diff options
| author | Tatsuya Kinoshita <tats@vega.ocn.ne.jp> | 2011-05-04 07:36:06 +0000 |
|---|---|---|
| committer | Tatsuya Kinoshita <tats@vega.ocn.ne.jp> | 2011-05-04 07:36:06 +0000 |
| commit | dfe4acf8454e10bce983c1bb291f24f91e2f4e0c (patch) | |
| tree | df8554f65d302c2b6e697af6d6d77d7c908c4478 | |
| parent | Releasing debian version 0.5.2-2 (diff) | |
| download | w3m-debian/0.5.2-2+lenny1.tar.gz w3m-debian/0.5.2-2+lenny1.zip | |
Releasing debian version 0.5.2-2+lenny1debian/0.5.2-2+lenny1
| -rw-r--r-- | debian/changelog | 7 | ||||
| -rw-r--r-- | debian/patches/60_check-null-cn.patch | 57 | ||||
| -rw-r--r-- | debian/patches/series | 1 |
3 files changed, 65 insertions, 0 deletions
diff --git a/debian/changelog b/debian/changelog index a2820aa..5f0e128 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,10 @@ +w3m (0.5.2-2+lenny1) stable; urgency=high + + * debian/patches/60_check-null-cn.patch: Patch to check for null bytes + in CN/subjAltName, provided by Ludwig Nussel. [CVE-2010-2074] + + -- Tatsuya Kinoshita <tats@debian.org> Sat, 03 Jul 2010 20:53:06 +0900 + w3m (0.5.2-2) unstable; urgency=low * debian/control: diff --git a/debian/patches/60_check-null-cn.patch b/debian/patches/60_check-null-cn.patch new file mode 100644 index 0000000..fdab45c --- /dev/null +++ b/debian/patches/60_check-null-cn.patch @@ -0,0 +1,57 @@ +Description: Check for null bytes in CN/subjAltName +Origin: http://www.openwall.com/lists/oss-security/2010/06/14/4 +Author: Ludwig Nussel <ludwig.nussel@suse.de> +Bug-Debian: http://bugs.debian.org/587445 + +--- w3m-0.5.2.orig/istream.c ++++ w3m-0.5.2/istream.c +@@ -447,8 +447,17 @@ ssl_check_cert_ident(X509 * x, char *hos + + if (!seen_dnsname) + seen_dnsname = Strnew(); ++ /* replace \0 to make full string visible to user */ ++ if (sl != strlen(sn)) { ++ int i; ++ for (i = 0; i < sl; ++i) { ++ if (!sn[i]) ++ sn[i] = '!'; ++ } ++ } + Strcat_m_charp(seen_dnsname, sn, " ", NULL); +- if (ssl_match_cert_ident(sn, sl, hostname)) ++ if (sl == strlen(sn) /* catch \0 in SAN */ ++ && ssl_match_cert_ident(sn, sl, hostname)) + break; + } + } +@@ -466,16 +475,27 @@ ssl_check_cert_ident(X509 * x, char *hos + if (match_ident == FALSE && ret == NULL) { + X509_NAME *xn; + char buf[2048]; ++ int slen; + + xn = X509_get_subject_name(x); + +- if (X509_NAME_get_text_by_NID(xn, NID_commonName, +- buf, sizeof(buf)) == -1) ++ slen = X509_NAME_get_text_by_NID(xn, NID_commonName, buf, sizeof(buf)); ++ if ( slen == -1) + /* FIXME: gettextize? */ + ret = Strnew_charp("Unable to get common name from peer cert"); +- else if (!ssl_match_cert_ident(buf, strlen(buf), hostname)) ++ else if (slen != strlen(buf) ++ || !ssl_match_cert_ident(buf, strlen(buf), hostname)) { ++ /* replace \0 to make full string visible to user */ ++ if (slen != strlen(buf)) { ++ int i; ++ for (i = 0; i < slen; ++i) { ++ if (!buf[i]) ++ buf[i] = '!'; ++ } ++ } + /* FIXME: gettextize? */ + ret = Sprintf("Bad cert ident %s from %s", buf, hostname); ++ } + else + match_ident = TRUE; + } diff --git a/debian/patches/series b/debian/patches/series index e55a89f..04346de 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -1,3 +1,4 @@ 03-w3m.1-debian-fix 04-ja-w3m.1-debian-fix 05-config-debian-fix +60_check-null-cn.patch |