From 333089beed76a3f03dd3a657c1db27dc56e5ed0a Mon Sep 17 00:00:00 2001 From: "Vojtech Vitek (V-Teq)" Date: Mon, 14 Feb 2011 16:14:10 +0100 Subject: [PATCH 1/8] - Add -Wl,-z,relro,-z,now to LDFLAGS --- xinetd.spec | 3 +++ 1 file changed, 3 insertions(+) diff --git a/xinetd.spec b/xinetd.spec index b9d0e73..75fbc38 100644 --- a/xinetd.spec +++ b/xinetd.spec @@ -88,6 +88,7 @@ aclocal autoconf %build +export LDFLAGS="$LDFLAGS -Wl,-z,relro,-z,now" %configure --with-loadavg --with-inet6 %{!?tcp_wrappers:--with-libwrap} --with-labeled-networking make @@ -142,6 +143,8 @@ fi %{_mandir}/*/* %changelog +- Add -Wl,-z,relro,-z,now to LDFLAGS + * Mon Feb 07 2011 Fedora Release Engineering - 2:2.3.14-33 - Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild From a7049f76890d45f848d8b750d9e7f103e3470a9d Mon Sep 17 00:00:00 2001 From: "Vojtech Vitek (V-Teq)" Date: Mon, 14 Feb 2011 16:15:17 +0100 Subject: [PATCH 2/8] Release build 2:2.3.14-34 --- xinetd.spec | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/xinetd.spec b/xinetd.spec index 75fbc38..1ef48b2 100644 --- a/xinetd.spec +++ b/xinetd.spec @@ -1,7 +1,7 @@ Summary: A secure replacement for inetd Name: xinetd Version: 2.3.14 -Release: 33%{?dist} +Release: 34%{?dist} License: xinetd Group: System Environment/Daemons Epoch: 2 @@ -143,6 +143,7 @@ fi %{_mandir}/*/* %changelog +* Mon Feb 14 2011 Vojtech Vitek (V-Teq) - 2:2.3.14-34 - Add -Wl,-z,relro,-z,now to LDFLAGS * Mon Feb 07 2011 Fedora Release Engineering - 2:2.3.14-33 From 4619c0cb189fec753afe4d466e721b41e7aef001 Mon Sep 17 00:00:00 2001 From: "Vojtech Vitek (V-Teq)" Date: Fri, 18 Feb 2011 14:28:01 +0100 Subject: [PATCH 3/8] Add note about -pie -PIE patches to %build configure section --- xinetd.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/xinetd.spec b/xinetd.spec index 1ef48b2..f18639a 100644 --- a/xinetd.spec +++ b/xinetd.spec @@ -88,6 +88,7 @@ aclocal autoconf %build +# -pie -PIE flags added by separate patches export LDFLAGS="$LDFLAGS -Wl,-z,relro,-z,now" %configure --with-loadavg --with-inet6 %{!?tcp_wrappers:--with-libwrap} --with-labeled-networking make From 8cad70d099953782c8da5d05ae1c99a11a968b51 Mon Sep 17 00:00:00 2001 From: "Vojtech Vitek (V-Teq)" Date: Fri, 18 Feb 2011 15:03:06 +0100 Subject: [PATCH 4/8] - fix crash when application's logfile hit size limit Related: #244063 --- xinetd-2.3.13-log-crash.patch | 17 +++++++++++++++++ xinetd.spec | 6 ++++++ 2 files changed, 23 insertions(+) create mode 100644 xinetd-2.3.13-log-crash.patch diff --git a/xinetd-2.3.13-log-crash.patch b/xinetd-2.3.13-log-crash.patch new file mode 100644 index 0000000..abd4d42 --- /dev/null +++ b/xinetd-2.3.13-log-crash.patch @@ -0,0 +1,17 @@ +244063: RHEL4 SIGSEGV in xinetd when application's logfile hit size limit + +Written-By: Jan Safranek + +Initialize xl_callback_arg, so xinetd does not crash when it gets dereferenced. + +diff -up xinetd-2.3.13/libs/src/xlog/xlog.c.orig xinetd-2.3.13/libs/src/xlog/xlog.c +--- xinetd-2.3.13/libs/src/xlog/xlog.c.orig 2003-05-31 23:58:58.000000000 +0200 ++++ xinetd-2.3.13/libs/src/xlog/xlog.c 2007-12-05 15:31:08.000000000 +0100 +@@ -216,6 +216,7 @@ int xlog_control( xlog_h pxlog, xlog_cmd + + case XLOG_CALLBACK: + xp->xl_callback = va_arg( ap, voidfunc ) ; ++ xp->xl_callback_arg = va_arg( ap, void * ); + break ; + + case XLOG_GETFLAG: diff --git a/xinetd.spec b/xinetd.spec index f18639a..e3d05bd 100644 --- a/xinetd.spec +++ b/xinetd.spec @@ -39,6 +39,7 @@ Patch15: xinetd-2.3.14-ipv6confusion.patch # This fixes bug #593904 - online reconfiguration caused log message # flood when turning off UDP service Patch16: xinetd-2.3.14-udp-reconfig.patch +Patch17: xinetd-2.3.13-log-crash.patch BuildRequires: autoconf, automake BuildRequires: libselinux-devel >= 1.30 @@ -83,6 +84,7 @@ located in the /etc/xinetd.d directory. %patch14 -p1 -b .clean-pfd %patch15 -p1 -b .ipv6confusion %patch16 -p1 -b .udp-reconfig +%patch17 -p1 -b .log-crash aclocal autoconf @@ -144,6 +146,10 @@ fi %{_mandir}/*/* %changelog +* Fri Feb 18 2011 Vojtech Vitek (V-Teq) - 2:2.3.14-35 +- fix crash when application's logfile hit size limit + Related: #244063 + * Mon Feb 14 2011 Vojtech Vitek (V-Teq) - 2:2.3.14-34 - Add -Wl,-z,relro,-z,now to LDFLAGS From 743e7109a4166175c6fb6f6e483e5bb66403befa Mon Sep 17 00:00:00 2001 From: "Vojtech Vitek (V-Teq)" Date: Fri, 18 Feb 2011 15:04:26 +0100 Subject: [PATCH 5/8] Release build 2:2.3.14-35 --- xinetd.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xinetd.spec b/xinetd.spec index e3d05bd..34a47f2 100644 --- a/xinetd.spec +++ b/xinetd.spec @@ -1,7 +1,7 @@ Summary: A secure replacement for inetd Name: xinetd Version: 2.3.14 -Release: 34%{?dist} +Release: 35%{?dist} License: xinetd Group: System Environment/Daemons Epoch: 2 From 3a87b00842d82547100c6ce2e8d1e564e47bae3c Mon Sep 17 00:00:00 2001 From: "Vojtech Vitek (V-Teq)" Date: Thu, 21 Apr 2011 15:25:09 +0200 Subject: [PATCH 6/8] - Fix build warning about "dereferencing type-punned pointer" - Avoid possible hang while logging an unexpected signal - Let RPC services bind to a specific port --- xinetd-2.3.14-fix-type-punned-ptr.patch | 22 ++++++++++++++++++ xinetd-2.3.14-rpc-specific-port.patch | 30 +++++++++++++++++++++++++ xinetd-2.3.14-signal-log-hang.patch | 27 ++++++++++++++++++++++ xinetd.spec | 13 +++++++++++ 4 files changed, 92 insertions(+) create mode 100644 xinetd-2.3.14-fix-type-punned-ptr.patch create mode 100644 xinetd-2.3.14-rpc-specific-port.patch create mode 100644 xinetd-2.3.14-signal-log-hang.patch diff --git a/xinetd-2.3.14-fix-type-punned-ptr.patch b/xinetd-2.3.14-fix-type-punned-ptr.patch new file mode 100644 index 0000000..993169f --- /dev/null +++ b/xinetd-2.3.14-fix-type-punned-ptr.patch @@ -0,0 +1,22 @@ +diff --git a/sensor.c b/sensor.c +index 09d0877..e65018c 100644 +--- a/xinetd/sensor.c ++++ b/xinetd/sensor.c +@@ -100,14 +100,15 @@ void process_sensor( const struct service *sp, const union xsockaddr *addr) + { + /* Here again, eh?...update time stamp. */ + char *exp_time; +- time_t stored_time; ++ int stored_time; + + item_matched--; /* Is # plus 1, to even get here must be >= 1 */ + exp_time = pset_pointer( global_no_access_time, item_matched ) ; + if (exp_time == NULL) + return ; + +- if ( parse_base10(exp_time, (int *)&stored_time) ) ++ /* FIXME: Parse (long int) instead of (int) prior to possible Y2K38 bug. */ ++ if ( parse_base10(exp_time, &stored_time ) ) + { /* if never let them off, bypass */ + if (stored_time != -1) + { diff --git a/xinetd-2.3.14-rpc-specific-port.patch b/xinetd-2.3.14-rpc-specific-port.patch new file mode 100644 index 0000000..19376fd --- /dev/null +++ b/xinetd-2.3.14-rpc-specific-port.patch @@ -0,0 +1,30 @@ +commit 1b91f7b0f67fba11ea8bbcdddef844656434c53c +Author: Jeffrey Bastian +Date: Tue Aug 17 13:45:20 2010 -0500 + + Let RPC services bind to a port + +diff --git a/xinetd/service.c b/xinetd/service.c +index 9f21f93..5d26885 100644 +--- a/xinetd/service.c ++++ b/xinetd/service.c +@@ -165,6 +165,7 @@ static status_e activate_rpc( struct service *sp ) + socklen_t sin_len = sizeof(tsin); + unsigned long vers ; + struct service_config *scp = SVC_CONF( sp ) ; ++ uint16_t service_port = SC_PORT( scp ) ; + struct rpc_data *rdp = SC_RPCDATA( scp ) ; + char *sid = SC_ID( scp ) ; + unsigned registered_versions = 0 ; +@@ -181,9 +182,11 @@ static status_e activate_rpc( struct service *sp ) + } + if( SC_IPV4( scp ) ) { + tsin.sa_in.sin_family = AF_INET ; ++ tsin.sa_in.sin_port = htons( service_port ) ; + sin_len = sizeof(struct sockaddr_in); + } else if( SC_IPV6( scp ) ) { + tsin.sa_in6.sin6_family = AF_INET6 ; ++ tsin.sa_in6.sin6_port = htons( service_port ); + sin_len = sizeof(struct sockaddr_in6); + } + diff --git a/xinetd-2.3.14-signal-log-hang.patch b/xinetd-2.3.14-signal-log-hang.patch new file mode 100644 index 0000000..18fd1a1 --- /dev/null +++ b/xinetd-2.3.14-signal-log-hang.patch @@ -0,0 +1,27 @@ +--- a/xinetd/signals.c 2009-05-07 05:56:52.000000000 -0400 ++++ b/xinetd/signals.c.new 2009-05-07 05:56:44.000000000 -0400 +@@ -389,9 +390,11 @@ + break ; + + default: +- msg( LOG_NOTICE, func, "Unexpected signal %s", sig_name( sig ) ) ; +- if ( debug.on && sig == SIGINT ) +- exit( 1 ) ; ++ /* Let my_handler() queue this signal for later logging. ++ Calling msg() and thus syslog() directly here can hang up ++ the process, trying to acquire an already acquired lock, ++ because another syslog() could have been the interrupted code. */ ++ my_handler(sig); + } + } + +@@ -495,6 +497,9 @@ + default: + msg(LOG_ERR, func, "unexpected signal: %s in signal pipe", + sig_name(sig)); ++ ++ if ( debug.on && sig == SIGINT ) ++ exit( 1 ) ; + } + } + } diff --git a/xinetd.spec b/xinetd.spec index 34a47f2..38a4bb4 100644 --- a/xinetd.spec +++ b/xinetd.spec @@ -40,6 +40,9 @@ Patch15: xinetd-2.3.14-ipv6confusion.patch # flood when turning off UDP service Patch16: xinetd-2.3.14-udp-reconfig.patch Patch17: xinetd-2.3.13-log-crash.patch +Patch18: xinetd-2.3.14-rpc-specific-port.patch +Patch19: xinetd-2.3.14-signal-log-hang.patch +Patch20: xinetd-2.3.14-fix-type-punned-ptr.patch BuildRequires: autoconf, automake BuildRequires: libselinux-devel >= 1.30 @@ -85,6 +88,9 @@ located in the /etc/xinetd.d directory. %patch15 -p1 -b .ipv6confusion %patch16 -p1 -b .udp-reconfig %patch17 -p1 -b .log-crash +%patch18 -p1 -b .rpc-specific-port +%patch19 -p1 -b .signal-log-hang +%patch20 -p1 -b .fix-type-punned-ptr aclocal autoconf @@ -146,6 +152,13 @@ fi %{_mandir}/*/* %changelog +- Fix build warning about "dereferencing type-punned pointer" + Related: #695674 +- Avoid possible hang while logging an unexpected signal + Related: #501604 +- Let RPC services bind to a specific port + Related: #624800 + * Fri Feb 18 2011 Vojtech Vitek (V-Teq) - 2:2.3.14-35 - fix crash when application's logfile hit size limit Related: #244063 From fffbdd6c6658fd5907d0ae30cab3648a9756d883 Mon Sep 17 00:00:00 2001 From: "Vojtech Vitek (V-Teq)" Date: Thu, 21 Apr 2011 15:26:15 +0200 Subject: [PATCH 7/8] Release build 2:2.3.14-36 --- xinetd.spec | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/xinetd.spec b/xinetd.spec index 38a4bb4..8a94d6c 100644 --- a/xinetd.spec +++ b/xinetd.spec @@ -1,7 +1,7 @@ Summary: A secure replacement for inetd Name: xinetd Version: 2.3.14 -Release: 