Hello community,
here is the log from the commit of package quagga for openSUSE:11.4
checked in at Thu Oct 13 17:35:05 CEST 2011.
--------
--- old-versions/11.4/UPDATES/all/quagga/quagga.changes 2011-06-02 13:30:16.000000000 +0200
+++ 11.4/quagga/quagga.changes 2011-09-19 04:11:37.000000000 +0200
@@ -1,0 +2,28 @@
+Mon Sep 19 02:05:55 UTC 2011 - boyang@suse.com
+
+- DoS while decoding EXTENDED_COMMUNITIES in Quagga's BGP
+ [bnc#718062]
+
+-------------------------------------------------------------------
+Mon Sep 19 02:05:25 UTC 2011 - boyang@suse.com
+
+- OSPFD DoS while decoding Link State Update [bnc#718061]
+
+-------------------------------------------------------------------
+Mon Sep 19 02:04:52 UTC 2011 - boyang@suse.com
+
+- OSPFD DoS while decoding Hello packet [bnc#718059]
+
+-------------------------------------------------------------------
+Mon Sep 19 02:04:08 UTC 2011 - boyang@suse.com
+
+- OSPF6D DoS while decoding Database Description packet
+ [bnc#718058]
+
+-------------------------------------------------------------------
+Mon Sep 19 02:00:52 UTC 2011 - boyang@suse.com
+
+- OSPF6D buffer overflow while decoding Link State Update with
+ Inter Area Prefix Lsa [bnc#718056]
+
+-------------------------------------------------------------------
calling whatdependson for 11.4-i586
New:
----
bug-718056_quagga-0.99.18-514840.patch
bug-718058_quagga-master-514839.patch
bug-718059_quagga-master-514838.1.patch
bug-718059_quagga-master-514838.2.patch
bug-718061_quagga-master-514837.patch
bug-718062_quagga-master-513254.patch
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ quagga.spec ++++++
--- /var/tmp/diff_new_pack.o0InyW/_old 2011-10-13 17:34:54.000000000 +0200
+++ /var/tmp/diff_new_pack.o0InyW/_new 2011-10-13 17:34:54.000000000 +0200
@@ -19,7 +19,7 @@
Name: quagga
Version: 0.99.17
-Release: 4.<RELEASE7>
+Release: 4.<RELEASE11>
License: LGPLv2.1+
Summary: Free Routing Software (for BGP, OSPF and RIP, for example)
Url: http://www.quagga.net
@@ -29,6 +29,12 @@
Source2: %{name}.pam
Patch0: %{name}-0.99.17-CVE-2010-1674.patch
Patch1: %{name}-0.99.17-CVE-2010-1675.patch
+Patch2: bug-718056_quagga-0.99.18-514840.patch
+Patch3: bug-718058_quagga-master-514839.patch
+Patch4: bug-718059_quagga-master-514838.1.patch
+Patch5: bug-718059_quagga-master-514838.2.patch
+Patch6: bug-718061_quagga-master-514837.patch
+Patch7: bug-718062_quagga-master-513254.patch
BuildRequires: net-snmp-devel
BuildRequires: pam-devel
BuildRequires: readline-devel
@@ -68,6 +74,12 @@
%setup -q -a 1
%patch0 -p 1
%patch1 -p 1
+%patch2 -p 1
+%patch3 -p 1
+%patch4 -p 1
+%patch5 -p 1
+%patch6 -p 1
+%patch7 -p 1
%build
if ! ls /proc/net/{dev,route,snmp} >/dev/null; then
++++++ bug-718056_quagga-0.99.18-514840.patch ++++++
++++ 793 lines (skipped)
++++++ bug-718058_quagga-master-514839.patch ++++++
commit 814a21b1a5af7b942e67ddf49e4b3eb3fd9353a6
Author: Denis Ovsienko
Date: Thu Sep 1 18:48:42 2011 +0400
ospf6d: CERT-FI #514839 (DD LSA assertion)
This vulnerability was reported by CROSS project.
When Database Description LSA header list contains trailing zero octets,
ospf6d tries to process this data as an LSA header. This triggers an
assertion in the code and ospf6d shuts down.
