← Back to branch summary

~ubuntu-branches/ubuntu/precise/maas/precise-updates

« back to all changes in this revision

Viewing changes to debian/patches/CVE-2013-1058.patch

Tags: 1.2+bzr1373+dfsg-0ubuntu1~12.04.4
https://launchpad.net/bugs/1039513
https://launchpad.net/bugs/1158425
* SECURITY UPDATE: failure to authenticate downloaded content (LP: #1039513)
  - debian/patches/CVE-2013-1058.patch: Authenticate downloaded files with
    GnuPG and MD5SUM files. Thanks to Julian Edwards.
  - CVE-2013-1058
* SECURITY UPDATE: configuration options may be loaded from current working
  directory (LP: #1158425)
  - debian/patches/CVE-2013-1057-1-2.patch: Do not load configuration
    options from the current working directory. Thanks to Julian Edwards.
  - CVE-2013-1057

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/patches/CVE-2013-1058.patch
 
1
Description: maas-import-pxe-files doesn't cryptographically verify what it downloads
 
2
Origin: https://bugs.launchpad.net/maas/+bug/1039513
 
3
Author: Julian Edwards
 
4
 
 
5
=== modified file 'scripts/maas-import-pxe-files'
 
6
---
 
7
 scripts/maas-import-pxe-files |   96 ++++++++++++++++++++++++++++++++++++++----
 
8
 1 file changed, 89 insertions(+), 7 deletions(-)
 
9
 
 
10
Index: b/scripts/maas-import-pxe-files
 
11
===================================================================
 
12
--- a/scripts/maas-import-pxe-files
 
13
+++ b/scripts/maas-import-pxe-files
 
14
@@ -20,6 +20,9 @@
 
15
 local_settings="$(pwd)/$settings"
 
16
 [ -r $local_settings ] && . $local_settings
 
17
 
 
18
+# Location of the GPG keyring for the Ubuntu archive.
 
19
+GPG_KEYRING="${GPG_KEYRING:-/usr/share/keyrings/ubuntu-archive-keyring.gpg}"
 
20
+
 
21
 # Download locations for Ubuntu releases.
 
22
 MAIN_ARCHIVE=${MAIN_ARCHIVE:-http://archive.ubuntu.com/ubuntu/}
 
23
 PORTS_ARCHIVE=${PORTS_ARCHIVE:-http://ports.ubuntu.com/ubuntu-ports/}
 
24
@@ -45,6 +48,12 @@
 
25
 # Default is yes.
 
26
 IMPORT_EPHEMERALS=${IMPORT_EPHEMERALS:-1}
 
27
 
 
28
+fail() {
 
29
+    local msg=$1
 
30
+
 
31
+    echo $msg >&2
 
32
+    exit 1
 
33
+}
 
34
 
 
35
 # Show script usage/summary.
 
36
 show_usage() {
 
37
@@ -61,16 +70,15 @@
 
38
     echo
 
39
 }
 
40
 
 
41
-
 
42
-# Put together a full URL for where the installer files for architecture $1
 
43
-# and release $2 can be downloaded.
 
44
-compose_installer_download_url() {
 
45
+# Return a URL that points to the images directory for the relevant
 
46
+# release/arch.
 
47
+compose_installer_base_url() {
 
48
     local arch=$1 release=$2
 
49
 
 
50
     case $arch in
 
51
         amd64/*|i386/*)
 
52
             local installer_url="$MAIN_ARCHIVE/dists/$release/main/installer-${arch%%/*}"
 
53
-            echo "$installer_url/current/images/netboot/ubuntu-installer/${arch%%/*}/"
 
54
+            echo "$installer_url/current/images/"
 
55
             ;;
 
56
         armhf/*)
 
57
             # No ARM server installers were available in precise, so always go for -updates for now
 
58
@@ -81,7 +89,26 @@
 
59
                 updates=
 
60
             fi
 
61
             local installer_url="$PORTS_ARCHIVE/dists/${release}${updates}/main/installer-${arch%%/*}"
 
62
-            echo "$installer_url/current/images/${arch#*/}/netboot/"
 
63
+            echo "$installer_url/current/images/"
 
64
+            ;;
 
65
+        *)
 
66
+            echo "Unknown architecture: $arch" >&2
 
67
+            exit 1
 
68
+            ;;
 
69
+    esac
 
70
+}
 
71
+
 
72
+# Return the URL part that is appended to the base url that gives the location
 
73
+# of the images.
 
