Merge lp:~jtaylor/ubuntu/precise/wicd/CVE-2012-2095 into lp:ubuntu/precise/wicd

[Julian Taylor]

[lp:~jtaylor/ubuntu/precise/wicd/CVE-2012-2095]

26. By Julian Taylor on 2012-05-03

fix unicode issue in patch

27. By Julian Taylor on 2012-05-03

encode to ascii to avoid crash on unicode input

[Marc Deslauriers (mdeslaur)]

Julian, could you please update the status of this merge request so it gets removed from the sponsors list? Thanks.

=== modified file 'debian/changelog'
--- debian/changelog	2012-04-22 18:42:19 +0000
+++ debian/changelog	2012-05-03 22:41:19 +0000
@@ -1,3 +1,15 @@
+wicd (1.7.2.3-1ubuntu0.12.04.1) precise-security; urgency=low
+
+  * SECURITY UPDATE: privilege escalation (LP: #979221)
+    - debian/patches/33-fix_local_privilege_escalation.patch:
+      sanitize config properties
+      Backported from
+      http://bazaar.launchpad.net/~wicd-devel/wicd/experimental/revision/767
+      Thanks to David Paleino <[e-mail]>
+    - CVE-2012-2095
+
+ -- Julian Taylor <[e-mail]>  Mon, 30 Apr 2012 22:22:03 +0200
+
 wicd (1.7.2.3-1) unstable; urgency=high
 
   * New upstram version

=== modified file 'debian/control'
--- debian/control	2012-04-12 22:08:37 +0000
+++ debian/control	2012-05-03 22:41:19 +0000
@@ -1,7 +1,8 @@
 Source: wicd
 Section: net
 Priority: optional
-Maintainer: David Paleino <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: David Paleino <[e-mail]>
 Build-Depends:
  debhelper (>= 7.2.3~)
  , python (>= 2.6.6-3~)

=== added file 'debian/patches/33-fix_local_privilege_escalation.patch'
--- debian/patches/33-fix_local_privilege_escalation.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/33-fix_local_privilege_escalation.patch	2012-05-03 22:41:19 +0000
@@ -0,0 +1,74 @@
+Description: sanitize config to prevent priviledge escalation
+  see http://www.infosecinstitute.com/courses/ethical-hacking-wicd-0day.html
+  CVE-2012-2095
+Author: David Paleino <[e-mail]>
+Origin: http://bazaar.launchpad.net/~wicd-devel/wicd/experimental/revision/767
+
+--- a/wicd/misc.py
++++ b/wicd/misc.py
+@@ -26,6 +26,7 @@
+ import locale
+ import sys
+ import re
++import string
+ import gobject
+ from threading import Thread
+ from subprocess import Popen, STDOUT, PIPE, call
+@@ -427,11 +428,12 @@
+ 
+ def sanitize_config(s):
+     """ Sanitize property names to be used in config-files. """
+-    s = s.strip()
+-    s = s.replace('=', '')
+-    s = s.replace(' ', '')
+-    s = s.replace('\n', '')
+-    return s
++    allowed = string.ascii_letters + '_' + string.digits
++    table = string.maketrans(allowed, ' ' * len(allowed))
++
++    # s is a dbus.String -- since we don't allow unicode property keys,
++    # make it simple.
++    return s.encode("ascii", "replace").translate(None, table)
+ 
+ def sanitize_escaped(s):
+     """ Sanitize double-escaped unicode strings. """
+--- a/wicd/wicd-daemon.py
++++ b/wicd/wicd-daemon.py
+@@ -1064,9 +1064,10 @@
+     def SetWirelessProperty(self, netid, prop, value):
+         """ Sets property to value in network specified. """
+         # We don't write script settings here.
+-        if misc.sanitize_config(prop).endswith('script'):
+-            print 'Setting script properties through the daemon' \
+-                  + ' is not permitted.'
++        prop =  misc.sanitize_config(prop)
++        if prop.endswith("script"):
++            print "Setting script properties through the daemon is not" \
++                  + " permitted."
+             return False
+         self.LastScan[netid][prop] = misc.to_unicode(misc.Noneify(value))
+ 
+@@ -1264,7 +1265,8 @@
+     @dbus.service.method('org.wicd.daemon.wireless')
+     def SaveWirelessNetworkProperty(self, id, option):
+         """ Writes a particular wireless property to disk. """
+-        if (option.strip()).endswith("script"):
++        option =  misc.sanitize_config(option)
++        if option.endswith("script"):
+             print 'You cannot save script information to disk through ' + \
+                   'the daemon.'
+             return
+@@ -1406,9 +1408,10 @@
+     def SetWiredProperty(self, prop, value):
+         """ Sets the given property to the given value. """
+         if self.WiredNetwork:
+-            if misc.sanitize_config(prop).endswith('script'):
+-                print 'Setting script properties through the daemon' \
+-                      + ' is not permitted.'
++            prop = misc.sanitize_config(prop)
++            if prop.endswith("script"):
++                print "Setting script properties through the daemon" \
++                      + " is not permitted."
+                 return False
+             self.WiredNetwork[prop] = misc.to_unicode(misc.Noneify(value))
+             return True

=== modified file 'debian/patches/series'
--- debian/patches/series	2012-02-02 20:36:02 +0000
+++ debian/patches/series	2012-05-03 22:41:19 +0000
@@ -2,3 +2,4 @@
 02-workaround_dhclient_bug.patch
 26-support_etc-network_scripts.patch
 32-prefer_gksu.patch
+33-fix_local_privilege_escalation.patch