pkgsrc-Changes-HG archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
[pkgsrc/trunk]: pkgsrc/chat/gaim 12 vulnerabilities were found in the instant...
details: https://anonhg.NetBSD.org/pkgsrc/rev/968cf29e30e5
branches: trunk
changeset: 467213:968cf29e30e5
user: recht <recht%pkgsrc.org@localhost>
date: Tue Jan 27 01:24:51 2004 +0000
description:
12 vulnerabilities were found in the instant messenger GAIM that allow remote compromise.
The 12 identified problems range from simple standard stack overflows, over heap overflows to an integer overflow that can be abused to cause a heap overflow. Due to the nature of instant messaging
some of these bugs require man-in-the-middle attacks between client and server. But the underlying protocols are easy to implement and MIM attacks on ordinary TCP sessions is afairly simple task.
Please see http://security.e-matters.de/advisories/012004.html
for more details.
Apply the fix posted in that advisory (originally by the FreeBSD security
team) and bump PKGREVISION to 1.
diffstat:
chat/gaim/Makefile | 3 +-
chat/gaim/distinfo | 5 +-
chat/gaim/patches/patch-aa | 2 +-
chat/gaim/patches/patch-ab | 176 +++++++++++++++++++++++++++++++++++++++++++++
chat/gaim/patches/patch-ac | 13 +++
chat/gaim/patches/patch-ad | 136 ++++++++++++++++++++++++++++++++++
6 files changed, 332 insertions(+), 3 deletions(-)
diffs (truncated from 372 to 300 lines):
diff -r 0b51e45babe8 -r 968cf29e30e5 chat/gaim/Makefile
--- a/chat/gaim/Makefile Tue Jan 27 00:53:10 2004 +0000
+++ b/chat/gaim/Makefile Tue Jan 27 01:24:51 2004 +0000
@@ -1,7 +1,8 @@
-# $NetBSD: Makefile,v 1.50 2004/01/22 07:49:20 grant Exp $
+# $NetBSD: Makefile,v 1.51 2004/01/27 01:24:51 recht Exp $
#
DISTNAME= gaim-0.75
+PKGREVISION= 1
CATEGORIES= chat x11
MASTER_SITES= ${MASTER_SITE_SOURCEFORGE:=gaim/}
EXTRACT_SUFX= .tar.bz2
diff -r 0b51e45babe8 -r 968cf29e30e5 chat/gaim/distinfo
--- a/chat/gaim/distinfo Tue Jan 27 00:53:10 2004 +0000
+++ b/chat/gaim/distinfo Tue Jan 27 01:24:51 2004 +0000
@@ -1,5 +1,8 @@
-$NetBSD: distinfo,v 1.37 2004/01/11 20:54:07 jmmv Exp $
+$NetBSD: distinfo,v 1.38 2004/01/27 01:24:52 recht Exp $
SHA1 (gaim-0.75.tar.bz2) = 20a7ccadf276d9db6b74ae3d07d90601d805a4a9
Size (gaim-0.75.tar.bz2) = 3370977 bytes
SHA1 (patch-aa) = 90d7bbc5c9ab5c6ffeba30a6c782e66cb1e3d861
+SHA1 (patch-ab) = aff902959e96d00c0712ac88b235aa918ba082d6
+SHA1 (patch-ac) = 803423543063b5838139dfad4c80172d6bfb4d70
+SHA1 (patch-ad) = 02f5d4d7b6cf2bc49043eba09b079ce2530552dc
diff -r 0b51e45babe8 -r 968cf29e30e5 chat/gaim/patches/patch-aa
--- a/chat/gaim/patches/patch-aa Tue Jan 27 00:53:10 2004 +0000
+++ b/chat/gaim/patches/patch-aa Tue Jan 27 01:24:51 2004 +0000
@@ -1,4 +1,4 @@
-$NetBSD: patch-aa,v 1.16 2004/01/11 20:54:08 jmmv Exp $
+$NetBSD: patch-aa,v 1.17 2004/01/27 01:24:52 recht Exp $
--- src/protocols/oscar/ft.c.orig 2004-01-05 02:34:04.000000000 +0100
+++ src/protocols/oscar/ft.c
diff -r 0b51e45babe8 -r 968cf29e30e5 chat/gaim/patches/patch-ab
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/chat/gaim/patches/patch-ab Tue Jan 27 01:24:51 2004 +0000
@@ -0,0 +1,176 @@
+$NetBSD: patch-ab,v 1.6 2004/01/27 01:24:52 recht Exp $
+
+--- src/protocols/yahoo/yahoo.c.orig 2004-01-10 06:04:09.000000000 +0100
++++ src/protocols/yahoo/yahoo.c
+@@ -20,6 +20,7 @@
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ *
