Merge lp:~brightbox/ubuntu/maverick/qemu-kvm/qemu-kvm.fix-697197 into lp:ubuntu/maverick/qemu-kvm

[Neil Wilson]

Security fix for CVE 2011-0011

[Dustin Kirkland  (kirkland)]

Looks good, thanks for doing this, Neil.

I'm going to update it just slightly, as this debdiff will need to go through the security queue, since there's an associated CVE. I'll prep that upload and the security team will sponsor it into maverick-security.

I'll get it uploaded to natty now.

The last thing I need you to do is to email your patch to the qemu-devel mailing list. The maintainers do not accept patches solely attached to bugs in Launchpad. Their processes require that you email the patch to the mailing list. Sorry for the run-around. Cheers!

review: Approve

[Neil Wilson (neil-aldur)]

Dustin,

I've been following the discussion on the qemu development list and
they are going for a complete rewrite of the associated functions to
get rid of the overloaded behaviour. There's an ongoing discussion
with the RedHat boys about it.

Additionally I think this patch needs to go into Lucid as well.

On 11 February 2011 15:39, Dustin Kirkland <email address hidden> wrote:
> Review: Approve
> Looks good, thanks for doing this, Neil.
>
> I'm going to update it just slightly, as this debdiff will need to go through the security queue, since there's an associated CVE.  I'll prep that upload and the security team will sponsor it into maverick-security.
>
> I'll get it uploaded to natty now.
>
> The last thing I need you to do is to email your patch to the qemu-devel mailing list.  The maintainers do not accept patches solely attached to bugs in Launchpad.  Their processes require that you email the patch to the mailing list.  Sorry for the run-around.  Cheers!
> --
> https://code.launchpad.net/~brightbox/ubuntu/maverick/qemu-kvm/qemu-kvm.fix-697197/+merge/47820
> Your team Brightbox is subscribed to branch lp:~brightbox/ubuntu/maverick/qemu-kvm/qemu-kvm.fix-697197.
>

--
Neil Wilson

[Dustin Kirkland  (kirkland)]

On Fri, Feb 11, 2011 at 9:49 AM, Neil Wilson <email address hidden> wrote:
> I've been following the discussion on the qemu development list and
> they are going for a complete rewrite of the associated functions to
> get rid of the overloaded behaviour. There's an ongoing discussion
> with the RedHat boys about it.
>
> Additionally I think this patch needs to go into Lucid as well.

Thanks, I ported the debdiff for lucid-security too.

I can't follow the qemu-devel list in detail any more. Would you mind
just dropping me a note once they get their fixes for this issue in
git HEAD?

Cheers,
Dustin

[Neil Wilson (neil-aldur)]

On 11 February 2011 16:07, Dustin Kirkland <email address hidden> wrote:

> Thanks, I ported the debdiff for lucid-security too.
>
> I can't follow the qemu-devel list in detail any more.  Would you mind
> just dropping me a note once they get their fixes for this issue in
> git HEAD?
>
> Cheers,
> Dustin

Will do.

It may take some time to resolve - a few differences of opinion to
iron out as ever.

--
Neil Wilson

Unmerged revisions

97. By Neil Wilson on 2011-01-28

Add patch description.

96. By Neil Wilson on 2011-01-28

* SECURITY UPDATE: Setting VNC password to empty string silently
  disables all authentication (LP: #697197)
  - debian/patches/697197-fix-vnc-password-semantics.patch: Reverses the
  change introduced in Qemu by git commit 52c18be9
  CVE: 2011-0011

95. By Benjamin Drung on 2010-11-24

Add caps-lock-key-up-event.patch to enable normal up/down events for
Caps-Lock and Num-Lock keys by setting SDL_DISABLE_LOCK_KEYS (which
requires SDL > 1.2.14). This fixes handling of capslock when capslock is
mapped to something else in host system. (LP: #427612)

=== modified file 'debian/changelog'
--- debian/changelog	2010-09-30 12:04:45 +0000
+++ debian/changelog	2011-01-28 16:03:09 +0000
@@ -1,3 +1,22 @@
+qemu-kvm (0.12.5+noroms-0ubuntu7.2) maverick; urgency=low
+
+  * SECURITY UPDATE: Setting VNC password to empty string silently
+    disables all authentication (LP: #697197)
+    - debian/patches/697197-fix-vnc-password-semantics.patch: Reverses the
+    change introduced in Qemu by git commit 52c18be9 
+    CVE: 2011-0011
+
+ -- Neil Wilson <[e-mail]>  Fri, 28 Jan 2011 15:30:44 +0000
+
+qemu-kvm (0.12.5+noroms-0ubuntu7.1) maverick-proposed; urgency=low
+
+  * Add caps-lock-key-up-event.patch to enable normal up/down events for
+    Caps-Lock and Num-Lock keys by setting SDL_DISABLE_LOCK_KEYS (which
+    requires SDL > 1.2.14). This fixes handling of capslock when capslock is
+    mapped to something else in host system. (LP: #427612)
+
+ -- Benjamin Drung <[e-mail]>  Wed, 24 Nov 2010 15:35:10 +0100
+
 qemu-kvm (0.12.5+noroms-0ubuntu7) maverick; urgency=low
 
