From owner-svn-ports-all@freebsd.org Tue Jun 9 05:48:28 2020 Return-Path: Delivered-To: svn-ports-all@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 24752349A28; Tue, 9 Jun 2020 05:48:28 +0000 (UTC) (envelope-from cy@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 49gzgc09Ynz4fwF; Tue, 9 Jun 2020 05:48:28 +0000 (UTC) (envelope-from cy@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id F061B10F04; Tue, 9 Jun 2020 05:48:27 +0000 (UTC) (envelope-from cy@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id 0595mRsC098735; Tue, 9 Jun 2020 05:48:27 GMT (envelope-from cy@FreeBSD.org) Received: (from cy@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id 0595mQQq098730; Tue, 9 Jun 2020 05:48:26 GMT (envelope-from cy@FreeBSD.org) Message-Id: <202006090548.0595mQQq098730@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: cy set sender to cy@FreeBSD.org using -f From: Cy Schubert Date: Tue, 9 Jun 2020 05:48:26 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r538281 - in head: net/hostapd security/wpa_supplicant security/wpa_supplicant/files X-SVN-Group: ports-head X-SVN-Commit-Author: cy X-SVN-Commit-Paths: in head: net/hostapd security/wpa_supplicant security/wpa_supplicant/files X-SVN-Commit-Revision: 538281 X-SVN-Commit-Repository: ports MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-all@freebsd.org X-Mailman-Version: 2.1.33 Precedence: list List-Id: SVN commit messages for the ports tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Jun 2020 05:48:28 -0000 Author: cy Date: Tue Jun 9 05:48:26 2020 New Revision: 538281 URL: https://svnweb.freebsd.org/changeset/ports/538281 Log: UPnP SUBSCRIBE misbehavior in hostapd WPS AP As published by our hostapd upstream Vulnerability General security vulnerability in the way the callback URLs in the UPnP SUBSCRIBE command are used were reported (VU#339275, CVE-2020-12695). Some of the described issues may be applicable to the use of UPnP in WPS AP mode functionality for supporting external registrars. Such issues could allow a device connected to the local network (i.e., a device that has been authorized to transmit packets in the network in which the AP is located) could trigger the AP to initiate a HTTP (TCP/IP) connection to an arbitrary URL, including connections to servers in external networks. This could have a security implication if traffic from the local network to external destinations have different rules (e.g., firewall and packet inspection) for different local hosts and the AP having access to external hosts while the attacker controlled local device not having such access. Such deployment cases may not be common for networks where WPS would be enabled, but it is not possible to completely rule out the applicability to cases where hostapd is used to control a WPS enabled AP. In addition to the more generic issues with the UPnP protocol, couple of implementation specific issues in hostapd were discovered while reviewing this area of the WPS implementation. These issues could allow local devices (i.e., devices that have been authorized to transmit packets in the network in which the AP is located) to trigger misbehavior in hostapd and cause the process to either get terminated or to start using more CPU resources by using a specially constructed SUBSCRIBE command. All these issues require the attacker to be able to discover the UPnP service provided by hostapd and to open a TCP connection toward the IP address of the AP. The former requires access to the local network to be able to receive broadcast packets and the latter requires access to initiate TCP/IP connection to the IP address used by the AP. In most common AP deployment cases, both of these operations are available only from the local network. Vulnerable versions/configurations All hostapd versions with WPS AP support with UPnP enabled in the build parameters (CONFIG_WPS_UPNP=y) and in the runtime configuration (upnp_iface). Possible mitigation steps - Disable WPS UPnP support in the hostapd runtime configuration by removing the upnp_iface parameter. - Merge the following commits to hostapd and rebuild: For CVE-2020-12695: WPS UPnP: Do not allow event subscriptions with URLs to other networks For the other issues: WPS UPnP: Fix event message generation using a long URL path WPS UPnP: Handle HTTP initiation failures for events more properly These patches are available from https://w1.fi/security/2020-1/ - Update to hostapd v2.10 or newer, once available Obtained from: https://w1.fi/security/2020-1/ MFH: 2020Q2 Security: VU#339275 and CVE-2020-12695 Modified: head/net/hostapd/Makefile (contents, props changed) head/net/hostapd/distinfo (contents, props changed) head/security/wpa_supplicant/Makefile (contents, props changed) head/security/wpa_supplicant/distinfo (contents, props changed) head/security/wpa_supplicant/files/patch-src_wps_wps__upnp.c (contents, props changed) Modified: head/net/hostapd/Makefile ============================================================================== --- head/net/hostapd/Makefile Tue Jun 9 05:40:02 2020 (r538280) +++ head/net/hostapd/Makefile Tue Jun 9 05:48:26 2020 (r538281) @@ -3,11 +3,14 @@ PORTNAME= hostapd PORTVERSION= 2.9 -PORTREVISION= 1 +PORTREVISION= 2 CATEGORIES= net MASTER_SITES= https://w1.fi/releases/ -PATCH_SITES= https://w1.fi/security/2018-1/:2018_1 +PATCH_SITES= https://w1.fi/security/2020-1/ +PATCHFILES= 0001-WPS-UPnP-Do-not-allow-event-subscriptions-with-URLs-.patch:-p1 \ + 0002-WPS-UPnP-Fix-event-message-generation-using-a-long-U.patch:-p1 \ + 0003-WPS-UPnP-Handle-HTTP-initiation-failures-for-events-.patch:-p1 MAINTAINER= cy@FreeBSD.org COMMENT= IEEE 802.11 AP, IEEE 802.1X/WPA/WPA2/EAP/RADIUS Authenticator Modified: head/net/hostapd/distinfo ============================================================================== --- head/net/hostapd/distinfo Tue Jun 9 05:40:02 2020 (r538280) +++ head/net/hostapd/distinfo Tue Jun 9 05:48:26 2020 (r538281) @@ -1,3 +1,9 @@ -TIMESTAMP = 1566442225 +TIMESTAMP = 1591652140 SHA256 (hostapd-2.9.tar.gz) = 881d7d6a90b2428479288d64233151448f8990ab4958e0ecaca7eeb3c9db2bd7 SIZE (hostapd-2.9.tar.gz) = 2244312 +SHA256 (0001-WPS-UPnP-Do-not-allow-event-subscriptions-with-URLs-.patch) = 2d9a5b9d616f1b4aa4a22b967cee866e2f69b798b0b46803a7928c8559842bd7 +SIZE (0001-WPS-UPnP-Do-not-allow-event-subscriptions-with-URLs-.patch) = 5909 +SHA256 (0002-WPS-UPnP-Fix-event-message-generation-using-a-long-U.patch) = 49feb35a5276279b465f6836d6fa2c6b34d94dc979e8b840d1918865c04260de +SIZE (0002-WPS-UPnP-Fix-event-message-generation-using-a-long-U.patch) = 2284 +SHA256 (0003-WPS-UPnP-Handle-HTTP-initiation-failures-for-events-.patch) = a8212a2d89a5bab2824d22b6047e7740553df163114fcec94832bfa9c5c5d78a +SIZE (0003-WPS-UPnP-Handle-HTTP-initiation-failures-for-events-.patch) = 1553 Modified: head/security/wpa_supplicant/Makefile ============================================================================== --- head/security/wpa_supplicant/Makefile Tue Jun 9 05:40:02 2020 (r538280) +++ head/security/wpa_supplicant/Makefile Tue Jun 9 05:48:26 2020 (r538281) @@ -2,11 +2,14 @@ PORTNAME= wpa_supplicant PORTVERSION= 2.9 -PORTREVISION= 5 +PORTREVISION= 6 CATEGORIES= security net MASTER_SITES= https://w1.fi/releases/ -PATCH_SITES= https://w1.fi/security/2018-1/:2018_1 +PATCH_SITES= https://w1.fi/security/2020-1/ +PATCHFILES= 0001-WPS-UPnP-Do-not-allow-event-subscriptions-with-URLs-.patch:-p1 \ + 0002-WPS-UPnP-Fix-event-message-generation-using-a-long-U.patch:-p1 \ + 0003-WPS-UPnP-Handle-HTTP-initiation-failures-for-events-.patch:-p1 MAINTAINER= cy@FreeBSD.org COMMENT= Supplicant (client) for WPA/802.1x protocols Modified: head/security/wpa_supplicant/distinfo ============================================================================== --- head/security/wpa_supplicant/distinfo Tue Jun 9 05:40:02 2020 (r538280) +++ head/security/wpa_supplicant/distinfo Tue Jun 9 05:48:26 2020 (r538281) @@ -1,3 +1,9 @@ -TIMESTAMP = 1566442248 +TIMESTAMP = 1591652317 SHA256 (wpa_supplicant-2.9.tar.gz) = fcbdee7b4a64bea8177973299c8c824419c413ec2e3a95db63dd6a5dc3541f17 SIZE (wpa_supplicant-2.9.tar.gz) = 3231785 +SHA256 (0001-WPS-UPnP-Do-not-allow-event-subscriptions-with-URLs-.patch) = 2d9a5b9d616f1b4aa4a22b967cee866e2f69b798b0b46803a7928c8559842bd7 +SIZE (0001-WPS-UPnP-Do-not-allow-event-subscriptions-with-URLs-.patch) = 5909 +SHA256 (0002-WPS-UPnP-Fix-event-message-generation-using-a-long-U.patch) = 49feb35a5276279b465f6836d6fa2c6b34d94dc979e8b840d1918865c04260de +SIZE (0002-WPS-UPnP-Fix-event-message-generation-using-a-long-U.patch) = 2284 +SHA256 (0003-WPS-UPnP-Handle-HTTP-initiation-failures-for-events-.patch) = a8212a2d89a5bab2824d22b6047e7740553df163114fcec94832bfa9c5c5d78a +SIZE (0003-WPS-UPnP-Handle-HTTP-initiation-failures-for-events-.patch) = 1553 Modified: head/security/wpa_supplicant/files/patch-src_wps_wps__upnp.c ============================================================================== --- head/security/wpa_supplicant/files/patch-src_wps_wps__upnp.c Tue Jun 9 05:40:02 2020 (r538280) +++ head/security/wpa_supplicant/files/patch-src_wps_wps__upnp.c Tue Jun 9 05:48:26 2020 (r538281) @@ -1,6 +1,6 @@ ---- src/wps/wps_upnp.c.orig 2015-03-15 17:30:39 UTC -+++ src/wps/wps_upnp.c -@@ -837,7 +837,8 @@ fail: +--- src/wps/wps_upnp.c.orig 2020-06-08 14:40:50.402529000 -0700 ++++ src/wps/wps_upnp.c 2020-06-08 15:48:08.294830000 -0700 +@@ -861,7 +861,8 @@ } @@ -10,7 +10,19 @@ #include #include #include -@@ -924,7 +925,8 @@ int get_netif_info(const char *net_if, u +@@ -950,7 +951,11 @@ + errno, strerror(errno)); + goto fail; + } ++#if defined(__FreeBSD__) || defined(__FreeBSD_kernel__) ++ addr = (struct sockaddr_in *) &req.ifr_addr; ++#else + addr = (struct sockaddr_in *) &req.ifr_netmask; ++#endif + netmask->s_addr = addr->sin_addr.s_addr; + } + +@@ -962,7 +967,8 @@ goto fail; } os_memcpy(mac, req.ifr_addr.sa_data, 6);