Hello community, here is the log from the commit of package cron for openSUSE:Factory checked in at Fri Nov 27 13:55:31 CET 2009. -------- --- cron/cron.changes 2009-11-20 10:16:28.000000000 +0100 +++ /mounts/work_src_done/STABLE/cron/cron.changes 2009-11-27 10:52:06.000000000 +0100 @@ -1,0 +2,6 @@ +Fri Nov 27 10:08:49 UTC 2009 - mseben@novell.com + +- added initgroups_check.patch : verify return value of + initgroups (bnc#537178) (CVE-2006-2607) + +------------------------------------------------------------------- calling whatdependson for head-i586 New: ---- vixie-cron-4.1-initgroups_check.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ cron.spec ++++++ --- /var/tmp/diff_new_pack.UenWrl/_old 2009-11-27 13:54:56.000000000 +0100 +++ /var/tmp/diff_new_pack.UenWrl/_new 2009-11-27 13:54:56.000000000 +0100 @@ -28,7 +28,7 @@ AutoReqProv: on PreReq: permissions %fillup_prereq %insserv_prereq Version: 4.1 -Release: 204 +Release: 205 Summary: Cron Daemon Source0: vixie-%name-%version.tar.bz2 Source1: %name.init @@ -55,6 +55,8 @@ Patch17: vixie-cron-4.1-restrict_link_count.patch Patch18: vixie-cron-4.1-remove_old_system.patch Patch19: vixie-cron-4.1-selinux.diff +#PATCH-FIX-UPSTREAM verify return value of initgroups (bnc#537178) (CVE-2006-2607) +Patch20: vixie-cron-4.1-initgroups_check.patch BuildRoot: %{_tmppath}/%{name}-%{version}-build %description @@ -93,6 +95,7 @@ %patch17 -p1 %patch18 -p1 %patch19 -p1 +%patch20 -p1 %build make DEFS="$RPM_OPT_FLAGS -DWITH_PAM -DWITH_SELINUX -Wno-comment -fpie -fstack-protector" LDFLAGS="-pie" ++++++ vixie-cron-4.1-initgroups_check.patch ++++++ Index: vixie-cron-4.1/do_command.c =================================================================== --- vixie-cron-4.1.orig/do_command.c +++ vixie-cron-4.1/do_command.c @@ -331,8 +331,12 @@ child_process(entry *e, user *u) { } } #else - - initgroups(usernm, e->pwd->pw_gid); + if (initgroups(usernm, e->pwd->pw_gid) !=0) { + char msg[256]; + snprintf(msg, 256, "do_command:initgroups(%lu) failed: %s",(unsigned long) e->pwd->pw_gid, strerror(errno)); + log_it("CRON",getpid(),"error",msg); + exit(ERROR_EXIT); + } #if (defined(BSD)) && (BSD >= 199103) setlogin(usernm); #endif /* BSD */ ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Remember to have fun... -- To unsubscribe, e-mail: opensuse-commit+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-commit+help@opensuse.org