Attachment 32267 Details for Bug 66128

patch made by redhat

bressers (text/plain), 9.11 KB, created by Ludwig Nussel on 2005-03-18 09:18:59 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Ludwig Nussel

Created: 2005-03-18 09:18:59 UTC

Size: 9.11 KB

patch

obsolete

>From vendor-sec-admin@lst.de  Thu Mar 17 15:21:05 2005
>Return-Path: <vendor-sec-admin@lst.de>
>X-Original-To: lnussel@wotan.suse.de
>Received: from hermes.suse.de (hermes.suse.de [149.44.160.1])
>	by wotan.suse.de (Postfix) with ESMTP id 98C402441E5
>	for <lnussel@wotan.suse.de>; Thu, 17 Mar 2005 15:21:05 +0100 (CET)
>Received: by hermes.suse.de (Postfix)
>	id 8C1CE153F7A; Thu, 17 Mar 2005 15:21:05 +0100 (CET)
>Received: from scanhost.suse.de (scanhost.suse.de [149.44.160.36])
>	by hermes.suse.de (Postfix) with ESMTP
>	id 7C9B5153D22; Thu, 17 Mar 2005 15:21:05 +0100 (CET)
>Received: from hermes.suse.de ([149.44.160.1])
> by scanhost.suse.de (scanhost [149.44.160.36]) (amavisd-new, port 10025)
> with ESMTP id 30829-17; Thu, 17 Mar 2005 15:21:01 +0100 (CET)
>Received: from Cantor.suse.de (mail-ex.suse.de [195.135.220.2])
>	(using TLSv1 with cipher EDH-RSA-DES-CBC3-SHA (168/168 bits))
>	(No client certificate requested)
>	by hermes.suse.de (Postfix) with ESMTP
>	id 503C01530F8; Thu, 17 Mar 2005 15:21:01 +0100 (CET)
>Received: from mail.lst.de (verein.lst.de [213.95.11.210])
>	(using TLSv1 with cipher EDH-RSA-DES-CBC3-SHA (168/168 bits))
>	(No client certificate requested)
>	by Cantor.suse.de (Postfix) with ESMTP id 2A4EC15E68E9;
>	Thu, 17 Mar 2005 15:21:01 +0100 (CET)
>Received: from verein.lst.de (localhost [127.0.0.1])
>	by mail.lst.de (8.12.3/8.12.3/Debian-7.1) with ESMTP id j2HEKQ6s007440;
>	Thu, 17 Mar 2005 15:20:26 +0100
>Received: from mx1.redhat.com (mx1.redhat.com [66.187.233.31])
>	by mail.lst.de (8.12.3/8.12.3/Debian-7.1) with ESMTP id j2HEJI6t007411
>	(version=TLSv1/SSLv3 cipher=EDH-RSA-DES-CBC3-SHA bits=168 verify=NO)
>	for <vendor-sec@lst.de>; Thu, 17 Mar 2005 15:19:19 +0100
>Received: from int-mx1.corp.redhat.com (int-mx1.corp.redhat.com [172.16.52.254])
>	by mx1.redhat.com (8.12.11/8.12.11) with ESMTP id j2HEJH6D005151;
>	Thu, 17 Mar 2005 09:19:17 -0500
>Received: from devserv.devel.redhat.com (devserv.devel.redhat.com [172.16.58.1])
>	by int-mx1.corp.redhat.com (8.11.6/8.11.6) with ESMTP id j2HEJHY17726;
>	Thu, 17 Mar 2005 09:19:17 -0500
>Received: from devserv.devel.redhat.com (localhost.localdomain [127.0.0.1])
>	by devserv.devel.redhat.com (8.12.11/8.12.11) with ESMTP id j2HEJHJW030703;
>	Thu, 17 Mar 2005 09:19:17 -0500
>Received: (from bressers@localhost)
>	by devserv.devel.redhat.com (8.12.11/8.12.11/Submit) id j2HEJGsM030701;
>	Thu, 17 Mar 2005 09:19:16 -0500
>From: Josh Bressers <bressers@redhat.com>
>To: Tom Rini <trini@mvista.com>
>Cc: vendor-sec@lst.de
>Subject: Re: [vendor-sec] iDEFENSE Security Advisory [IDEF0866] Multiple Telnet Client slc_add_reply() Buffer Overflow Vulnerability
>Message-ID: <20050317141916.GF25956@devserv.devel.redhat.com>
>References: <FB24803D1DF2A34FA59FC157B77C970503E245C8@idserv04.idef.com> <20050219194246.GA7495@openwall.com> <20050316172037.GM793@localhost>
>Mime-Version: 1.0
>Content-Type: multipart/mixed; boundary="7AUc2qLy4jB3hD7Z"
>Content-Disposition: inline
>In-Reply-To: <20050316172037.GM793@localhost>
>User-Agent: Mutt/1.4.1i
>Sender: vendor-sec-admin@lst.de