+ */
++#include <limits.h>
+ #include "internal.h"
+
+ #include "account.h"
+@@ -131,8 +132,15 @@ static void yahoo_packet_read(struct yah
+ while (pos + 1 < len) {
+ if (data[pos] == 0xc0 && data[pos + 1] == 0x80)
+ break;
++ if (x >= sizeof(key)-1) {
++ x++;
++ continue;
++
++ }
+ key[x++] = data[pos++];
+ }
++ if (x >= sizeof(key)-1)
++ x = 0;
+ key[x] = 0;
+ pos += 2;
+ pair->key = strtol(key, NULL, 10);
+@@ -868,32 +876,66 @@ static void yahoo_process_contact(GaimCo
+ }
+ }
+
++
++static void octal(const char **p, const char *end, unsigned char *n)
++{
++ int i, c;
++
++ for (i = 0, c = 0; i < 3 && *p < end; ++i, ++*p) {
++ c <<= 3;
++ switch (**p) {
++ case '0': break;
++ case '1': c += 1; break;
++ case '2': c += 2; break;
++ case '3': c += 3; break;
++ case '4': c += 4; break;
++ case '5': c += 5; break;
++ case '6': c += 6; break;
++ case '7': c += 7; break;
++ default:
++ if (i == 0) {
++ *n = **p;
++ ++*p;
++ return;
++ }
++ c >>= 3;
++ goto done;
++ }
++ }
++done:
++ *n = (c > UCHAR_MAX) ? '?' : c;
++ return;
++}
++
+ #define OUT_CHARSET "utf-8"
+
+ static char *yahoo_decode(const char *text)
+ {
+ char *converted;
+- char *p, *n, *new;
+-
+- n = new = g_malloc(strlen (text) + 1);
+-
+- for (p = (char *)text; *p; p++, n++) {
++ unsigned char *n, *new;
++ size_t len;
++ const char *p, *end;
++
++ len = strlen (text);
++ p = text;
++ end = &text[len];
++ n = new = g_malloc(len + 1);
++ while (p < end) {
+ if (*p == '\\') {
+- sscanf(p + 1, "%3o\n", (int *)n);
+- p += 3;
+- }
+- else
+- *n = *p;
++ ++p;
++ octal(&p, end, n);
++ } else
++ *n = *p++;
++ ++n;
+ }
+-
+ *n = '\0';
+-
+ converted = g_convert(new, n - new, OUT_CHARSET, "iso-8859-1", NULL, NULL, NULL);
+ g_free(new);
+
+ return converted;
+ }
+
++
+ static void yahoo_process_mail(GaimConnection *gc, struct yahoo_packet *pkt)
+ {
+ GaimAccount *account = gaim_connection_get_account(gc);
+@@ -1903,32 +1945,30 @@ static void yahoo_got_web_connected(gpoi
+
+ static void yahoo_web_pending(gpointer data, gint source, GaimInputCondition cond)
+ {
++ static const char http302[] = "HTTP/1.0 302";
++ static const char setcookie[] = "Set-Cookie: ";
+ GaimConnection *gc = data;
+ GaimAccount *account = gaim_connection_get_account(gc);
+ struct yahoo_data *yd = gc->proto_data;
+- char buf[1024], buf2[256], *i = buf, *r = buf2;
+- int len, o = 0;
++ char buf[1024], *i = buf;
++ int len;
++ GString *s;
+
+ len = read(source, buf, sizeof(buf));
+- if (len <= 0 || strncmp(buf, "HTTP/1.0 302", strlen("HTTP/1.0 302"))) {
++ if (len <= 0 || (len >= sizeof(http302)-1 &&
++ memcmp(http302, buf, sizeof(http302)-1) != 0)) {
+ gaim_connection_error(gc, _("Unable to read"));
+ return;
+ }
+-
+- while ((i = strstr(i, "Set-Cookie: ")) && 0 < 2) {
+- i += strlen("Set-Cookie: ");
+- for (;*i != ';'; r++, i++) {
+- *r = *i;
+- }
+- *r=';';
+- r++;
+- *r=' ';
+- r++;
+- o++;
+- }
+- /* Get rid of that "; " */
+- *(r-2) = '\0';
+- yd->auth = g_strdup(buf2);
++ s = g_string_sized_new(len);
++ buf[len] = '\0';
++ while ((i = strstr(i, setcookie)) != NULL) {
++ i += sizeof(setcookie)-1;
++ for (;*i != ';'; i++)
++ g_string_append_c(s, *i);
++ g_string_append(s, "; ");
++ }
++ yd->auth = g_string_free(s, FALSE);
+ gaim_input_remove(gc->inpa);
+ close(source);
