From 4f26911b4c74217476a70f1fea6e4d15b6d18959 Mon Sep 17 00:00:00 2001 From: Gwyn Ciesla Date: Mon, 7 Oct 2019 08:50:42 -0500 Subject: [PATCH 1/4] "Adding package.cfg file" --- package.cfg | 2 ++ 1 file changed, 2 insertions(+) create mode 100644 package.cfg diff --git a/package.cfg b/package.cfg new file mode 100644 index 0000000..66ea79d --- /dev/null +++ b/package.cfg @@ -0,0 +1,2 @@ +[koji] +targets = epel8 epel8-playground \ No newline at end of file From bfdf04e19b611ffc368f3fd8be315d11474fb0e0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ond=C5=99ej=20Lyson=C4=9Bk?= Date: Mon, 27 Jan 2020 14:05:23 +0100 Subject: [PATCH 2/4] Fix potential stack exhaustion in function listdir (CVE-2019-20176) Resolves: rhbz#1795153 --- ...single-buffer-to-store-every-file-na.patch | 70 +++++++++++++++++++ pure-ftpd.spec | 8 ++- 2 files changed, 77 insertions(+), 1 deletion(-) create mode 100644 0001-listdir-reuse-a-single-buffer-to-store-every-file-na.patch diff --git a/0001-listdir-reuse-a-single-buffer-to-store-every-file-na.patch b/0001-listdir-reuse-a-single-buffer-to-store-every-file-na.patch new file mode 100644 index 0000000..efed2f3 --- /dev/null +++ b/0001-listdir-reuse-a-single-buffer-to-store-every-file-na.patch @@ -0,0 +1,70 @@ +From aea56f4bcb9948d456f3fae4d044fd3fa2e19706 Mon Sep 17 00:00:00 2001 +From: Frank Denis +Date: Mon, 30 Dec 2019 17:40:04 +0100 +Subject: [PATCH] listdir(): reuse a single buffer to store every file name to + display + +Allocating a new buffer for each entry is useless. + +And as these buffers are allocated on the stack, on systems with a +small stack size, with many entries, the limit can easily be reached, +causing a stack exhaustion and aborting the user session. + +Reported by Antonio Morales from the GitHub Security Lab team, thanks! +--- + src/ls.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +diff --git a/src/ls.c b/src/ls.c +index cf804c7..f8a588f 100644 +--- a/src/ls.c ++++ b/src/ls.c +@@ -661,6 +661,8 @@ static void listdir(unsigned int depth, int f, void * const tls_fd, + char *names; + PureFileInfo *s; + PureFileInfo *r; ++ char *alloca_subdir; ++ size_t sizeof_subdir; + int d; + + if (depth >= max_ls_depth || matches >= max_ls_files) { +@@ -690,14 +692,12 @@ static void listdir(unsigned int depth, int f, void * const tls_fd, + } + outputfiles(f, tls_fd); + r = dir; ++ sizeof_subdir = PATH_MAX + 1U; ++ if ((alloca_subdir = ALLOCA(sizeof_subdir)) == NULL) { ++ goto toomany; ++ } + while (opt_R && r != s) { + if (r->name_offset != (size_t) -1 && !chdir(FI_NAME(r))) { +- char *alloca_subdir; +- const size_t sizeof_subdir = PATH_MAX + 1U; +- +- if ((alloca_subdir = ALLOCA(sizeof_subdir)) == NULL) { +- goto toomany; +- } + if (SNCHECK(snprintf(alloca_subdir, sizeof_subdir, "%s/%s", + name, FI_NAME(r)), sizeof_subdir)) { + goto nolist; +@@ -706,8 +706,8 @@ static void listdir(unsigned int depth, int f, void * const tls_fd, + wrstr(f, tls_fd, alloca_subdir); + wrstr(f, tls_fd, ":\r\n\r\n"); + listdir(depth + 1U, f, tls_fd, alloca_subdir); ++ + nolist: +- ALLOCA_FREE(alloca_subdir); + if (matches >= max_ls_files) { + goto toomany; + } +@@ -720,6 +720,7 @@ static void listdir(unsigned int depth, int f, void * const tls_fd, + r++; + } + toomany: ++ ALLOCA_FREE(alloca_subdir); + free(names); + free(dir); + names = NULL; +-- +2.20.1 + diff --git a/pure-ftpd.spec b/pure-ftpd.spec index 24d2838..e213353 100644 --- a/pure-ftpd.spec +++ b/pure-ftpd.spec @@ -1,6 +1,6 @@ Name: pure-ftpd Version: 1.0.49 -Release: 2%{?dist} +Release: 3%{?dist} Summary: Lightweight, fast and secure FTP server License: BSD URL: http://www.pureftpd.org @@ -16,6 +16,8 @@ Source8: pure-ftpd-with-tls-init.service Source9: pure-ftpd-with-tls.service Patch0: 0001-modify-pam.patch Patch1: 0002-fedora-specific-config-file.patch +# Upstream patch: +Patch2: 0001-listdir-reuse-a-single-buffer-to-store-every-file-na.patch Provides: ftpserver BuildRequires: pam-devel, libcap-devel @@ -227,6 +229,10 @@ fi %changelog +* Mon Jan 27 2020 Ondřej Lysoněk - 1.0.49-3 +- Fix potential stack exhaustion in function listdir (CVE-2019-20176) +- Resolves: rhbz#1795153 + * Fri Jul 26 2019 Fedora Release Engineering - 1.0.49-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild From 4785c305cc060f7e385951e7cfecf2d7ec728ca0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ond=C5=99ej=20Lyson=C4=9Bk?