Merge lp:~jtaylor/ubuntu/oneiric/super/CVE-2011-2776 into lp:ubuntu/oneiric/super

[Julian Taylor]

[lp:~jtaylor/ubuntu/oneiric/super/CVE-2011-2776]

10. By Julian Taylor on 2012-03-13

Thanks to Robert Luberda

11. By Julian Taylor on 2012-03-13

fix typo

[Marc Deslauriers (mdeslaur)]

ACK. Uploading now.

review: Approve

=== modified file 'debian/changelog'
--- debian/changelog	2011-02-21 22:04:44 +0000
+++ debian/changelog	2012-03-13 23:51:17 +0000
@@ -1,3 +1,14 @@
+super (3.30.0-5ubuntu0.1) oneiric-security; urgency=low
+
+  * SECURITY UPDATE: buffer overflow when logging via syslog (LP: #954579).
+   - 12-Use-vsnprintf.patch:
+     use vsnprintf to prevent overflow
+   - 13-Potential-format-string-vulnerability.patch
+   - Thanks to Robert Luberda
+   - CVE-2011-2776
+
+ -- Julian Taylor <[e-mail]>  Wed, 14 Mar 2012 00:22:33 +0100
+
 super (3.30.0-5) unstable; urgency=low
 
   * 10_ftbfs_hurd.patch: fix FTBFS on GNU/Hurd.

=== added file 'debian/patches/12-Use-vnsprintf.patch'
--- debian/patches/12-Use-vnsprintf.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/12-Use-vnsprintf.patch	2012-03-13 23:51:17 +0000
@@ -0,0 +1,49 @@
+From: Robert Luberda <[e-mail]>
+Date: Sun, 4 Dec 2011 16:56:57 +0100
+Subject: 12 Use vnsprintf.
+
+error.c: Use vsnprintf() instead of vprintf() to fix a crash
+occurring when syslog logging is enabled and total length
+of arguments passed to super is greater then 1300 characters.
+rsyslog.c: Do the same just in case.
+---
+ error.c   |    4 ++--
+ rsyslog.c |    2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/error.c b/error.c
+index 0b91ad9..30529fa 100644
+--- a/error.c
++++ b/error.c
+@@ -346,7 +346,7 @@ Error(
+ 	if (tag)
+ 	    StrLCat(newfmt, tag, sizeof(newfmt));
+ 	va_start(ap, fmt);
+-	(void) vsprintf(buf, newfmt, ap);
++	(void) vsnprintf(buf, sizeof(buf), newfmt, ap);
+ 	va_end(ap);
+ 	if (show_perror)
+ 	    StrLCat(buf, Strerror(error), sizeof(buf));
+@@ -515,7 +515,7 @@ va_dcl
+ 	StrLCat(newfmt, fmt, sizeof(newfmt));
+ 	if (tag)
+ 	    StrLCat(newfmt, tag, sizeof(newfmt));
+-	(void) vsprintf(buf, newfmt, ap);
++	(void) vsnprintf(buf, sizeof(buf), newfmt, ap);
+ 	va_end(ap);
+ 	SysLog(error_priority, buf);
+     }
+diff --git a/rsyslog.c b/rsyslog.c
+index ed478d8..af1e571 100644
+--- a/rsyslog.c
++++ b/rsyslog.c
+@@ -103,7 +103,7 @@ static struct {
+ 	(void) sprintf(msg,"(%d) ", getpid());
+     if (*loginfo.ident)
+ 	(void) sprintf(msg+strlen(msg),"%s: ", loginfo.ident);
+-    (void) vsprintf(msg+strlen(msg), fmt, args);
++    (void) vsnprintf(msg+strlen(msg), sizeof(msg)-strlen(msg), fmt, args);
+     va_end(args);
+ 
+     /*
+-- 