   * Resurrect arm-host-fix-compiler-warning patch, applied in

=== modified file 'debian/control'
--- debian/control	2010-08-24 09:56:34 +0000
+++ debian/control	2011-01-28 16:03:09 +0000
@@ -3,7 +3,7 @@
 Priority: optional
 Maintainer: Ubuntu Developers <[e-mail]>
 Build-Depends: debhelper (>= 7), pkg-config, quilt (>= 0.40),
- bzip2, uuid-dev, zlib1g-dev, libsdl1.2-dev, libasound2-dev, libcurl4-gnutls-dev, libgnutls-dev,
+ bzip2, uuid-dev, zlib1g-dev, libsdl1.2-dev (>= 1.2.14), libasound2-dev, libcurl4-gnutls-dev, libgnutls-dev,
  libncurses5-dev, libpci-dev, libpulse-dev, libaio-dev, nasm, texi2html, bcc, iasl,
  device-tree-compiler [powerpc], sysv-rc (>= 2.86.ds1-14.1ubuntu2), libx11-dev, libsasl2-dev
 Standards-Version: 3.8.3

=== added file 'debian/patches/697197-fix-vnc-password-semantics.patch'
--- debian/patches/697197-fix-vnc-password-semantics.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/697197-fix-vnc-password-semantics.patch	2011-01-28 16:03:09 +0000
@@ -0,0 +1,17 @@
+## Description: Stop 'change password' switching off VNC authentication
+## Origin/Author: Neil Wilson <[e-mail]>
+## Bug: http://launchpad.net/bugs/697197
+--- a/vnc.c
++++ b/vnc.c
+@@ -2461,11 +2461,6 @@
+     if (password && password[0]) {
+         if (!(vs->password = qemu_strdup(password)))
+             return -1;
+-        if (vs->auth == VNC_AUTH_NONE) {
+-            vs->auth = VNC_AUTH_VNC;
+-        }
+-    } else {
+-        vs->auth = VNC_AUTH_NONE;
+     }
+ 
+     return 0;

=== added file 'debian/patches/caps-lock-key-up-event.patch'
--- debian/patches/caps-lock-key-up-event.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/caps-lock-key-up-event.patch	2011-01-28 16:03:09 +0000
@@ -0,0 +1,33 @@
+Description: Enable normal up/down events for Caps-Lock and Num-Lock keys
+ by setting SDL_DISABLE_LOCK_KEYS (which requires SDL > 1.2.14). This fixes
+ handling of capslock when capslock is mapped to something else in host system.
+Author: Benjamin Drung <[e-mail]>
+Bug-Ubuntu: https://launchpad.net/bugs/427612
+
+--- a/sdl.c	2010-02-26 16:26:00 +0000
++++ b/sdl.c	2010-11-24 21:17:18 +0000
+@@ -388,12 +388,6 @@
+         else
+             modifiers_state[keycode] = 1;
+         break;
+-    case 0x45: /* num lock */
+-    case 0x3a: /* caps lock */
+-        /* SDL does not send the key up event, so we generate it */
+-        kbd_put_keycode(keycode);
+-        kbd_put_keycode(keycode | 0x80);
+-        return;
+     }
+ 
+     /* now send the key code */
+@@ -848,6 +842,10 @@
+     if (no_frame)
+         gui_noframe = 1;
+ 
++    // Enable normal up/down events for Caps-Lock and Num-Lock keys.
++    // This requires SDL >= 1.2.14
++    setenv("SDL_DISABLE_LOCK_KEYS", "1", 1);
++
+     flags = SDL_INIT_VIDEO | SDL_INIT_NOPARACHUTE;
+     if (SDL_Init (flags)) {
+         fprintf(stderr, "Could not initialize SDL - exiting\n");
+

=== modified file 'debian/patches/series'
--- debian/patches/series	2010-09-29 14:26:38 +0000
+++ debian/patches/series	2011-01-28 16:03:09 +0000
@@ -8,3 +8,5 @@
 check-for-invalid-initrd-file.patch
 fix-CMOS-info-for-drives-defined-with--device.patch
 arm-host-fix-compiler-warning.patch
+caps-lock-key-up-event.patch
+697197-fix-vnc-password-semantics.patch