* ospf6_lsa.c
* ospf6_lsa_is_changed(): handle header-only argument(s)
appropriately, do not treat LSA length underrun as a fatal error.
diff --git a/ospf6d/ospf6_lsa.c b/ospf6d/ospf6_lsa.c
index c1db374..a9545c3 100644
--- a/ospf6d/ospf6_lsa.c
+++ b/ospf6d/ospf6_lsa.c
@@ -163,9 +163,19 @@ ospf6_lsa_is_changed (struct ospf6_lsa *lsa1,
return 1;
if (ntohs (lsa1->header->length) != ntohs (lsa2->header->length))
return 1;
+ /* Going beyond LSA headers to compare the payload only makes sense, when both LSAs aren't header-only. */
+ if (CHECK_FLAG (lsa1->flag, OSPF6_LSA_HEADERONLY) != CHECK_FLAG (lsa2->flag, OSPF6_LSA_HEADERONLY))
+ {
+ zlog_warn ("%s: only one of two (%s, %s) LSAs compared is header-only", __func__, lsa1->name, lsa2->name);
+ return 1;
+ }
+ if (CHECK_FLAG (lsa1->flag, OSPF6_LSA_HEADERONLY))
+ return 0;
length = OSPF6_LSA_SIZE (lsa1->header) - sizeof (struct ospf6_lsa_header);
- assert (length > 0);
+ /* Once upper layer verifies LSAs received, length underrun should become a warning. */
+ if (length <= 0)
+ return 0;
return memcmp (OSPF6_LSA_HEADER_END (lsa1->header),
OSPF6_LSA_HEADER_END (lsa2->header), length);
++++++ bug-718059_quagga-master-514838.1.patch ++++++
commit 6952d9a10f29b29ae79a7329a882da5938dda553
Author: Denis Ovsienko
Date: Thu Sep 1 18:46:51 2011 +0400
ospfd: CERT-FI #514838.1 (OSPF header underrun)
This vulnerability was reported by CROSS project.
When only 14 first bytes of a Hello packet is delivered, ospfd crashes.
* ospf_packet.c
* ospf_read(): add size check
diff --git a/ospfd/ospf_packet.c b/ospfd/ospf_packet.c
index 1066e64..7227452 100644
--- a/ospfd/ospf_packet.c
+++ b/ospfd/ospf_packet.c
@@ -2367,10 +2367,19 @@ ospf_read (struct thread *thread)
return 0;
}
- /* Adjust size to message length. */
+ /* Advance from IP header to OSPF header (iph->ip_hl has been verified
+ by ospf_recv_packet() to be correct). */
stream_forward_getp (ibuf, iph->ip_hl * 4);
-
- /* Get ospf packet header. */
+
+ /* Make sure the OSPF header is really there. */
+ if (stream_get_endp (ibuf) - stream_get_getp (ibuf) < OSPF_HEADER_SIZE)
+ {
+ zlog_debug ("ospf_read: ignored OSPF packet with undersized (%u bytes) header",
+ stream_get_endp (ibuf) - stream_get_getp (ibuf));
+ return -1;
+ }
+
+ /* Now it is safe to access all fields of OSPF packet header. */
ospfh = (struct ospf_header *) STREAM_PNT (ibuf);
/* associate packet with ospf interface */
++++++ bug-718059_quagga-master-514838.2.patch ++++++
commit 399339cc74071a056e28f7233e3d31b48704139e
Author: Denis Ovsienko
Date: Thu Sep 1 18:47:35 2011 +0400
ospfd: CERT-FI #514838.2 (OSPF pkt type segfault)
This vulnerability was reported by CROSS project.
The error is reproducible only when ospfd debugging is enabled:
* debug ospf packet all
* debug ospf zebra
When incoming packet header type field is set to 0x0a, ospfd will crash.
