From b62be9b2abcd217b1c78d86035036bcf912dc47b Mon Sep 17 00:00:00 2001 From: Timo Aaltonen Date: Wed, 6 Apr 2011 17:45:19 +0300 Subject: [PATCH] Security update --- debian/changelog | 10 ++ debian/patches/CVE-2011-0465.diff | 178 ++++++++++++++++++++++++++++++ debian/patches/series | 1 + 3 files changed, 189 insertions(+) create mode 100644 debian/patches/CVE-2011-0465.diff diff --git a/debian/changelog b/debian/changelog index 84c6d15..1180387 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,13 @@ +x11-xserver-utils (7.5+2ubuntu1.1) maverick-security; urgency=low + + * SECURITY UPDATE: root escalation via rogue hostname (LP: #752315) + - xrdb: Create shell-escape-safe cpp options in the non-pathetic-cpp + case. + - http://cgit.freedesktop.org/xorg/app/xrdb/commit/?id=1027d5df07398c1507fb1fe3a9981aa6b4bc3a56 + - CVE-2011-0465 + + -- Timo Aaltonen Wed, 06 Apr 2011 17:44:41 +0300 + x11-xserver-utils (7.5+2ubuntu1) maverick; urgency=low * Merge from debian unstable. Remaining Ubuntu changes: diff --git a/debian/patches/CVE-2011-0465.diff b/debian/patches/CVE-2011-0465.diff new file mode 100644 index 0000000..9599a45 --- /dev/null +++ b/debian/patches/CVE-2011-0465.diff @@ -0,0 +1,178 @@ +commit 4ca7e1a5e4e9d52d062175e10c8fd58e218dea41 +Author: Matthias Hopf +Date: Tue Mar 1 19:37:34 2011 +0100 + + xrdb: Create shell-escape-safe cpp options in the non-pathetic-cpp case. + + Fixes CVE-2011-0465. + + Signed-off-by: Matthias Hopf + Reviewed-by: Adam Jackson + Signed-off-by: Julien Cristau + +diff --git a/xrdb/xrdb.c b/xrdb/xrdb.c +index 6d266e5..bece59c 100644 +--- a/xrdb/xrdb.c ++++ b/xrdb/xrdb.c +@@ -144,6 +144,8 @@ Entries newDB; + + static void fatal(char *, ...); + static void addstring ( String *arg, const char *s ); ++static void addescapedstring ( String *arg, const char *s ); ++static void addtokstring ( String *arg, const char *s ); + static void FormatEntries ( Buffer *buffer, Entries *entries ); + static void StoreProperty ( Display *dpy, Window root, Atom res_prop ); + static void Process ( int scrno, Bool doScreen, Bool execute ); +@@ -393,14 +395,20 @@ AddDef(String *buff, char *title, char *value) + addstring(buff, " -D"); + } else + addstring(buff, "-D"); +- addstring(buff, title); ++ addtokstring(buff, title); + if (value && (value[0] != '\0')) { + addstring(buff, "="); +- addstring(buff, value); ++ addescapedstring(buff, value); + } + } + + static void ++AddSimpleDef(String *buff, char *title) ++{ ++ AddDef(buff, title, (char *)NULL); ++} ++ ++static void + AddDefQ(String *buff, char *title, char *value) + { + #ifdef PATHETICCPP +@@ -409,8 +417,9 @@ AddDefQ(String *buff, char *title, char *value) + else + #endif + if (value && (value[0] != '\0')) { +- AddDef(buff, title, "\""); +- addstring(buff, value); ++ AddSimpleDef(buff, title); ++ addstring(buff, "=\""); ++ addescapedstring(buff, value); + addstring(buff, "\""); + } else + AddDef(buff, title, NULL); +@@ -425,24 +434,28 @@ AddNum(String *buff, char *title, int value) + } + + static void +-AddSimpleDef(String *buff, char *title) ++AddDefTok(String *buff, char *prefix, char *title) + { +- AddDef(buff, title, (char *)NULL); ++ char name[512]; ++ ++ snprintf(name, sizeof(name), "%s%s", prefix, title); ++ AddSimpleDef(buff, name); + } + + static void +-AddDefTok(String *buff, char *prefix, char *title) ++AddDefHostname(String *buff, char *title, char *value) + { + char *s; + char name[512]; + char c; + +- snprintf(name, sizeof(name), "%s%s", prefix, title); ++ strncpy (name, value, sizeof(name)-1); ++ name[sizeof(name)-1] = '\0'; + for (s = name; (c = *s); s++) { +- if (!isalpha(c) && !isdigit(c) && c != '_') ++ if (!isalpha(c) && !isdigit(c) && c != '_' && c != '.' && c != ':' && c != '-') + *s = '_'; + } +- AddSimpleDef(buff, name); ++ AddDef(buff, title, name); + } + + static void +@@ -462,7 +475,7 @@ AddUndef(String *buff, char *title) + addstring(buff, " -U"); + } else + addstring(buff, "-U"); +- addstring(buff, title); ++ addtokstring(buff, title); + } + + static void +@@ -522,11 +535,11 @@ DoDisplayDefines(Display *display, String *defs, char *host) + } + if (!*server || !strcmp(server, "unix") || !strcmp(server, "localhost")) + strcpy(server, client); +- AddDef(defs, "HOST", server); /* R3 compatibility */ +- AddDef(defs, "SERVERHOST", server); ++ AddDefHostname(defs, "HOST", server); /* R3 compatibility */ ++ AddDefHostname(defs, "SERVERHOST", server); + AddDefTok(defs, "SRVR_", server); + AddNum(defs, "DISPLAY_NUM", n); +- AddDef(defs, "CLIENTHOST", client); ++ AddDefHostname(defs, "CLIENTHOST", client); + AddDefTok(defs, "CLNT_", client); + AddNum(defs, "VERSION", ProtocolVersion(display)); + AddNum(defs, "REVISION", ProtocolRevision(display)); +@@ -569,7 +582,7 @@ DoScreenDefines(Display *display, int scrno, String *defs) + AddNum(defs, "Y_RESOLUTION", Resolution(screen->height,screen->mheight)); + AddNum(defs, "PLANES", DisplayPlanes(display, scrno)); + AddNum(defs, "BITS_PER_RGB", visual->bits_per_rgb); +- AddDef(defs, "CLASS", ClassNames[visual->class]); ++ AddDefQ(defs, "CLASS", ClassNames[visual->class]); + snprintf(name, sizeof(name), "CLASS_%s", ClassNames[visual->class]); + AddNum(defs, name, (int)visual->visualid); + switch(visual->class) { +@@ -762,6 +775,40 @@ addstring(String *arg, const char *s) + arg->used += strlen(s); + } + ++static void ++addescapedstring(String *arg, const char *s) ++{ ++ char copy[512], *c; ++ ++ for (c = copy; *s && c < ©[sizeof(copy)-1]; s++) { ++ switch (*s) { ++ case '"': case '\'': case '`': ++ case '$': case '\\': ++ *c++ = '_'; ++ break; ++ default: ++ *c++ = *s; ++ } ++ } ++ *c = 0; ++ addstring (arg, copy); ++} ++ ++static void ++addtokstring(String *arg, const char *s) ++{ ++ char copy[512], *c; ++ ++ for (c = copy; *s && c < ©[sizeof(copy)-1]; s++) { ++ if (!isalpha(*s) && !isdigit(*s) && *s != '_') ++ *c++ = '_'; ++ else ++ *c++ = *s; ++ } ++ *c = 0; ++ addstring (arg, copy); ++} ++ + + int + main(int argc, char *argv[]) +@@ -857,7 +904,7 @@ main(int argc, char *argv[]) + continue; + } else if (arg[1] == 'I') { + addstring(&includes, " "); +- addstring(&includes, arg); ++ addescapedstring(&includes, arg); + continue; + } else if (arg[1] == 'U' || arg[1] == 'D') { + if (num_cmd_defines < MAX_CMD_DEFINES) { diff --git a/debian/patches/series b/debian/patches/series index 8ed6665..31436f3 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -1,2 +1,3 @@ 01_sessreg_implement_hostname_hashing.diff 101_xset_spellfix.patch +CVE-2011-0465.diff