= Date: Wed, 6 May 2020 18:27:45 +0200 Subject: [PATCH 3/4] Fix CVE-2020-9365 and CVE-2020-9274 Resolves: rhbz#1828689 Resolves: rhbz#1831060 --- ...ays-set-the-tail-of-the-list-to-NULL.patch | 34 +++++++++++++++++++ 0001-pure_strcmp-len-s2-can-be-len-s1.patch | 28 +++++++++++++++ pure-ftpd.spec | 11 +++++- 3 files changed, 72 insertions(+), 1 deletion(-) create mode 100644 0001-diraliases-always-set-the-tail-of-the-list-to-NULL.patch create mode 100644 0001-pure_strcmp-len-s2-can-be-len-s1.patch diff --git a/0001-diraliases-always-set-the-tail-of-the-list-to-NULL.patch b/0001-diraliases-always-set-the-tail-of-the-list-to-NULL.patch new file mode 100644 index 0000000..d5b2523 --- /dev/null +++ b/0001-diraliases-always-set-the-tail-of-the-list-to-NULL.patch @@ -0,0 +1,34 @@ +From 8d0d42542e2cb7a56d645fbe4d0ef436e38bcefa Mon Sep 17 00:00:00 2001 +From: Frank Denis +Date: Tue, 18 Feb 2020 18:36:58 +0100 +Subject: [PATCH] diraliases: always set the tail of the list to NULL + +Spotted and reported by Antonio Norales from GitHub Security Labs. +Thanks! +--- + src/diraliases.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/diraliases.c b/src/diraliases.c +index 4002a36..fb70273 100644 +--- a/src/diraliases.c ++++ b/src/diraliases.c +@@ -93,7 +93,6 @@ int init_aliases(void) + (tail->dir = strdup(dir)) == NULL) { + die_mem(); + } +- tail->next = NULL; + } else { + DirAlias *curr; + +@@ -105,6 +104,7 @@ int init_aliases(void) + tail->next = curr; + tail = curr; + } ++ tail->next = NULL; + } + fclose(fp); + aliases_up++; +-- +2.25.4 + diff --git a/0001-pure_strcmp-len-s2-can-be-len-s1.patch b/0001-pure_strcmp-len-s2-can-be-len-s1.patch new file mode 100644 index 0000000..375b970 --- /dev/null +++ b/0001-pure_strcmp-len-s2-can-be-len-s1.patch @@ -0,0 +1,28 @@ +From bf6fcd4935e95128cf22af5924cdc8fe5c0579da Mon Sep 17 00:00:00 2001 +From: Frank Denis +Date: Mon, 24 Feb 2020 15:19:43 +0100 +Subject: [PATCH] pure_strcmp(): len(s2) can be > len(s1) + +Reported by Antonio Morales from GitHub Security Labs, thanks! +--- + src/utils.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/src/utils.c b/src/utils.c +index f41492d..5e88104 100644 +--- a/src/utils.c ++++ b/src/utils.c +@@ -45,5 +45,9 @@ int pure_memcmp(const void * const b1_, const void * const b2_, size_t len) + + int pure_strcmp(const char * const s1, const char * const s2) + { +- return pure_memcmp(s1, s2, strlen(s1) + 1U); ++ const size_t s1_len = strlen(s1); ++ const size_t s2_len = strlen(s2); ++ const size_t len = (s1_len < s2_len) ? s1_len : s2_len; ++ ++ return pure_memcmp(s1, s2, len + 1); + } +-- +2.25.4 + diff --git a/pure-ftpd.spec b/pure-ftpd.spec index e213353..875ec60 100644 --- a/pure-ftpd.spec +++ b/pure-ftpd.spec @@ -1,6 +1,6 @@ Name: pure-ftpd Version: 1.0.49 -Release: 3%{?dist} +Release: 4%{?dist} Summary: Lightweight, fast and secure FTP server License: BSD URL: http://www.pureftpd.org @@ -18,6 +18,10 @@ Patch0: 0001-modify-pam.patch Patch1: 0002-fedora-specific-config-file.patch # Upstream patch: Patch2: 0001-listdir-reuse-a-single-buffer-to-store-every-file-na.patch +# Upstream patch: +Patch3: 0001-diraliases-always-set-the-tail-of-the-list-to-NULL.patch +# Upstream patch: +Patch4: 0001-pure_strcmp-len-s2-can-be-len-s1.patch Provides: ftpserver BuildRequires: pam-devel, libcap-devel @@ -229,6 +233,11 @@ fi %changelog +* Wed May 06 2020 Ondřej Lysoněk - 1.0.49-4 +- Fix CVE-2020-9365 and CVE-2020-9274 +- Resolves: rhbz#1828689 +- Resolves: rhbz#1831060 + * Mon Jan 27 2020 Ondřej Lysoněk - 1.0.49-3 - Fix potential stack exhaustion in function listdir (CVE-2019-20176) - Resolves: rhbz#1795153 From 3fa9a6e158858544e2b378adad5339fd27cd76db Mon Sep 17 00:00:00 2001 From: Troy Dawson Date: Thu, 24 Sep 2020 17:38:24 +0000 Subject: [PATCH 4/4] remove package.cfg per new epel-playground policy --- package.cfg | 2 -- 1 file changed, 2 deletions(-) delete mode 100644 package.cfg diff --git a/package.cfg b/package.cfg deleted file mode 100644 index 66ea79d..0000000 --- a/package.cfg +++ /dev/null @@ -1,2 +0,0 @@ -[koji] -targets = epel8 epel8-playground \ No newline at end of file