=== added file 'debian/patches/13-Potential-format-string-vulnerability.patch'
--- debian/patches/13-Potential-format-string-vulnerability.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/13-Potential-format-string-vulnerability.patch	2012-03-13 23:51:17 +0000
@@ -0,0 +1,85 @@
+From: Robert Luberda <[e-mail]>
+Date: Sat, 7 Jan 2012 12:53:33 +0100
+Subject: 13 Potential format string vulnerability.
+
+Fix potential format string vulnerability that
+might occur if the user of file name or file name
+used in the tag contains a '%' character.
+---
+ error.c |   26 ++++++++++----------------
+ 1 files changed, 10 insertions(+), 16 deletions(-)
+
+diff --git a/error.c b/error.c
+index 30529fa..c9a5cc0 100644
+--- a/error.c
++++ b/error.c
+@@ -188,14 +188,16 @@ int fac;
+ }
+ 
+ void
+-SysLog(pri, buf)
++SysLog(pri, user, buf, tag)
+ int pri;
++char *user;
+ char *buf;
++char *tag;
+ {
+     if (using_rsyslog) {
+-	rsyslog(pri, "%s", buf);
++	rsyslog(pri, "(%s) %s%s", user, buf, (tag ? tag : ""));
+     } else {
+-	syslog(pri, "%s", buf);
++	syslog(pri, "(%s) %s%s", user, buf, (tag ? tag : ""));
+     }
+ }
+ 
+@@ -336,21 +338,17 @@ Error(
+ 
+ #ifdef HAVE_SYSLOG_H
+     if (error_syslog) {
+-	char newfmt[MAXPRINT], buf[MAXPRINT];
++	char buf[MAXPRINT];
+ 	if (!openlog_done) {
+ 	    OpenLog(error_prog ? error_prog : "", 0, error_facility);
+ 	    openlog_done = 1;
+ 	}
+-	sprintf(newfmt, "(%s) ", error_user ? error_user : user);
+-	StrLCat(newfmt, fmt, sizeof(newfmt));
+-	if (tag)
+-	    StrLCat(newfmt, tag, sizeof(newfmt));
+ 	va_start(ap, fmt);
+-	(void) vsnprintf(buf, sizeof(buf), newfmt, ap);
++	(void) vsnprintf(buf, sizeof(buf), fmt, ap);
+ 	va_end(ap);
+ 	if (show_perror)
+ 	    StrLCat(buf, Strerror(error), sizeof(buf));
+-	SysLog(error_priority, buf);
++	SysLog(error_priority, (error_user ? error_user : user), buf, tag);
+     }
+ #endif
+ 
+@@ -502,7 +500,7 @@ va_dcl
+ 
+ #ifdef HAVE_SYSLOG_H
+     if (error_syslog) {
+-	char newfmt[MAXPRINT], buf[MAXPRINT];
++	char buf[MAXPRINT];
+ 	va_start(ap);
+ 	show_perror = va_arg(ap, int);
+ 	die = va_arg(ap, int);
+@@ -511,13 +509,9 @@ va_dcl
+ 	    OpenLog(error_prog ? error_prog : "", 0, error_facility);
+ 	    openlog_done = 1;
+ 	}
+-	sprintf(newfmt, "(%s) ", error_user ? error_user : user);
+-	StrLCat(newfmt, fmt, sizeof(newfmt));
+-	if (tag)
+-	    StrLCat(newfmt, tag, sizeof(newfmt));
+ 	(void) vsnprintf(buf, sizeof(buf), newfmt, ap);
+ 	va_end(ap);
+-	SysLog(error_priority, buf);
++	SysLog(error_priority, (error_user ? error_user : user), buf, tag);
+     }
+ #endif
+ 
+-- 

=== modified file 'debian/patches/series'
--- debian/patches/series	2011-02-21 22:04:44 +0000
+++ debian/patches/series	2012-03-13 23:51:17 +0000
@@ -9,3 +9,5 @@
 09_Makefile_srcdir.patch
 10_ftbfs_hurd.patch
 11_gcc_wformat.patch
+12-Use-vnsprintf.patch
+13-Potential-format-string-vulnerability.patch