Merge lp:~jtaylor/ubuntu/lucid/dropbear/2012-0920 into lp:ubuntu/lucid/dropbear

[Julian Taylor]

same patch from squeeze applies

[Jamie Strandboge (jdstrand)]

Based on https://wiki.ubuntu.com/SecurityTeam/UpdatePreparation#Packaging, the lucid update should use 0.52-4ubuntu0.10.04.1 as the version.

review: Approve

Unmerged revisions

14. By Julian Taylor on 2012-04-24

* SECURITY UPDATE: remote execution via use after free (LP: #976360)
  - debian/diff/0003-Fix-use-after-free-bug-CVE-2012-0920.diff
    backported from https://secure.ucc.asn.au/hg/dropbear/rev/818108bf7749
    Thanks to Gerrit Pape
  - CVE-2012-0920

=== modified file 'debian/changelog'
--- debian/changelog	2009-10-06 01:51:42 +0000
+++ debian/changelog	2012-04-24 22:02:23 +0000
@@ -1,3 +1,13 @@
+dropbear (0.52-4ubuntu1) lucid-security; urgency=low
+
+  * SECURITY UPDATE: remote execution via use after free (LP: #976360)
+    - debian/diff/0003-Fix-use-after-free-bug-CVE-2012-0920.diff
+      backported from https://secure.ucc.asn.au/hg/dropbear/rev/818108bf7749
+      Thanks to Gerrit Pape
+    - CVE-2012-0920
+
+ -- Julian Taylor <[e-mail]>  Tue, 24 Apr 2012 22:54:41 +0200
+
 dropbear (0.52-4) unstable; urgency=low
 
   * debian/initramfs/dropbear-hook: allow more than one public key in

=== modified file 'debian/control'
--- debian/control	2009-09-24 14:37:17 +0000
+++ debian/control	2012-04-24 22:02:23 +0000
@@ -1,7 +1,8 @@
 Source: dropbear
 Section: net
 Priority: optional
-Maintainer: Gerrit Pape <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Gerrit Pape <[e-mail]>
 Build-Depends: libz-dev
 Standards-Version: 3.8.2.0
 

=== added file 'debian/diff/0003-Fix-use-after-free-bug-CVE-2012-0920.diff'
--- debian/diff/0003-Fix-use-after-free-bug-CVE-2012-0920.diff	1970-01-01 00:00:00 +0000
+++ debian/diff/0003-Fix-use-after-free-bug-CVE-2012-0920.diff	2012-04-24 22:02:23 +0000
@@ -0,0 +1,35 @@
+From d46b781361cae7fdbdc50ad5752d47f786f30a2b Mon Sep 17 00:00:00 2001
+From: Gerrit Pape <[e-mail]>
+Date: Mon, 27 Feb 2012 16:33:55 +0000
+Subject: [PATCH 3/3] Fix use-after-free bug (CVE-2012-0920)
+
+Fix use-after-free bug that could be triggered if command="..."
+authorized_keys restrictions are used.
+
+This is a backport of the upstream fix in version 2012.55 to version
+0.52
+ https://secure.ucc.asn.au/hg/dropbear/rev/818108bf7749
+---
+ svr-authpubkeyoptions.c |    6 ++++--
+ 1 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/svr-authpubkeyoptions.c b/svr-authpubkeyoptions.c
+index 13a179d..324eb47 100644
+--- a/svr-authpubkeyoptions.c
++++ b/svr-authpubkeyoptions.c
+@@ -90,8 +90,10 @@ int svr_pubkey_allows_pty() {
+ 
+ /* Set chansession command to the one forced by 'command' public key option */
+ void svr_pubkey_set_forced_command(struct ChanSess *chansess) {
+-	if (ses.authstate.pubkey_options)
+-		chansess->cmd = ses.authstate.pubkey_options->forced_command;
++	if (ses.authstate.pubkey_options) {
++		m_free(chansess->cmd);
++		chansess->cmd = m_strdup(ses.authstate.pubkey_options->forced_command);
++	}
+ }
+ 
+ /* Free potential public key options */
+-- 
+1.7.9.1
+