35%{?dist} +Release: 36%{?dist} License: xinetd Group: System Environment/Daemons Epoch: 2 @@ -152,6 +152,7 @@ fi %{_mandir}/*/* %changelog +* Thu Apr 21 2011 Vojtech Vitek (V-Teq) - 2:2.3.14-36 - Fix build warning about "dereferencing type-punned pointer" Related: #695674 - Avoid possible hang while logging an unexpected signal From 45e8dedc63bc1dd9654a07a14b70c559d7846fe7 Mon Sep 17 00:00:00 2001 From: Jan Synacek Date: Thu, 17 May 2012 09:11:31 +0200 Subject: [PATCH 8/8] Fix tcpmux security Resolves: #820318 (CVE-2012-0862) --- xinetd-2.3.14-tcpmux-nonmux-security.patch | 49 ++++++++++++++++++++++ xinetd.spec | 9 +++- 2 files changed, 57 insertions(+), 1 deletion(-) create mode 100644 xinetd-2.3.14-tcpmux-nonmux-security.patch diff --git a/xinetd-2.3.14-tcpmux-nonmux-security.patch b/xinetd-2.3.14-tcpmux-nonmux-security.patch new file mode 100644 index 0000000..115ae81 --- /dev/null +++ b/xinetd-2.3.14-tcpmux-nonmux-security.patch @@ -0,0 +1,49 @@ +--- xinetd-2.3.14/xinetd/builtins.c.old 2012-02-15 16:29:48.263844700 -0600 ++++ xinetd-2.3.14/xinetd/builtins.c 2012-02-15 16:37:52.209594438 -0600 +@@ -560,17 +560,16 @@ + /* Found the pointer. Validate its type. + */ + scp = SVC_CONF( sp ); +-/* +- if ( ! SVC_IS_MUXCLIENT( sp ) ) ++ ++ if ( ! SVC_IS_MUXCLIENT( sp ) && ! SVC_IS_MUXPLUSCLIENT( sp ) ) + { + if ( debug.on ) + { + msg(LOG_DEBUG, "tcpmux_handler", "Non-tcpmux service name: %s.", + svc_name); + } +- exit(0); ++ continue; + } +-*/ + + /* Send the accept string if we're a PLUS (+) client. + */ +@@ -597,6 +596,19 @@ + msg(LOG_DEBUG, "tcpmux_handler", "Service name %s not found.", + svc_name); + } ++ ++ /* If a service was not found, we should say so. */ ++ if ( Swrite( descriptor, TCPMUX_NOT_FOUND, sizeof( TCPMUX_NOT_FOUND ) ) != ++ sizeof ( TCPMUX_NOT_FOUND ) ) ++ { ++ msg(LOG_ERR, "tcpmux_handler", "Not found write failed for %s.", ++ svc_name); ++ exit(0); ++ } ++ ++ /* Flush and exit, nothing to do */ ++ Sflush( descriptor ); ++ Sclose( descriptor ); + exit(0); + } + +--- xinetd-2.3.14/xinetd/service.h.old 2012-02-15 16:29:34.186942629 -0600 ++++ xinetd-2.3.14/xinetd/service.h 2012-02-15 16:30:19.009446694 -0600 +@@ -114,2 +114,3 @@ + #define TCPMUX_ACK "+Go\r\n" ++#define TCPMUX_NOT_FOUND "-Service name not found\r\n" + /* diff --git a/xinetd.spec b/xinetd.spec index 8a94d6c..c53f0e2 100644 --- a/xinetd.spec +++ b/xinetd.spec @@ -1,7 +1,7 @@ Summary: A secure replacement for inetd Name: xinetd Version: 2.3.14 -Release: 36%{?dist} +Release: 37%{?dist} License: xinetd Group: System Environment/Daemons Epoch: 2 @@ -43,6 +43,8 @@ Patch17: xinetd-2.3.13-log-crash.patch Patch18: xinetd-2.3.14-rpc-specific-port.patch Patch19: xinetd-2.3.14-signal-log-hang.patch Patch20: xinetd-2.3.14-fix-type-punned-ptr.patch +# CVE-2012-0862 +Patch21: xinetd-2.3.14-tcpmux-nonmux-security.patch BuildRequires: autoconf, automake BuildRequires: libselinux-devel >= 1.30 @@ -91,6 +93,7 @@ located in the /etc/xinetd.d directory. %patch18 -p1 -b .rpc-specific-port %patch19 -p1 -b .signal-log-hang %patch20 -p1 -b .fix-type-punned-ptr +%patch21 -p1 -b .tcpmux-security aclocal autoconf @@ -152,6 +155,10 @@ fi %{_mandir}/*/* %changelog +* Thu May 17 2012 Jan Synáček - 2:2.3.14-37 +- Fix tcpmux security +- Resolves: #820318 (CVE-2012-0862) + * Thu Apr 21 2011 Vojtech Vitek (V-Teq) - 2:2.3.14-36 - Fix build warning about "dereferencing type-punned pointer" Related: #695674