>Errors-To: vendor-sec-admin@lst.de
>X-BeenThere: vendor-sec@lst.de
>X-Mailman-Version: 2.0.11
>Precedence: bulk
>List-Help: <mailto:vendor-sec-request@lst.de?subject=help>
>List-Post: <mailto:vendor-sec@lst.de>
>List-Subscribe: <https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec>,
>	<mailto:vendor-sec-request@lst.de?subject=subscribe>
>List-Id: <vendor-sec.lst.de>
>List-Unsubscribe: <https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec>,
>	<mailto:vendor-sec-request@lst.de?subject=unsubscribe>
>List-Archive: <https://www.lst.de/cgi-bin/mailman/private/vendor-sec/>
>X-Original-Date: Thu, 17 Mar 2005 09:19:16 -0500
>Date: Thu, 17 Mar 2005 09:19:16 -0500
>X-Virus-Scanned: by amavisd-new at scanhost.suse.de
>X-Spam-Status: No, hits=-3.6 tagged_above=-20.0 required=5.0 tests=BAYES_00,
> MY_LINUX
>X-Spam-Level: 
>Status: RO
>Content-Length: 5459
>Lines: 213
>
>
>--7AUc2qLy4jB3hD7Z
>Content-Type: text/plain; charset=us-ascii
>Content-Disposition: inline
>
>On Wed, Mar 16, 2005 at 10:20:37AM -0700, Tom Rini wrote:
>> On Sat, Feb 19, 2005 at 10:42:46PM +0300, Solar Designer wrote:
>> 
>> > Hi,
>> > 
>> > I've just checked the source code for our (Openwall GNU/*/Linux)
>> > telnet client for these three vulnerabilities.  Our telnet client
>> > and server are derived from OpenBSD 3.0, and I notice no relevant
>> > changes in current OpenBSD.
>> 
>> Would you mind sharing the fix I assume you've come up with for the
>> Openwall package?  Thanks.
>
>While it's not the openwall patch, this is the patch our telnet maintainer
>created (tested against the iDEFENSE exploits).
>
>-- 
>    JB
>
>--7AUc2qLy4jB3hD7Z
>Content-Type: text/plain; charset=us-ascii
>Content-Disposition: attachment; filename="telnet-0.17-CAN-2005-468_469.patch"
>
>--- netkit-telnet-0.17/telnet/telnet.c.CAN-2005-468_469	2005-03-17 13:48:58.000000000 +0100
>+++ netkit-telnet-0.17/telnet/telnet.c	2005-03-17 14:02:27.000000000 +0100
>@@ -1310,22 +1310,66 @@
> }
> 
> 
>-unsigned char slc_reply[128];
>+#define SLC_REPLY_SIZE 128
>+unsigned char *slc_reply;
> unsigned char *slc_replyp;
>+unsigned char *slc_replyend;
> 
> 	void
> slc_start_reply(void)
> {
>+        slc_reply = (unsigned char *)malloc(SLC_REPLY_SIZE);
>+        if (slc_reply == NULL) {
>+/*@*/           printf("slc_start_reply: malloc()/realloc() failed!!!\n");
>+                slc_reply = slc_replyp = slc_replyend = NULL;
>+                return;
>+	}
>+
> 	slc_replyp = slc_reply;
>+	slc_replyend = slc_reply + SLC_REPLY_SIZE;
> 	*slc_replyp++ = IAC;
> 	*slc_replyp++ = SB;
> 	*slc_replyp++ = TELOPT_LINEMODE;
> 	*slc_replyp++ = LM_SLC;
> }
> 
>+static int
>+slc_assure_buffer(int want_len);
>+
>+	static int
>+slc_assure_buffer(int want_len)
>+{
>+        if ((slc_replyp + want_len) >= slc_replyend) {
>+                int len;
>+		int old_len = slc_replyp - slc_reply;
>+		unsigned char *p;
>+
>+                len = old_len
>+			+ (want_len / SLC_REPLY_SIZE + 1) * SLC_REPLY_SIZE;
>+                p = (unsigned char *)realloc(slc_reply, len);
>+                if (p == NULL)
>+                        free(slc_reply);
>+                slc_reply = p;
>+                if (slc_reply == NULL) {
>+/*@*/                   printf("slc_add_reply: realloc() failed!!!\n");
>+                        slc_reply = slc_replyp = slc_replyend = NULL;
>+                        return 1;
