From 22ec66be50c35507ef10e6db4c0499db18df4ac6c29ddd6260e5291d63e64d01 Mon Sep 17 00:00:00 2001 From: Reinhard Max Date: Fri, 7 Feb 2020 14:48:55 +0000 Subject: [PATCH 1/3] - CVE-2020-8597, bsc#1162610: rhostname buffer overflow in the eap_request and eap_response functions. OBS-URL: https://build.opensuse.org/package/show/network/ppp?expand=0&rev=49 --- ppp-CVE-2020-8597.patch | 35 +++++++++++++++++++++++++++++++++++ ppp.changes | 6 ++++++ ppp.spec | 4 +++- 3 files changed, 44 insertions(+), 1 deletion(-) create mode 100644 ppp-CVE-2020-8597.patch diff --git a/ppp-CVE-2020-8597.patch b/ppp-CVE-2020-8597.patch new file mode 100644 index 0000000..57bc1fa --- /dev/null +++ b/ppp-CVE-2020-8597.patch @@ -0,0 +1,35 @@ +From 8d7970b8f3db727fe798b65f3377fe6787575426 Mon Sep 17 00:00:00 2001 +From: Paul Mackerras +Date: Mon, 3 Feb 2020 15:53:28 +1100 +Subject: [PATCH] pppd: Fix bounds check in EAP code + +Given that we have just checked vallen < len, it can never be the case +that vallen >= len + sizeof(rhostname). This fixes the check so we +actually avoid overflowing the rhostname array. + +Reported-by: Ilja Van Sprundel +Signed-off-by: Paul Mackerras +--- + pppd/eap.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- pppd/eap.c.orig ++++ pppd/eap.c +@@ -1421,7 +1421,7 @@ int len; + } + + /* Not so likely to happen. */ +- if (vallen >= len + sizeof (rhostname)) { ++ if (len - vallen >= sizeof (rhostname)) { + dbglog("EAP: trimming really long peer name down"); + BCOPY(inp + vallen, rhostname, sizeof (rhostname) - 1); + rhostname[sizeof (rhostname) - 1] = '\0'; +@@ -1847,7 +1847,7 @@ int len; + } + + /* Not so likely to happen. */ +- if (vallen >= len + sizeof (rhostname)) { ++ if (len - vallen >= sizeof (rhostname)) { + dbglog("EAP: trimming really long peer name down"); + BCOPY(inp + vallen, rhostname, sizeof (rhostname) - 1); + rhostname[sizeof (rhostname) - 1] = '\0'; diff --git a/ppp.changes b/ppp.changes index 4d0d887..ba77971 100644 --- a/ppp.changes +++ b/ppp.changes @@ -1,3 +1,9 @@ +------------------------------------------------------------------- +Fri Feb 7 14:30:35 UTC 2020 - Reinhard Max + +- CVE-2020-8597, bsc#1162610: rhostname buffer overflow in the + eap_request and eap_response functions. + ------------------------------------------------------------------- Thu Oct 4 15:18:10 UTC 2018 - schwab@suse.de diff --git a/ppp.spec b/ppp.spec index 3ff3913..8b2824b 100644 --- a/ppp.spec +++ b/ppp.spec @@ -1,7 +1,7 @@ # # spec file for package ppp # -# Copyright (c) 2018 SUSE LINUX GmbH, Nuernberg, Germany. +# Copyright (c) 2020 SUSE LLC # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -75,6 +75,7 @@ Patch23: ppp-send-padt.patch Patch24: ppp-CVE-2015-3310.patch Patch25: fix-header-conflict.patch Patch26: ppp-2.4.7-DES-openssl.patch +Patch27: ppp-CVE-2020-8597.patch BuildRequires: libpcap-devel BuildRequires: linux-atm-devel BuildRequires: openssl-devel @@ -146,6 +147,7 @@ you can disable unnecessary or disable everything. %patch24 %patch25 -p1 %patch26 -p1 +%patch27 sed -i -e '1s/local\///' scripts/secure-card find scripts -type f | xargs chmod a-x find -type f -name '*.orig' | xargs rm -f From 782ca703b299f2b489828db84980d178d0b7fb47e9d4024ad9914ccb6006bc1a Mon Sep 17 00:00:00 2001 From: Reinhard Max Date: Fri, 7 Feb 2020 15:27:32 +0000 Subject: [PATCH 2/3] OBS-URL: https://build.opensuse.org/package/show/network/ppp?expand=0&rev=50 --- ppp.changes | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ppp.changes b/ppp.changes index ba77971..9accecf 100644 --- a/ppp.changes +++ b/ppp.changes @@ -1,8 +1,8 @@ ------------------------------------------------------------------- Fri Feb 7 14:30:35 UTC 2020 - Reinhard Max -- CVE-2020-8597, bsc#1162610: rhostname buffer overflow in the - eap_request and eap_response functions. +- CVE-2020-8597, bsc#1162610, ppp-CVE-2020-8597.patch: rhostname + buffer overflow in the eap_request and eap_response functions. ------------------------------------------------------------------- Thu Oct 4 15:18:10 UTC 2018 - schwab@suse.de From 4e816d705bd2a5b49cc97ca8011156d771964d01f0644ac9ae597297c6b0ff7d Mon Sep 17 00:00:00 2001 From: Reinhard Max Date: Fri, 7 Feb 2020 15:28:45 +0000 Subject: [PATCH 3/3] OBS-URL: https://build.opensuse.org/package/show/network/ppp?expand=0&rev=51 --- ppp.changes | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ppp.changes b/ppp.changes index 9accecf..3c7d4f4 100644 --- a/ppp.changes +++ b/ppp.changes @@ -1,7 +1,7 @@ ------------------------------------------------------------------- Fri Feb 7 14:30:35 UTC 2020 - Reinhard Max -- CVE-2020-8597, bsc#1162610, ppp-CVE-2020-8597.patch: rhostname +- CVE-2020-8597, bsc#1162610, ppp-CVE-2020-8597.patch: rhostname buffer overflow in the eap_request and eap_response functions. -------------------------------------------------------------------