rpm/openssh
SHA256
1
0
Fork 0
forked from pool/openssh
Code Pull Requests Activity

OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/openssh?expand=0&rev=10

Browse Source
This commit is contained in:
OBS User unknown 2007-09-13 16:53:57 +00:00 committed by Git OBS Bridge
parent 4ac6d8dbdc
commit f248bab6fd
4 changed files with 56 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

45
openssh-4.6p1-untrusted-cookie-CVE-2007-4752.diff Normal file
View File

@ -0,0 +1,45 @@
--- clientloop.c
+++ clientloop.c
@@ -290,19 +290,29 @@
generated = 1;
}
}
- snprintf(cmd, sizeof(cmd),
- "%s %s%s list %s 2>" _PATH_DEVNULL,
- xauth_path,
- generated ? "-f " : "" ,
- generated ? xauthfile : "",
- display);
- debug2("x11_get_proto: %s", cmd);
- f = popen(cmd, "r");
- if (f && fgets(line, sizeof(line), f) &&
- sscanf(line, "%*s %511s %511s", proto, data) == 2)
- got_data = 1;
- if (f)
- pclose(f);
+
+ /*
+ * When in untrusted mode, we read the cookie only if it was
+ * successfully generated as an untrusted one in the step
+ * above.
+ */
+ if (trusted || generated) {
+ snprintf(cmd, sizeof(cmd),
+ "%s %s%s list %s 2>" _PATH_DEVNULL,
+ xauth_path,
+ generated ? "-f " : "" ,
+ generated ? xauthfile : "",
+ display);
+ debug2("x11_get_proto: %s", cmd);
+ f = popen(cmd, "r");
+ if (f && fgets(line, sizeof(line), f) &&
+ sscanf(line, "%*s %511s %511s", proto, data) == 2)
+ got_data = 1;
+ if (f)
+ pclose(f);
+ } else
+ error("Warning: untrusted X11 forwarding setup failed: "
+ "xauth key data not generated");
}
if (do_unlink) {

2
openssh-askpass-gnome.spec
View File

@ -15,7 +15,7 @@ BuildRequires: gtk2-devel krb5-devel opensc-devel openssh openssl-devel pam-dev
License: BSD 3-Clause License: BSD 3-Clause
Group: Productivity/Networking/SSH Group: Productivity/Networking/SSH
Version: 4.6p1 Version: 4.6p1
Release: 53 Release: 60
Requires: openssh = %{version} openssh-askpass = %{version} Requires: openssh = %{version} openssh-askpass = %{version}
Autoreqprov: on Autoreqprov: on
Summary: A GNOME-Based Passphrase Dialog for OpenSSH Summary: A GNOME-Based Passphrase Dialog for OpenSSH

5
openssh.changes
View File

@ -1,3 +1,8 @@
-------------------------------------------------------------------
Thu Sep 13 15:50:39 CEST 2007 - nadvornik@suse.cz
- fixed checking of an untrusted cookie, CVE-2007-4752 [#308521]
------------------------------------------------------------------- -------------------------------------------------------------------
Tue Aug 28 18:25:57 CEST 2007 - anicka@suse.cz Tue Aug 28 18:25:57 CEST 2007 - anicka@suse.cz

6
openssh.spec
View File

@ -29,7 +29,7 @@ PreReq: /usr/sbin/groupadd /usr/sbin/useradd %insserv_prereq %fillup_pr
Conflicts: nonfreessh Conflicts: nonfreessh
Autoreqprov: on Autoreqprov: on
Version: 4.6p1 Version: 4.6p1
Release: 47 Release: 53
%define xversion 1.2.4.1 %define xversion 1.2.4.1
Summary: Secure Shell Client and Server (Remote Login Program) Summary: Secure Shell Client and Server (Remote Login Program)
URL: http://www.openssh.com/ URL: http://www.openssh.com/
@ -64,6 +64,7 @@ Patch42: %{name}-gssapi_krb5-fix.patch
Patch43: %{name}-%{version}-default-protocol.diff Patch43: %{name}-%{version}-default-protocol.diff
Patch44: %{name}-%{version}-audit.patch Patch44: %{name}-%{version}-audit.patch
Patch45: %{name}-%{version}-challenge.patch Patch45: %{name}-%{version}-challenge.patch
Patch46: %{name}-%{version}-untrusted-cookie-CVE-2007-4752.diff
BuildRoot: %{_tmppath}/%{name}-%{version}-build BuildRoot: %{_tmppath}/%{name}-%{version}-build
%package askpass %package askpass
Summary: A passphrase dialog for OpenSSH and the X Window System Summary: A passphrase dialog for OpenSSH and the X Window System
@ -155,6 +156,7 @@ Authors:
%patch43 %patch43
%patch44 -p1 %patch44 -p1
%patch45 %patch45
%patch46
cp -v %{SOURCE4} . cp -v %{SOURCE4} .
cp -v %{SOURCE6} . cp -v %{SOURCE6} .
cd ../x11-ssh-askpass-%{xversion} cd ../x11-ssh-askpass-%{xversion}
@ -298,6 +300,8 @@ rm -rf $RPM_BUILD_ROOT
%config %_appdefdir/SshAskpass %config %_appdefdir/SshAskpass
%changelog %changelog
* Thu Sep 13 2007 - nadvornik@suse.cz
- fixed checking of an untrusted cookie, CVE-2007-4752 [#308521]
* Tue Aug 28 2007 - anicka@suse.cz * Tue Aug 28 2007 - anicka@suse.cz
- fix blocksigalrm patch to set old signal mask after - fix blocksigalrm patch to set old signal mask after
writing the log in every case [#304819] writing the log in every case [#304819]