Merge lp:~jtaylor/ubuntu/oneiric/wicd/CVE-2012-2095 into lp:ubuntu/oneiric/wicd

[Julian Taylor]

[lp:~jtaylor/ubuntu/oneiric/wicd/CVE-2012-2095]

23. By Julian Taylor on 2012-05-03

fix unicode issue in patch

24. By Julian Taylor on 2012-05-03

encode to ascii to avoid crash on unicode input

[Marc Deslauriers (mdeslaur)]

Julian, could you please update the status of this merge request so it gets removed from the sponsors list? Thanks.

=== modified file 'debian/changelog'
--- debian/changelog	2011-02-12 00:16:58 +0000
+++ debian/changelog	2012-05-03 22:42:19 +0000
@@ -1,3 +1,22 @@
+wicd (1.7.0+ds1-6ubuntu0.11.10.1) oneiric-security; urgency=low
+
+  * SECURITY UPDATE: privilege escalation (LP: #979221)
+    - debian/patches/36-fix_local_privilege_escalation.patch:
+      sanitize config properties
+      Backported from
+      http://bazaar.launchpad.net/~wicd-devel/wicd/experimental/revision/767
+      Thanks to David Paleino <[e-mail]>
+    - CVE-2012-2095
+  * SECURITY UPDATE: information leak in log files (LP: #992177)
+    - debian/patches/37-mask-sensitive-info-from-log.patch:
+      mask sensitive information in logs
+      Backported from
+      http://bazaar.launchpad.net/~wicd-devel/wicd/experimental/revision/682
+      Thanks to David Paleino <[e-mail]>
+    - CVE-2012-0813
+
+ -- Julian Taylor <[e-mail]>  Mon, 30 Apr 2012 19:57:13 +0200
+
 wicd (1.7.0+ds1-6) unstable; urgency=low
 
   * debian/patches/:

=== modified file 'debian/control'
--- debian/control	2011-02-12 00:16:58 +0000
+++ debian/control	2012-05-03 22:42:19 +0000
@@ -1,7 +1,8 @@
 Source: wicd
 Section: net
 Priority: optional
-Maintainer: David Paleino <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: David Paleino <[e-mail]>
 Build-Depends:
  debhelper (>= 7.2.3~)
  , python

=== added file 'debian/patches/36-fix_local_privilege_escalation.patch'
--- debian/patches/36-fix_local_privilege_escalation.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/36-fix_local_privilege_escalation.patch	2012-05-03 22:42:19 +0000
@@ -0,0 +1,73 @@
+Description: sanitize config to prevent priviledge escalation
+  see http://www.infosecinstitute.com/courses/ethical-hacking-wicd-0day.html
+  CVE-2012-2095
+Author: David Paleino <[e-mail]>
+Origin: http://bazaar.launchpad.net/~wicd-devel/wicd/experimental/revision/767
+
+--- a/wicd/misc.py
++++ b/wicd/misc.py
+@@ -26,6 +26,7 @@
+ import locale
+ import sys
+ import re
++import string
+ import gobject
+ from threading import Thread
+ from subprocess import Popen, STDOUT, PIPE, call
+@@ -398,6 +399,15 @@
+                 ret = x.decode('utf-8', 'replace').encode('utf-8')
+             
+     return ret
++
++def sanitize_config(s):
++    """ Sanitize property names to be used in config-files. """
++    allowed = string.ascii_letters + '_' + string.digits
++    table = string.maketrans(allowed, ' ' * len(allowed))
++
++    # s is a dbus.String -- since we don't allow unicode property keys,
++    # make it simple.
++    return s.encode("ascii", "replace").translate(None, table)
+     
+ def RenameProcess(new_name):
+     """ Renames the process calling the function to the given name. """
+--- a/wicd/wicd-daemon.py
++++ b/wicd/wicd-daemon.py
+@@ -1088,7 +1088,8 @@
+     def SetWirelessProperty(self, netid, prop, value):
+         """ Sets property to value in network specified. """
+         # We don't write script settings here.
+-        if (prop.strip()).endswith("script"):
++        prop =  misc.sanitize_config(prop)
++        if prop.endswith("script"):
+             print "Setting script properties through the daemon is not" \
+                   + " permitted."
+             return False
+@@ -1282,7 +1283,8 @@
+     @dbus.service.method('org.wicd.daemon.wireless')
+     def SaveWirelessNetworkProperty(self, id, option):
+         """ Writes a particular wireless property to disk. """
+-        if (option.strip()).endswith("script"):
++        option =  misc.sanitize_config(option)
++        if option.endswith("script"):
+             print 'You cannot save script information to disk through ' + \
+                   'the daemon.'
+             return
+@@ -1409,14 +1411,15 @@
+         return str(iface)
+ 
+     @dbus.service.method('org.wicd.daemon.wired')
+-    def SetWiredProperty(self, property, value):
++    def SetWiredProperty(self, prop, value):
+         """ Sets the given property to the given value. """
+         if self.WiredNetwork:
+-            if (property.strip()).endswith("script"):
++            prop = misc.sanitize_config(prop)
++            if prop.endswith("script"):
+                 print "Setting script properties through the daemon" \
+                       + " is not permitted."
+                 return False
+-            self.WiredNetwork[property] = misc.to_unicode(misc.Noneify(value))
++            self.WiredNetwork[prop] = misc.to_unicode(misc.Noneify(value))
+             return True
+         else:
+             print 'SetWiredProperty: WiredNetwork does not exist'

=== added file 'debian/patches/37-mask-sensitive-info-from-log.patch'
--- debian/patches/37-mask-sensitive-info-from-log.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/37-mask-sensitive-info-from-log.patch	2012-05-03 22:42:19 +0000
@@ -0,0 +1,22 @@
+Description: mask sensitive information from logs
+  CVE-2012-0813
+Author: David Paleino <[e-mail]>
+Origin: http://bazaar.launchpad.net/~wicd-devel/wicd/experimental/revision/682
+--- a/wicd/configmanager.py
++++ b/wicd/configmanager.py
+@@ -107,8 +107,13 @@
+                 ret = ret[3:-3]
+             if default:
+                 if self.debug:
+-                    print ''.join(['found ', option, ' in configuration ', 
+-                                   str(ret)])
++                    # mask out sensitive information
++                    if option in ['apsk', 'password', 'identity', 'private_key', \
++                                  'private_key_passwd', 'key', 'passphrase']:
++                        print ''.join(['found ', option, ' in configuration *****'])
++                    else:
++                        print ''.join(['found ', option, ' in configuration ', 
++                                       str(ret)])
+         else:
+             if default != "__None__":
+                 print 'did not find %s in configuration, setting default %s' % (option, str(default))

=== modified file 'debian/patches/series'
--- debian/patches/series	2011-02-12 00:16:58 +0000
+++ debian/patches/series	2012-05-03 22:42:19 +0000
@@ -26,3 +26,5 @@
 33-deepcopy_python27_fixes.patch
 34-dont_save_useless_config.patch
 35-restrict_netmode_characters.patch
+36-fix_local_privilege_escalation.patch
+37-mask-sensitive-info-from-log.patch