diff options
author | Vladimír Čunát <vcunat@gmail.com> | 2014-08-23 16:04:53 +0200 |
---|---|---|
committer | Vladimír Čunát <vcunat@gmail.com> | 2014-08-23 16:04:53 +0200 |
commit | 96cec2a7bdf2482ae58fe04cce5e87a1eec644f9 (patch) | |
tree | ea48b901c9ba0ac2b4a249ae94bd966c4a025001 /pkgs/os-specific/linux/pam | |
parent | db83d9a35b09a7cc548d9b8b2ad63c1f8ca8ba28 (diff) | |
parent | 084626deecaffcaa017af07eaab00682eff5d6f3 (diff) | |
download | nixpkgs-96cec2a7bdf2482ae58fe04cce5e87a1eec644f9.tar nixpkgs-96cec2a7bdf2482ae58fe04cce5e87a1eec644f9.tar.gz nixpkgs-96cec2a7bdf2482ae58fe04cce5e87a1eec644f9.tar.bz2 nixpkgs-96cec2a7bdf2482ae58fe04cce5e87a1eec644f9.tar.lz nixpkgs-96cec2a7bdf2482ae58fe04cce5e87a1eec644f9.tar.xz nixpkgs-96cec2a7bdf2482ae58fe04cce5e87a1eec644f9.tar.zst nixpkgs-96cec2a7bdf2482ae58fe04cce5e87a1eec644f9.zip |
Merge 'staging' into multiple-outputs
Conflicts: pkgs/applications/audio/flac/default.nix pkgs/build-support/gcc-wrapper/builder.sh pkgs/development/libraries/apr-util/default.nix pkgs/development/libraries/apr/default.nix pkgs/development/libraries/atk/default.nix pkgs/development/libraries/freetype/default.nix pkgs/development/libraries/gdk-pixbuf/default.nix pkgs/development/libraries/glib/default.nix pkgs/development/libraries/glibc/2.17/builder.sh pkgs/development/libraries/glibc/2.17/locales.nix pkgs/development/libraries/libjpeg/default.nix pkgs/development/libraries/libogg/default.nix pkgs/development/libraries/libsamplerate/default.nix pkgs/development/libraries/libtiff/default.nix pkgs/development/libraries/libvorbis/default.nix pkgs/development/libraries/mesa/default.nix pkgs/development/libraries/pango/default.nix pkgs/development/web/nodejs/default.nix pkgs/os-specific/linux/pam/default.nix pkgs/os-specific/linux/systemd/default.nix pkgs/stdenv/generic/setup.sh pkgs/stdenv/linux/default.nix pkgs/top-level/all-packages.nix pkgs/top-level/release-small.nix
Diffstat (limited to 'pkgs/os-specific/linux/pam')
-rw-r--r-- | pkgs/os-specific/linux/pam/CVE-2014-2583.patch | 49 | ||||
-rw-r--r-- | pkgs/os-specific/linux/pam/default.nix | 8 |
2 files changed, 54 insertions, 3 deletions
diff --git a/pkgs/os-specific/linux/pam/CVE-2014-2583.patch b/pkgs/os-specific/linux/pam/CVE-2014-2583.patch new file mode 100644 index 00000000000..25b1f7549fa --- /dev/null +++ b/pkgs/os-specific/linux/pam/CVE-2014-2583.patch @@ -0,0 +1,49 @@ +From 9dcead87e6d7f66d34e7a56d11a30daca367dffb Mon Sep 17 00:00:00 2001 +From: "Dmitry V. Levin" <ldv@altlinux.org> +Date: Wed, 26 Mar 2014 22:17:23 +0000 +Subject: pam_timestamp: fix potential directory traversal issue (ticket #27) + +pam_timestamp uses values of PAM_RUSER and PAM_TTY as components of +the timestamp pathname it creates, so extra care should be taken to +avoid potential directory traversal issues. + +* modules/pam_timestamp/pam_timestamp.c (check_tty): Treat +"." and ".." tty values as invalid. +(get_ruser): Treat "." and ".." ruser values, as well as any ruser +value containing '/', as invalid. + +Fixes CVE-2014-2583. + +Reported-by: Sebastian Krahmer <krahmer@suse.de> + +diff --git a/modules/pam_timestamp/pam_timestamp.c b/modules/pam_timestamp/pam_timestamp.c +index 5193733..b3f08b1 100644 +--- a/modules/pam_timestamp/pam_timestamp.c ++++ b/modules/pam_timestamp/pam_timestamp.c +@@ -158,7 +158,7 @@ check_tty(const char *tty) + tty = strrchr(tty, '/') + 1; + } + /* Make sure the tty wasn't actually a directory (no basename). */ +- if (strlen(tty) == 0) { ++ if (!strlen(tty) || !strcmp(tty, ".") || !strcmp(tty, "..")) { + return NULL; + } + return tty; +@@ -243,6 +243,17 @@ get_ruser(pam_handle_t *pamh, char *ruserbuf, size_t ruserbuflen) + if (pwd != NULL) { + ruser = pwd->pw_name; + } ++ } else { ++ /* ++ * This ruser is used by format_timestamp_name as a component ++ * of constructed timestamp pathname, so ".", "..", and '/' ++ * are disallowed to avoid potential path traversal issues. ++ */ ++ if (!strcmp(ruser, ".") || ++ !strcmp(ruser, "..") || ++ strchr(ruser, '/')) { ++ ruser = NULL; ++ } + } + if (ruser == NULL || strlen(ruser) >= ruserbuflen) { + *ruserbuf = '\0'; diff --git a/pkgs/os-specific/linux/pam/default.nix b/pkgs/os-specific/linux/pam/default.nix index 5545b5c16d6..8423ea6f123 100644 --- a/pkgs/os-specific/linux/pam/default.nix +++ b/pkgs/os-specific/linux/pam/default.nix @@ -1,13 +1,15 @@ { stdenv, fetchurl, flex, cracklib }: stdenv.mkDerivation rec { - name = "linux-pam-1.1.6"; + name = "linux-pam-1.1.8"; src = fetchurl { - url = https://fedorahosted.org/releases/l/i/linux-pam/Linux-PAM-1.1.6.tar.bz2; - sha256 = "1hlz2kqvbjisvwyicdincq7nz897b9rrafyzccwzqiqg53b8gf5s"; + url = http://www.linux-pam.org/library/Linux-PAM-1.1.8.tar.bz2; + sha256 = "0m8ygb40l1c13nsd4hkj1yh4p1ldawhhg8pyjqj9w5kd4cxg5cf4"; }; + patches = [ ./CVE-2014-2583.patch ]; + outputs = [ "out" "doc" "man" "modules" ]; nativeBuildInputs = [ flex ]; |