Merge lp:~dage/mysql-mmm/cve-fix into lp:mysql-mmm

[David Beveridge]

Fix for TALOS-2017-0501; CVE-2017-14474 - CVE-2017-14481

Multi-Master Replication Manager for MySQL mmm_agentd Remote Command Injection Vulnerabilities

Multiple exploitable remote command injection vulnerabilities exist
in the MySQL Master-Master Replication Manager (MMM) mmm_agentd
daemon 2.2.1. mmm_agentd commonly runs with root privileges and does not
require authentication by default. A specially crafted MMM protocol
message can cause a shell command injection resulting in arbitrary
command execution with the privileges of the mmm_agentd process. An
attacker that can initiate a TCP session with mmm_agentd can trigger
these vulnerabilities.

[David Beveridge (dage)]

review: Approve

=== modified file 'lib/Agent/Helpers.pm'
--- lib/Agent/Helpers.pm	2018-05-04 22:53:37 +0000
+++ lib/Agent/Helpers.pm	2018-05-04 22:53:37 +0000
@@ -168,6 +168,10 @@
 	my $config_file		= $main::agent->config_file;
 	$params = '' unless defined($params);
 
+	if ($params !~ /^[\w\. \:\-]*$/) {
+		_exit_error("ERROR: Invalid Parameter");
+	}
+
 	DEBUG "Executing $path $config_file $params";
 	my $res = `$path $config_file $params 2>&1`;
 

=== modified file 'lib/Agent/Helpers/Network.pm'
--- lib/Agent/Helpers/Network.pm	2018-05-04 22:53:37 +0000
+++ lib/Agent/Helpers/Network.pm	2018-05-04 22:53:37 +0000
@@ -33,6 +33,10 @@
 	my $if = shift;
 	my $ip = shift;
 
+	if ($ip !~ /^[\d\.]*$/) {
+		_exit_error("ERROR: Invalid IP Address");
+	}
+
 	my $output;
 	if ($OSNAME eq 'linux') {
 		$output = `/sbin/ip addr show dev $if`;
@@ -65,6 +69,10 @@
 	my $if = shift;
 	my $ip = shift;
 
+	if ($ip !~ /^[\d\.]*$/) {
+		_exit_error("ERROR: Invalid IP Address");
+	}
+
 	my $output;
 	if ($OSNAME eq 'linux') {
 		$output = `/sbin/ip addr add $ip/32 dev $if`;
@@ -101,6 +109,10 @@
 	my $if = shift;
 	my $ip = shift;
 
+	if ($ip !~ /^[\d\.]*$/) {
+		_exit_error("ERROR: Invalid IP Address");
+	}
+
 	my $output;
 	if ($OSNAME eq 'linux') {
 		$output = `/sbin/ip addr del $ip/32 dev $if`;
@@ -130,6 +142,9 @@
 	my $if = shift;
 	my $ip = shift;
 
+	if ($ip !~ /^[\d\.]*$/) {
+		_exit_error("ERROR: Invalid IP Address");
+	}
 
 	if ($OSNAME eq 'linux' || $OSNAME eq 'freebsd') {
 		my $mac = '';

=== modified file 'lib/Common/Role.pm'
--- lib/Common/Role.pm	2008-12-21 20:54:31 +0000
+++ lib/Common/Role.pm	2018-05-04 22:53:37 +0000
@@ -59,7 +59,7 @@
 	my $class	= shift;
 	my $string	= shift;
 
-	if (my ($name, $ip) = $string =~ /(.*)\((.*)\)/) {
+	if (my ($name, $ip) = $string =~ /^([\w_\.\-]+)\(([\d\.]+)\)$/) {
 		return $class->new(name => $name, ip => $ip);
 	}
 	return undef;

=== modified file 'lib/Common/Socket.pm'
--- lib/Common/Socket.pm	2009-01-14 20:28:20 +0000
+++ lib/Common/Socket.pm	2018-05-04 22:53:37 +0000
@@ -80,6 +80,7 @@
 			SSL_cert_file	=> $main::config->{'socket'}->{cert_file},
 			SSL_key_file	=> $main::config->{'socket'}->{key_file},
 			SSL_ca_file		=> $main::config->{'socket'}->{ca_file},
+			SSL_verify_mode => 0x03 # SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT
 		);
 	}