← Back to branch summary

~ubuntu-branches/ubuntu/oneiric/sudo/oneiric-security

« back to all changes in this revision

Viewing changes to debian/patches/CVE-2012-2337.patch

  • Committer: Package Import Robot
  • Author(s): Tyler Hicks
  • Date: 2012-05-15 23:28:04 UTC
  • Revision ID: package-import@ubuntu.com-20120515232804-2rd0d4k222la647h
Tags: 1.7.4p6-1ubuntu2.1
* SECURITY UPDATE: Properly handle multiple netmasks in sudoers Host and
  Host_List values
  - debian/patches/CVE-2012-2337.patch: Don't perform IPv6 checks on IPv4
    addresses. Based on upstream patch.
  - CVE-2012-2337

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/patches/CVE-2012-2337.patch
 
1
Description: Prevent IPv6 netmask-based address matching logic from incorrectly
 
2
 being applied to IPv4 addresses.
 
3
Author: Todd C. Miller <Todd.Miller@courtesan.com>
 
4
 
 
5
Index: sudo-1.7.4p6/match.c
 
6
===================================================================
 
7
--- sudo-1.7.4p6.orig/match.c   2011-01-12 08:46:58.000000000 -0600
 
8
+++ sudo-1.7.4p6/match.c        2012-05-14 17:45:16.258916540 -0500
 
9
@@ -628,7 +628,7 @@
 
10
        ifp = &interfaces[i];
 
11
        if (ifp->family != family)
 
12
            continue;
 
13
-       switch(family) {
 
14
+       switch (family) {
 
15
            case AF_INET:
 
16
                if (ifp->addr.ip4.s_addr == addr.ip4.s_addr ||
 
17
                    (ifp->addr.ip4.s_addr & ifp->netmask.ip4.s_addr)
 
18
@@ -646,6 +646,7 @@
 
19
                }
 
20
                if (j == sizeof(addr.ip6.s6_addr))
 
21
                    return(TRUE);
 
22
+               break;
 
23
 #endif
 
24
        }
 
25
     }
 
26
@@ -707,10 +708,11 @@
 
27
        ifp = &interfaces[i];
 
28
        if (ifp->family != family)
 
29
            continue;
 
30
-       switch(family) {
 
31
+       switch (family) {
 
32
            case AF_INET:
 
33
                if ((ifp->addr.ip4.s_addr & mask.ip4.s_addr) == addr.ip4.s_addr)
 
34
                    return(TRUE);
 
35
+               break;
 
36
 #ifdef HAVE_IN6_ADDR
 
37
            case AF_INET6:
 
38
                for (j = 0; j < sizeof(addr.ip6.s6_addr); j++) {
 
39
@@ -719,6 +721,7 @@
 
40
                }
 
41
                if (j == sizeof(addr.ip6.s6_addr))
 
42
                    return(TRUE);
 
43
+               break;
 
44
 #endif /* HAVE_IN6_ADDR */
 
45
        }
 
46
     }