Merge lp:~davewalker/ubuntu/natty/isc-dhcp/lp_720729 into lp:ubuntu/natty/isc-dhcp

[Dave Walker]

[lp:~davewalker/ubuntu/natty/isc-dhcp/lp_720729]

17. By Dave Walker on 2011-02-17

Adjusted spacing on debian/patches/CVE-2011-0413.dpatch

=== modified file 'debian/changelog'
--- debian/changelog	2010-12-09 11:21:53 +0000
+++ debian/changelog	2011-02-17 17:44:59 +0000
@@ -1,3 +1,15 @@
+isc-dhcp (4.1.1-P1-15ubuntu3) natty; urgency=low
+
+  * SECURITY UPDATE: denial of service via processing of message from an address
+    that was previously declined, causing assert failure. (LP: #720729)
+    - debian/patches/CVE-2011-0413.dpatch: Reclaim the previously abandoned 
+      address in isc-dhcp/server/mdb6.c, by retagging the lease and adding
+      a sane expiration value.  Based on changes between upstream releases 
+      4.1.2 and 4.1.2-P1
+    - CVE-2011-0413
+
+ -- Dave Walker (Daviey) <[e-mail]>  Thu, 17 Feb 2011 16:24:57 +0000
+
 isc-dhcp (4.1.1-P1-15ubuntu2) natty; urgency=low
 
   * debian/apparmor-profile.dhcpd: allow read access to @{PROC}/[0-9]*/net/dev
 
=== modified file 'debian/patches/00list'
--- debian/patches/00list	2010-12-06 14:23:12 +0000
+++ debian/patches/00list	2011-02-17 17:44:59 +0000
@@ -11,6 +11,8 @@
 
 # Backported from 4.1.2
 CVE-2010-3611
+# Ported from 4.1-ESV
+CVE-2011-0413
 
 # Ubuntu patches (see patch headers)
 # emailed upstream
 
=== added file 'debian/patches/CVE-2011-0413.dpatch'
--- debian/patches/CVE-2011-0413.dpatch	1970-01-01 00:00:00 +0000
+++ debian/patches/CVE-2011-0413.dpatch	2011-02-17 17:44:59 +0000
@@ -0,0 +1,62 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+# Description: When the DHCPv6 server code processed a message for an address 
+#  that was previously declined and internally tagged as abandoned it could 
+#  trigger an assert failure resulting in the server crashing. This could have 
+#  been used to crash DHCPv6 servers remotely. This issue only affected DHCPv6 
+#  servers. DHCPv4 servers were unaffected.  Patch is based on diff between 
+#  upstream releases 4.1.2 and 4.1.2-P1, constructed to apply by Raphael 
+# Geissert. (CVE-2011-0413)
+# Origin: upstream
+# Author: Raphael Geissert <[e-mail]>
+# Bug-Ubuntu: https://launchpad.net/bugs/720729
+# Bug-Debian: http://bugs.debian.org/611217
+# Last-Update: 2011-02-17
+
+@DPATCH@
+diff -urNad isc-dhcp~/server/mdb6.c isc-dhcp/server/mdb6.c
+--- isc-dhcp~/server/mdb6.c	2008-10-22 04:41:58.000000000 -0700
++++ isc-dhcp/server/mdb6.c	2011-02-03 22:18:27.000000000 -0800
+@@ -1006,7 +1006,7 @@
+  * Renew an lease in the pool.
+  *
+  * To do this, first set the new hard_lifetime_end_time for the resource,
+- * and then invoke renew_lease() on it.
++ * and then invoke renew_lease6() on it.
+  *
+  * WARNING: lease times must only be extended, never reduced!!!
+  */
+@@ -1016,12 +1016,24 @@
+ 	 * If we're already active, then we can just move our expiration
+ 	 * time down the heap. 
+ 	 *
++	 * If we're abandoned then we are already on the active list
++	 * but we need to retag the lease and move our expiration
++	 * from infinite to the current value
++	 *
+ 	 * Otherwise, we have to move from the inactive heap to the 
+ 	 * active heap.
+ 	 */
+ 	if (lease->state == FTS_ACTIVE) {
+ 		isc_heap_decreased(pool->active_timeouts, lease->heap_index);
+ 		return ISC_R_SUCCESS;
++	} else if (lease->state == FTS_ABANDONED) {
++		char tmp_addr[INET6_ADDRSTRLEN];
++                lease->state = FTS_ACTIVE;
++                isc_heap_increased(pool->active_timeouts, lease->heap_index);
++		log_info("Reclaiming previously abandoned address %s",
++			 inet_ntop(AF_INET6, &(lease->addr), tmp_addr,
++				   sizeof(tmp_addr)));
++                return ISC_R_SUCCESS;
+ 	} else {
+ 		return move_lease_to_active(pool, lease);
+ 	}
+@@ -1109,7 +1121,8 @@
+ decline_lease6(struct ipv6_pool *pool, struct iasubopt *lease) {
+ 	isc_result_t result;
+ 
+-	if (lease->state != FTS_ACTIVE) {
++	if ((lease->state != FTS_ACTIVE) &&
++	    (lease->state != FTS_ABANDONED)) {
+ 		result = move_lease_to_active(pool, lease);
+ 		if (result != ISC_R_SUCCESS) {
+ 			return result;