sync/ports
1
0
Fork 0
mirror of https://git.freebsd.org/ports.git synced 2025-05-30 01:46:55 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix ssh injection vulnerability from CVE-2017-12836

Browse source 
Details:
- Adopt patch from debian, documented in
  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=871810#10

PR:		226088
Submitted by:	fk@fabiankeil.de
MFH:		2018Q1
Security:	CVE-2017-12836
This commit is contained in:
Thomas Zander 2018-02-24 08:54:57 +00:00
parent 8e78ac8e67
commit 2e65b080e6
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=462776
2 changed files with 56 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
devel/cvs/Makefile
View file

@ -2,7 +2,7 @@
PORTNAME= cvs
PORTVERSION= 1.20120905
PORTREVISION?= 4
PORTREVISION?= 5
CATEGORIES= devel
MASTER_SITES= LOCAL/eadler

55
devel/cvs/files/patch-src-client.c Normal file
View file

@ -0,0 +1,55 @@
From 9c448da8bb5f592ddcd2d980d01d81305f920f78 Mon Sep 17 00:00:00 2001
From: Fabian Keil <fk@fabiankeil.de>
Date: Mon, 21 Aug 2017 10:49:05 +0200
Subject: [PATCH] Add fix for CVE-2017-12836
Based on a patch by Thorsten Glaser:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=871810#10
The patched file had to be changed and in the first
chunk the size of rsh_argv has been extended to 16
to match Debian's upstream version.
---
cvs/src/client.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git cvs/src/client.c cvs/src/client.c
index c9fe170..09771ce 100644
--- src/client.c
+++ src/client.c
@@ -4736,9 +4736,10 @@ start_rsh_server (root, to_server, from_server)
char *cvs_rsh;
char *cvs_server = getenv ("CVS_SERVER");
int i = 0;
- /* This needs to fit "rsh", "-b", "-l", "USER", "host",
- "cmd (w/ args)", and NULL. We leave some room to grow. */
- char *rsh_argv[10];
+ /* This needs to fit "rsh", "-b", "-l", "USER", "-p", port,
+ "--", "host", "cvs", "-R", "server", and NULL.
+ We leave some room to grow. */
+ char *rsh_argv[16];
if (root->method == extssh_method)
cvs_rsh = env_cvs_ssh ? env_cvs_ssh : SSH_DFLT;
@@ -4763,6 +4764,9 @@ start_rsh_server (root, to_server, from_server)
rsh_argv[i++] = root->username;
}
+ /* Only non-option arguments from here. (CVE-2017-12836) */
+ rsh_argv[i++] = "--";
+
rsh_argv[i++] = root->hostname;
rsh_argv[i++] = cvs_server;
rsh_argv[i++] = "server";
@@ -4841,6 +4845,8 @@ start_rsh_server (root, to_server, from_server)
*p++ = root->username;
}
+ *p++ = "--";
+
*p++ = root->hostname;
*p++ = command;
*p++ = NULL;
--
2.14.1