74
+compose_installer_download_url_postfix() {
 
75
+    local arch=$1
 
76
+
 
77
+    case $arch in
 
78
+        amd64/*|i386/*)
 
79
+            echo "netboot/ubuntu-installer/${arch%%/*}/"
 
80
+            ;;
 
81
+        armhf/*)
 
82
+            echo "${arch#*/}/netboot/"
 
83
             ;;
 
84
         *)
 
85
             echo "Unknown architecture: $arch" >&2
 
86
@@ -90,6 +117,50 @@
 
87
     esac
 
88
 }
 
89
 
 
90
+# Put together a full URL for where the installer files for architecture $1
 
91
+# and release $2 can be downloaded.
 
92
+compose_installer_download_url() {
 
93
+    local arch=$1 release=$2
 
94
+
 
95
+    base_url=$(compose_installer_base_url $arch $release)
 
96
+    postfix=$(compose_installer_download_url_postfix $arch)
 
97
+
 
98
+    echo "$base_url/$postfix"
 
99
+}
 
100
+
 
101
+fetch_server_md5sums() {
 
102
+    local base_url=$1
 
103
+    local ignore
 
104
+
 
105
+    $DOWNLOAD "$base_url/MD5SUMS" &&
 
106
+        $DOWNLOAD "$base_url/MD5SUMS.gpg" ||
 
107
+            fail "unable to download $base_url/MD5SUMS[.gpg]"
 
108
+
 
109
+    ignore=$(gpg --keyring=$GPG_KEYRING --verify MD5SUMS.gpg MD5SUMS 2>&1) ||
 
110
+        fail "failed to verify MD5SUMS via $GPG_KEYRING ($base_url/MD5SUMS)"
 
111
+}
 
112
+
 
113
+get_md5sum_for_file() {
 
114
+    local filename=$1
 
115
+
 
116
+    # The filename supplied in $1 must be the full path as seen in the
 
117
+    # MD5SUMS file.  The files are rooted from a single place so the grepped
 
118
+    # string will only match once.
 
119
+    server_md5sum=$(grep $filename MD5SUMS|awk '{print $1}') ||
 
120
+        fail "failed to find checksum for $filename"
 
121
+    echo $server_md5sum
 
122
+}
 
123
+
 
124
+check_checksum() {
 
125
+    local server_md5sum=$1 file_on_disk=$2
 
126
+    local md5sum
 
127
+
 
128
+    md5sum=$(md5sum $file_on_disk|awk '{print $1}')
 
129
+
 
130
+    if [ "$md5sum" != "$server_md5sum" ]; then
 
131
+        fail "md5 checksum mismatch for $file_on_disk: expected $server_md5sum, got $md5sum"
 
132
+    fi
 
133
+}
 
134
 
 
135
 # Return a list of files for architecture $1 and release $2 that need to be
 
136
 # downloaded
 
137
@@ -147,16 +218,23 @@
 
138
 # architecture $1 and install it into the TFTP directory hierarchy.
 
139
 update_install_files() {
 
140
     local arch=$1 release=$2
 
141
-    local files file url
 
142
+    local files file url file_prefix filename_in_md5sums_file md5sum
 
143
 
 
144
     files=$(compose_installer_download_files $arch $release)
 
145
     url=$(compose_installer_download_url $arch $release)
 
146
 
 
147
     mkdir "install"
 
148
     pushd "install" >/dev/null
 
149
+    fetch_server_md5sums $(compose_installer_base_url $arch $release)
 
150
+    echo "MD5SUMS GPG signature OK for $arch $release"
 
151
     for file in $files
 
152
     do
 
153
         $DOWNLOAD $url/$file
 
154
+        file_prefix=$(compose_installer_download_url_postfix $arch)
 
155
+        filename_in_md5sums_file=$file_prefix$file
 
156
+        md5sum=$(get_md5sum_for_file $filename_in_md5sums_file)
 
157
+        check_checksum $md5sum $file
 
158
+        echo "'$file' md5sum OK"
 
159
     done
 
160
     rename_installer_download_files $arch $release
 
161
     popd >/dev/null
 
162
@@ -216,4 +294,8 @@
 
163
     esac
 
164
 fi
 
165
 
 
166
+if [ ! -f "$GPG_KEYRING" ]; then
 
167
+    fail "gpg keyring $GPG_KEYRING is not a file"
 
168
+fi
 
169
+
 
170
 main