>+                }
>+                slc_replyp = slc_reply + old_len;
>+                slc_replyend = slc_reply + len;
>+        }
>+	return 0;
>+}
>+
> 	void
> slc_add_reply(unsigned char func, unsigned char flags, cc_t value)
> {
>+	if (slc_assure_buffer(6))
>+		return;
>+
>+	if (slc_replyp == NULL)
>+		return;
>+
> 	if ((*slc_replyp++ = func) == IAC)
> 		*slc_replyp++ = IAC;
> 	if ((*slc_replyp++ = flags) == IAC)
>@@ -1339,6 +1383,12 @@
> {
>     int len;
> 
>+    if (slc_assure_buffer(2))
>+	return;
>+
>+    if (slc_replyp == NULL)
>+	return;
>+
>     *slc_replyp++ = IAC;
>     *slc_replyp++ = SE;
>     len = slc_replyp - slc_reply;
>@@ -1456,7 +1506,7 @@
> 	}
> }
> 
>-#define	OPT_REPLY_SIZE	256
>+#define	OPT_REPLY_SIZE	1024
> unsigned char *opt_reply;
> unsigned char *opt_replyp;
> unsigned char *opt_replyend;
>@@ -1490,10 +1540,38 @@
> env_opt_start_info(void)
> {
> 	env_opt_start();
>-	if (opt_replyp)
>+	if (opt_replyp && (opt_replyp > opt_reply))
> 	    opt_replyp[-1] = TELQUAL_INFO;
> }
> 
>+static int
>+env_opt_assure_buffer(int want_len);
>+
>+	static int
>+env_opt_assure_buffer(int want_len)
>+{
>+        if ((opt_replyp + want_len) >= opt_replyend) {
>+		int len;
>+		unsigned char *p;
>+		int old_len = opt_replyp - opt_reply;
>+
>+		len = old_len
>+			+ (want_len / OPT_REPLY_SIZE + 1) * OPT_REPLY_SIZE;
>+		p = (unsigned char *)realloc(opt_reply, len);
>+		if (p == NULL)
>+			free(opt_reply);
>+		opt_reply = p;
>+		if (opt_reply == NULL) {
>+/*@*/			printf("env_opt_add: realloc() failed!!!\n");
>+			opt_reply = opt_replyp = opt_replyend = NULL;
>+			return 1;
>+		}
>+		opt_replyp = opt_reply + old_len;
>+		opt_replyend = opt_reply + len;
>+	}
>+	return 0;
>+}
>+
> 	void
> env_opt_add(unsigned char *ep)
> {
>@@ -1515,25 +1593,12 @@
> 		return;
> 	}
> 	vp = env_getvalue(ep, 1);
>-	if (opt_replyp + (vp ? strlen((char *)vp) : 0) +
>-				strlen((char *)ep) + 6 > opt_replyend)
>-	{
>-		int len;
>-		unsigned char *p;
>-		opt_replyend += OPT_REPLY_SIZE;
>-		len = opt_replyend - opt_reply;
>-		p = (unsigned char *)realloc(opt_reply, len);
>-		if (p == NULL)
>-			free(opt_reply);
>-		opt_reply = p;
>-		if (opt_reply == NULL) {
>-/*@*/			printf("env_opt_add: realloc() failed!!!\n");
>-			opt_reply = opt_replyp = opt_replyend = NULL;
>-			return;
>-		}
>-		opt_replyp = opt_reply + len - (opt_replyend - opt_replyp);
>-		opt_replyend = opt_reply + len;
>-	}
>+
>+	/* use the double length in case it gots escaped */
>+	if (env_opt_assure_buffer((vp ? strlen((char *)vp)*2 : 0) +
>+				strlen((char *)ep)*2 + 6))
>+		return;
>+
> 	if (opt_welldefined((char *)ep))
> #ifdef	OLD_ENVIRON
> 		if (telopt_environ == TELOPT_OLD_ENVIRON)
>@@ -1588,8 +1653,14 @@
> {
> 	int len;
> 
>+        if (opt_reply == NULL)          /*XXX*/
>+                return;                 /*XXX*/
>+
>+
> 	len = opt_replyp - opt_reply + 2;
> 	if (emptyok || len > 6) {
>+		if (env_opt_assure_buffer(2))
>+			return;
> 		*opt_replyp++ = IAC;
> 		*opt_replyp++ = SE;
> 		if (NETROOM() > len) {
>
>--7AUc2qLy4jB3hD7Z--
>_______________________________________________
>Vendor Security mailing list
>Vendor Security@lst.de
>https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec
>

Actions: View

Attachments on bug 66128: 28649 | 28650 | 28708 | 28709 | 28710 | 28741 | 28742 | 28745 | 28746 | 28756 | 28757 | 32267 | 32268 | 39119