diff options
author | tron <tron> | 2010-07-01 18:50:14 +0000 |
---|---|---|
committer | tron <tron> | 2010-07-01 18:50:14 +0000 |
commit | bde2f91a67b7b520faeed5350cdc1b1677cf3d96 (patch) | |
tree | 6987edd3ff9ee459dc7ab36ccdf3dab1e4825425 /www/w3m/patches | |
parent | baf113f2b890933410b158dcca55f8544a3450d3 (diff) | |
download | pkgsrc-bde2f91a67b7b520faeed5350cdc1b1677cf3d96.tar.gz |
Add patch by Ludwig Nussel to fix the certificate spoofing vulnerability
reported in CVE-2010-2074.
Diffstat (limited to 'www/w3m/patches')
-rw-r--r-- | www/w3m/patches/patch-ac | 26 | ||||
-rw-r--r-- | www/w3m/patches/patch-ad | 58 |
2 files changed, 84 insertions, 0 deletions
diff --git a/www/w3m/patches/patch-ac b/www/w3m/patches/patch-ac new file mode 100644 index 00000000000..72bd7607ffa --- /dev/null +++ b/www/w3m/patches/patch-ac @@ -0,0 +1,26 @@ +$NetBSD: patch-ac,v 1.14 2010/07/01 18:50:15 tron Exp $ + +Fix for CVE-2010-2074 taken from here: + +http://www.openwall.com/lists/oss-security/2010/06/14/4 + +--- fm.h.orig 2007-05-30 05:47:24.000000000 +0100 ++++ fm.h 2010-07-01 19:26:27.000000000 +0100 +@@ -1119,7 +1119,7 @@ + #endif + + #if defined(USE_SSL) && defined(USE_SSL_VERIFY) +-global int ssl_verify_server init(FALSE); ++global int ssl_verify_server init(TRUE); + global char *ssl_cert_file init(NULL); + global char *ssl_key_file init(NULL); + global char *ssl_ca_path init(NULL); +@@ -1128,7 +1128,7 @@ + #endif /* defined(USE_SSL) && + * defined(USE_SSL_VERIFY) */ + #ifdef USE_SSL +-global char *ssl_forbid_method init(NULL); ++global char *ssl_forbid_method init("2"); + #endif + + global int is_redisplay init(FALSE); diff --git a/www/w3m/patches/patch-ad b/www/w3m/patches/patch-ad new file mode 100644 index 00000000000..f07418010e9 --- /dev/null +++ b/www/w3m/patches/patch-ad @@ -0,0 +1,58 @@ +$NetBSD: patch-ad,v 1.8 2010/07/01 18:50:15 tron Exp $ + +Fix for CVE-2010-2074 taken from here: + +http://www.openwall.com/lists/oss-security/2010/06/14/4 + +--- istream.c.orig 2007-05-23 16:06:05.000000000 +0100 ++++ istream.c 2010-07-01 19:31:00.000000000 +0100 +@@ -447,8 +447,17 @@ + + if (!seen_dnsname) + seen_dnsname = Strnew(); ++ /* replace \0 to make full string visible to user */ ++ if (sl != strlen(sn)) { ++ int i; ++ for (i = 0; i < sl; ++i) { ++ if (!sn[i]) ++ sn[i] = '!'; ++ } ++ } + Strcat_m_charp(seen_dnsname, sn, " ", NULL); +- if (ssl_match_cert_ident(sn, sl, hostname)) ++ if (sl == strlen(sn) /* catch \0 in SAN */ ++ && ssl_match_cert_ident(sn, sl, hostname)) + break; + } + } +@@ -466,16 +475,27 @@ + if (match_ident == FALSE && ret == NULL) { + X509_NAME *xn; + char buf[2048]; ++ int slen; + + xn = X509_get_subject_name(x); + +- if (X509_NAME_get_text_by_NID(xn, NID_commonName, +- buf, sizeof(buf)) == -1) ++ slen = X509_NAME_get_text_by_NID(xn, NID_commonName, buf, sizeof(buf)); ++ if ( slen == -1) + /* FIXME: gettextize? */ + ret = Strnew_charp("Unable to get common name from peer cert"); +- else if (!ssl_match_cert_ident(buf, strlen(buf), hostname)) ++ else if (slen != strlen(buf) ++ || !ssl_match_cert_ident(buf, strlen(buf), hostname)) { ++ /* replace \0 to make full string visible to user */ ++ if (slen != strlen(buf)) { ++ int i; ++ for (i = 0; i < slen; ++i) { ++ if (!buf[i]) ++ buf[i] = '!'; ++ } ++ } + /* FIXME: gettextize? */ + ret = Sprintf("Bad cert ident %s from %s", buf, hostname); ++ } + else + match_ident = TRUE; + } |