Merge lp:~ari-tczew/ubuntu/hardy/xchat/CVE-2009-0315 into lp:ubuntu/hardy/xchat

[Artur Rona]

[Marc Deslauriers (mdeslaur)]

Approved. Will upload to hardy-security.

review: Approve

Unmerged revisions

26. By Artur Rona on 2010-06-01

* SECURITY UPDATE (LP: #322196)
* debian/patches/64_CVE-2009-0315.dpatch:
  - Fix untrusted search path vulnerability in the Python module
    in xchat allows local users to execute arbitrary code via
    a Trojan horse Python file in the current working directory
  - CVE-2009-0315

=== modified file 'debian/changelog'
--- debian/changelog	2008-04-09 10:37:24 +0000
+++ debian/changelog	2010-06-01 20:20:50 +0000
@@ -1,3 +1,14 @@
+xchat (2.8.4-0ubuntu7.1) hardy-security; urgency=low
+
+  * SECURITY UPDATE (LP: #322196)
+  * debian/patches/64_CVE-2009-0315.dpatch:
+    - Fix untrusted search path vulnerability in the Python module
+      in xchat allows local users to execute arbitrary code via
+      a Trojan horse Python file in the current working directory
+    - CVE-2009-0315
+
+ -- Artur Rona <[e-mail]>  Tue, 01 Jun 2010 21:27:28 +0200
+
 xchat (2.8.4-0ubuntu7) hardy; urgency=low
 
   * Rebuild for liblaunchpad-integration1 transition.

=== modified file 'debian/control'
--- debian/control	2007-07-31 15:25:31 +0000
+++ debian/control	2010-06-01 20:20:50 +0000
@@ -1,7 +1,7 @@
 Source: xchat
 Section: net
 Priority: optional
-Maintainer: Ubuntu MOTU Developers <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
 XSBC-Original-Maintainer: Davide Puricelli (evo) <[e-mail]>
 Standards-Version: 3.7.2
 Build-Depends: debhelper (>> 4), bison, libssl-dev, libglib2.0-dev, libgtk2.0-dev (>= 2.10.0), libperl-dev, gettext (>= 0.10.37-1), libtool, zlib1g-dev, perl (>= 5.8), python-dev, tcl8.4-dev, autotools-dev, dpatch, libdbus-glib-1-dev, libgtkspell-dev, gconf2, dpkg-dev (>= 1.13.19), liblaunchpad-integration-dev, libsexy-dev

=== modified file 'debian/patches/00list'
--- debian/patches/00list	2007-09-29 14:58:03 +0000
+++ debian/patches/00list	2010-06-01 20:20:50 +0000
@@ -8,3 +8,4 @@
 45_ctcp_version_less_information
 62_xc284-scrollbmkdir
 63_xc284-improvescrollback
+64_CVE-2009-0315

=== added file 'debian/patches/64_CVE-2009-0315.dpatch'
--- debian/patches/64_CVE-2009-0315.dpatch	1970-01-01 00:00:00 +0000
+++ debian/patches/64_CVE-2009-0315.dpatch	2010-06-01 20:20:50 +0000
@@ -0,0 +1,30 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 64_CVE-2009-0315.dpatch by Nico Golde <[e-mail]>
+## From: Artur Rona <[e-mail]>
+## Description: Untrusted search path vulnerability in the Python module in xchat allows
+##  local users to execute arbitrary code via a Trojan horse Python file in the
+##  current working directory, related to a vulnerability in the PySys_SetArgv
+##  function (CVE-2008-5983).
+## Bug: https://launchpad.net/bugs/322196
+## Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=513509
+
+@DPATCH@
+diff -urNad xchat-2.8.6~/plugins/python/python.c xchat-2.8.6/plugins/python/python.c
+--- xchat-2.8.6~/plugins/python/python.c	2008-03-29 06:57:35.000000000 +0100
++++ xchat-2.8.6/plugins/python/python.c	2009-02-05 19:13:02.000000000 +0100
+@@ -1106,6 +1106,7 @@
+ 	}
+ 
+ 	PySys_SetArgv(1, argv);
++	PyRun_SimpleString("import sys; sys.path = filter(None, sys.path)");
+ 	PySys_SetObject("__plugin__", (PyObject *) plugin);
+ 
+ 	/* Set stdout and stderr to xchatout. */
+@@ -2110,6 +2111,7 @@
+ 	Py_SetProgramName("xchat");
+ 	Py_Initialize();
+ 	PySys_SetArgv(1, argv);
++	PyRun_SimpleString("import sys; sys.path = filter(None, sys.path)");
+ 
+ 	Plugin_Type.ob_type = &PyType_Type;
+ 	Context_Type.ob_type = &PyType_Type;