+ /* Now we have our cookies to login with. I'll go get the milk. */
+@@ -1974,15 +2014,17 @@ static GHashTable *yahoo_login_page_hash
+ const char *c = buf;
+ char *d;
+ char name[64], value[64];
++ int count = sizeof(name)-1;
+ while ((c < (buf + len)) && (c = strstr(c, "<input "))) {
+ c = strstr(c, "name=\"") + strlen("name=\"");
+- for (d = name; *c!='"'; c++, d++)
++ for (d = name; *c!='"' && count; c++, d++, count--)
+ *d = *c;
+ *d = '\0';
++ count = sizeof(value)-1;
+ d = strstr(c, "value=\"") + strlen("value=\"");
+ if (strchr(c, '>') < d)
+ break;
+- for (c = d, d = value; *c!='"'; c++, d++)
++ for (c = d, d = value; *c!='"' && count; c++, d++, count--)
+ *d = *c;
+ *d = '\0';
+ g_hash_table_insert(hash, g_strdup(name), g_strdup(value));
diff -r 0b51e45babe8 -r 968cf29e30e5 chat/gaim/patches/patch-ac
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/chat/gaim/patches/patch-ac Tue Jan 27 01:24:51 2004 +0000
@@ -0,0 +1,13 @@
+$NetBSD: patch-ac,v 1.5 2004/01/27 01:24:52 recht Exp $
+
+--- src/proxy.c.orig 2004-01-10 05:04:56.000000000 +0100
++++ src/proxy.c
+@@ -974,7 +974,7 @@ http_canread(gpointer data, gint source,
+
+ gaim_input_remove(phb->inpa);
+
+- while ((nlc != 2) && (read(source, &inputline[pos++], 1) == 1)) {
++ while ((pos < sizeof(inputline)-1) && (nlc != 2) && (read(source, &inputline[pos++], 1) == 1)) {
+ if (inputline[pos - 1] == '\n')
+ nlc++;
+ else if (inputline[pos - 1] != '\r')
diff -r 0b51e45babe8 -r 968cf29e30e5 chat/gaim/patches/patch-ad
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/chat/gaim/patches/patch-ad Tue Jan 27 01:24:51 2004 +0000
@@ -0,0 +1,136 @@
+$NetBSD: patch-ad,v 1.1 2004/01/27 01:24:52 recht Exp $
+
+--- src/util.c.orig 2004-01-10 05:04:56.000000000 +0100
++++ src/util.c
+@@ -247,24 +247,71 @@ gaim_base64_decode(const char *text, cha
+ /**************************************************************************
+ * Quoted Printable Functions
+ **************************************************************************/
+-void
+-gaim_quotedp_decode(const char *str, char **ret_str, int *ret_len)
++static void hex(const char **p, const char *end, unsigned char *n)
+ {
+- char *p, *n, *new;
++ int i, c;
+
+- n = new = g_malloc(strlen (str) + 1);
++ for (i = 0, c = 0; i < 2 && *p < end; ++i, ++*p) {
++ c <<= 4;
++ switch (**p) {
++ case '0': break;
++ case '1': c += 1; break;
++ case '2': c += 2; break;
++ case '3': c += 3; break;
++ case '4': c += 4; break;
++ case '5': c += 5; break;
++ case '6': c += 6; break;
++ case '7': c += 7; break;
++ case '8': c += 8; break;
++ case '9': c += 9; break;
++ case 'a': c += 10; break;
++ case 'b': c += 11; break;
++ case 'c': c += 12; break;
++ case 'd': c += 13; break;
++ case 'e': c += 14; break;
++ case 'f': c += 15; break;
++ case 'A': c += 10; break;
++ case 'B': c += 11; break;
++ case 'C': c += 12; break;
++ case 'D': c += 13; break;
++ case 'E': c += 14; break;
++ case 'F': c += 15; break;
++ default:
++ if (i == 0) {
++ *n = **p;
++ ++*p;
++ return;
++ }
++ c >>= 4;
++ goto done;
++ }
++ }
++done:
++ *n = (c > UCHAR_MAX) ? '?' : c;
++ return;
++}
+
+- for (p = (char *)str; *p; p++, n++) {
++void
++gaim_quotedp_decode(const char *str, char **ret_str, int *ret_len)
++{
++ const char *p, *end;
++ unsigned char *n, *new;
++ size_t len;
++
Home |
Main Index |
Thread Index |
Old Index