* ospf_packet.c
* ospf_verify_header(): add type field check
* ospf_read(): perform input checks early
diff --git a/ospfd/ospf_packet.c b/ospfd/ospf_packet.c
index 7227452..489b928 100644
--- a/ospfd/ospf_packet.c
+++ b/ospfd/ospf_packet.c
@@ -2258,6 +2258,13 @@ ospf_verify_header (struct stream *ibuf, struct ospf_interface *oi,
return -1;
}
+ /* Valid OSPFv2 packet types are 1 through 5 inclusive. */
+ if (ospfh->type < 1 || ospfh->type > 5)
+ {
+ zlog_warn ("interface %s: invalid packet type %u", IF_NAME (oi), ospfh->type);
+ return -1;
+ }
+
/* Check Area ID. */
if (!ospf_check_area_id (oi, ospfh))
{
@@ -2385,6 +2392,17 @@ ospf_read (struct thread *thread)
/* associate packet with ospf interface */
oi = ospf_if_lookup_recv_if (ospf, iph->ip_src, ifp);
+ /* Verify header fields before any further processing. */
+ ret = ospf_verify_header (ibuf, oi, iph, ospfh);
+ if (ret < 0)
+ {
+ if (IS_DEBUG_OSPF_PACKET (0, RECV))
+ zlog_debug ("ospf_read[%s]: Header check failed, "
+ "dropping.",
+ inet_ntoa (iph->ip_src));
+ return ret;
+ }
+
/* If incoming interface is passive one, ignore it. */
if (oi && OSPF_IF_PASSIVE_STATUS (oi) == OSPF_IF_PASSIVE)
{
@@ -2494,20 +2512,6 @@ ospf_read (struct thread *thread)
zlog_debug ("-----------------------------------------------------");
}
- /* Some header verification. */
- ret = ospf_verify_header (ibuf, oi, iph, ospfh);
- if (ret < 0)
- {
- if (IS_DEBUG_OSPF_PACKET (ospfh->type - 1, RECV))
- {
- zlog_debug ("ospf_read[%s/%s]: Header check failed, "
- "dropping.",
- ospf_packet_type_str[ospfh->type],
- inet_ntoa (iph->ip_src));
- }
- return ret;
- }
-
stream_forward_getp (ibuf, OSPF_HEADER_SIZE);
/* Adjust size to message length. */
++++++ bug-718061_quagga-master-514837.patch ++++++
commit ef53ed9691c435a50b3addf44b733a60ad022597
Author: Denis Ovsienko
Date: Thu Sep 1 18:45:55 2011 +0400
ospfd: CERT-FI #514837 (uknown LSA type segfault)
This vulnerability was reported by CROSS project. They have also
suggested a fix to the problem, which was found acceptable.
Quagga ospfd does not seem to handle unknown LSA types in a Link State
Update message correctly. If LSA type is something else than one
supported by Quagga, the default handling of unknown types leads to an
error.
* ospf_flood.c
* ospf_flood(): check return value of ospf_lsa_install()
diff --git a/ospfd/ospf_flood.c b/ospfd/ospf_flood.c
index 41661da..fc0bbf1 100644
--- a/ospfd/ospf_flood.c
+++ b/ospfd/ospf_flood.c
@@ -319,7 +319,8 @@ ospf_flood (struct ospf *ospf, struct ospf_neighbor *nbr,
procedure cannot overwrite the newly installed LSA until
MinLSArrival seconds have elapsed. */
- new = ospf_lsa_install (ospf, nbr->oi, new);
+ if (! (new = ospf_lsa_install (ospf, nbr->oi, new)))
+ return 0; /* unknown LSA type */
/* Acknowledge the receipt of the LSA by sending a Link State
Acknowledgment packet back out the receiving interface. */
++++++ bug-718062_quagga-master-513254.patch ++++++
commit d850aabc9bca322dd366d4d3ee2d82b4dddc96d6
Author: Denis Ovsienko
Date: Thu Sep 1 18:31:57 2011 +0400
bgpd: CERT-FI #513254 (ext. comm. buffer overflow)
This vulnerability was reported by CROSS project. They have also
suggested a fix to the problem, which was found acceptable.
The problem occurs when bgpd receives an UPDATE message containing
255 unknown AS_PATH attributes in Path Attribute Extended Communities.
This causes a buffer overlow in bgpd.
* bgp_ecommunity.c
* ecommunity_ecom2str(): perform size check earlier
diff --git a/bgpd/bgp_ecommunity.c b/bgpd/bgp_ecommunity.c
index 8d5fa74..e7eb0a0 100644
--- a/bgpd/bgp_ecommunity.c
+++ b/bgpd/bgp_ecommunity.c
@@ -619,6 +619,13 @@ ecommunity_ecom2str (struct ecommunity *ecom, int format)
for (i = 0; i < ecom->size; i++)
{
+ /* Make it sure size is enough. */
+ while (str_pnt + ECOMMUNITY_STR_DEFAULT_LEN >= str_size)
+ {
+ str_size *= 2;
+ str_buf = XREALLOC (MTYPE_ECOMMUNITY_STR, str_buf, str_size);
+ }
+
/* Space between each value. */
if (! first)
str_buf[str_pnt++] = ' ';
@@ -662,13 +669,6 @@ ecommunity_ecom2str (struct ecommunity *ecom, int format)
break;
}
- /* Make it sure size is enough. */
- while (str_pnt + ECOMMUNITY_STR_DEFAULT_LEN >= str_size)
- {
- str_size *= 2;
- str_buf = XREALLOC (MTYPE_ECOMMUNITY_STR, str_buf, str_size);
- }
-
/* Put string into buffer. */
if (encode == ECOMMUNITY_ENCODE_AS4)
{
continue with "q"...
Remember to have fun...
--
To unsubscribe, e-mail: opensuse-commit+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-commit+help@opensuse.org
