/src/diraliases.c +@@ -93,7 +93,6 @@ int init_aliases(void) + (tail->dir = strdup(dir)) == NULL) { + die_mem(); + } +- tail->next = NULL; + } else { + DirAlias *curr; + +@@ -105,6 +104,7 @@ int init_aliases(void) + tail->next = curr; + tail = curr; + } ++ tail->next = NULL; + } + fclose(fp); + aliases_up++; diff --git a/net-ftp/pure-ftpd/files/pure-ftpd-1.0.49-pure_strcmp_OOB_read.patch b/net-ftp/pure-ftpd/files/pure-ftpd-1.0.49-pure_strcmp_OOB_read.patch new file mode 100644 index 000000000000..4ed197e46d35 --- /dev/null +++ b/net-ftp/pure-ftpd/files/pure-ftpd-1.0.49-pure_strcmp_OOB_read.patch @@ -0,0 +1,27 @@ +From 36c6d268cb190282a2c17106acfd31863121b58e Mon Sep 17 00:00:00 2001 +From: Frank Denis +Date: Mon, 24 Feb 2020 15:19:43 +0100 +Subject: [PATCH] pure_strcmp(): len(s2) can be > len(s1) + +Reported by Antonio Morales from GitHub Security Labs, thanks! +--- + src/utils.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/src/utils.c b/src/utils.c +index f41492d..a7f0381 100644 +--- a/src/utils.c ++++ b/src/utils.c +@@ -45,5 +45,11 @@ int pure_memcmp(const void * const b1_, const void * const b2_, size_t len) + + int pure_strcmp(const char * const s1, const char * const s2) + { +- return pure_memcmp(s1, s2, strlen(s1) + 1U); ++ const size_t s1_len = strlen(s1); ++ const size_t s2_len = strlen(s2); ++ ++ if (s1_len != s2_len) { ++ return -1; ++ } ++ return pure_memcmp(s1, s2, s1_len); + } diff --git a/net-ftp/pure-ftpd/pure-ftpd-1.0.49-r2.ebuild b/net-ftp/pure-ftpd/pure-ftpd-1.0.49-r2.ebuild new file mode 100644 index 000000000000..9ca535572cfc --- /dev/null +++ b/net-ftp/pure-ftpd/pure-ftpd-1.0.49-r2.ebuild @@ -0,0 +1,152 @@ +# Copyright 1999-2020 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=7 + +inherit flag-o-matic + +DESCRIPTION="Fast, production-quality, standard-conformant FTP server" +HOMEPAGE="http://www.pureftpd.org/" +if [[ "${PV}" == 9999 ]] ; then + inherit autotools git-r3 + EGIT_REPO_URI="https://github.com/jedisct1/pure-ftpd.git" +else + SRC_URI="ftp://ftp.pureftpd.org/pub/${PN}/releases/${P}.tar.bz2 + http://download.pureftpd.org/pub/${PN}/releases/${P}.tar.bz2" + KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~ppc ~ppc64 ~sparc ~x86" +fi + +LICENSE="BSD" +SLOT="0" + +IUSE="anondel anonperm anonren anonres caps implicittls ldap libressl mysql noiplog pam paranoidmsg postgres resolveids selinux ssl sysquota vchroot xinetd" + +REQUIRED_USE="implicittls? ( ssl )" + +DEPEND="caps? ( sys-libs/libcap ) + ldap? ( >=net-nds/openldap-2.0.25 ) + mysql? ( || ( + dev-db/mariadb-connector-c + dev-db/mysql-connector-c + ) ) + pam? ( sys-libs/pam ) + postgres? ( dev-db/postgresql:= ) + ssl? ( + !libressl? ( >=dev-libs/openssl-0.9.6g:0=[-bindist] ) + libressl? ( dev-libs/libressl:= ) + ) + sysquota? ( sys-fs/quota[-rpc] ) + xinetd? ( virtual/inetd )" + +RDEPEND="${DEPEND} + dev-libs/libsodium:= + net-ftp/ftpbase + selinux? ( sec-policy/selinux-ftp )" + +PATCHES=( + "${FILESDIR}/${PN}-1.0.28-pam.patch" + + # https://bugs.gentoo.org/711124 + "${FILESDIR}/${P}-diraliases_uninitialized_pointer.patch" + "${FILESDIR}/${P}-pure_strcmp_OOB_read.patch" +) + +src_prepare() { + default + [[ "${PV}" == 9999 ]] && eautoreconf +} + +src_configure() { + # adjust max user length to something more appropriate + # for virtual hosts. See bug #62472 for details. + sed -e "s:# define MAX_USER_LENGTH 32U:# define MAX_USER_LENGTH 127U:" \ + -i "${S}/src/ftpd.h" || die "sed failed" + + # Those features are only configurable like this, see bug #179375. + use anondel && append-cppflags -DANON_CAN_DELETE + use anonperm && append-cppflags -DANON_CAN_CHANGE_PERMS + use anonren && append-cppflags -DANON_CAN_RENAME + use anonres && append-cppflags -DANON_CAN_RESUME + use resolveids && append-cppflags -DALWAYS_RESOLVE_IDS + + # Do not auto-use SSP -- let the user select this. + export ax_cv_check_cflags___fstack_protector_all=no + + local myeconfargs=( + --enable-largefile + # Required for correct pid file location. + # pure-ftpd appends "/run/pure-ftpd.pid" to the localstatedir + # path, and tries to write to that file even when being + # started in foreground. So we need to pin this to / + --localstatedir="${EPREFIX}"/ + --with-altlog + --with-cookie + --with-diraliases + --with-extauth + --with-ftpwho + --with-language=${PUREFTPD_LANG:=english} + --with-peruserlimits + --with-privsep + --with-puredb + --with-quotas + --with-ratios + --with-throttling + --with-uploadscript + --with-virtualhosts + $(use_with ldap) + $(use_with mysql) + $(use_with pam) + $(use_with paranoidmsg) + $(use_with postgres pgsql) + $(use_with ssl tls) + $(use_with implicittls) + $(use_with vchroot virtualchroot) + $(use_with sysquota sysquotas) + $(usex caps '' '--without-capabilities') + $(usex noiplog '--without-iplogging' '') + $(usex xinetd '' '--without-inetd') + ) + econf "${myeconfargs[@]}" +} + +src_install() { + local DOCS=( AUTHORS ChangeLog FAQ HISTORY README* NEWS ) + + default + + newinitd "${FILESDIR}/pure-ftpd.rc11" ${PN} + newconfd "${FILESDIR}/pure-ftpd.conf_d-3" ${PN} + + if use implicittls ; then + sed -i '/^SERVER/s@21@990@' "${ED}"/etc/conf.d/${PN} \ + || die "Adjusting default server port for implicittls usage failed!" + fi + + keepdir /var/lib/run/${PN} + + if use xinetd ; then + insinto /etc/xinetd.d + newins "${FILESDIR}/pure-ftpd.xinetd" ${PN} + fi + + if use ldap ; then + insinto /etc/openldap/schema + doins pureftpd.schema + insinto /etc/openldap + insopts -m 0600 + doins pureftpd-ldap.conf + fi +} + +pkg_postinst() { + if [[ -z "${REPLACING_VERSIONS}" ]]; then + # This is a new installation + elog + elog "Before starting Pure-FTPd, you have to edit the /etc/conf.d/pure-ftpd file!" + elog + ewarn "It's *really* important to read the README provided with Pure-FTPd!" + ewarn "Check out http://download.pureftpd.org/pub/pure-ftpd/doc/README for general info" + ewarn "and http://download.pureftpd.org/pub/pure-ftpd/doc/README.TLS for SSL/TLS info." + ewarn + fi +} -- cgit v1.2.3-65-gdbad