From owner-svn-src-all@freebsd.org Wed Mar 16 22:30:04 2016 Return-Path: Delivered-To: svn-src-all@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id C85E8AD39C5; Wed, 16 Mar 2016 22:30:04 +0000 (UTC) (envelope-from glebius@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id A3D05D93; Wed, 16 Mar 2016 22:30:04 +0000 (UTC) (envelope-from glebius@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id u2GMU3vu043038; Wed, 16 Mar 2016 22:30:03 GMT (envelope-from glebius@FreeBSD.org) Received: (from glebius@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id u2GMU3b1043034; Wed, 16 Mar 2016 22:30:03 GMT (envelope-from glebius@FreeBSD.org) Message-Id: <201603162230.u2GMU3b1043034@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: glebius set sender to glebius@FreeBSD.org using -f From: Gleb Smirnoff Date: Wed, 16 Mar 2016 22:30:03 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-releng@freebsd.org Subject: svn commit: r296953 - in releng/9.3: . crypto/openssh sys/amd64/amd64 sys/conf X-SVN-Group: releng MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 16 Mar 2016 22:30:04 -0000 Author: glebius Date: Wed Mar 16 22:30:03 2016 New Revision: 296953 URL: https://svnweb.freebsd.org/changeset/base/296953 Log: o Fix OpenSSH xauth(1) command injection. [SA-16:14] o Fix incorrect argument validation in sysarch(2). [SA-16:15] Security: FreeBSD-SA-16:14.openssh-xauth, CVE-2016-3115 Security: FreeBSD-SA-16:15.sysarch, CVE-2016-1885 Approved by: so Modified: releng/9.3/UPDATING releng/9.3/crypto/openssh/session.c releng/9.3/sys/amd64/amd64/sys_machdep.c releng/9.3/sys/conf/newvers.sh Modified: releng/9.3/UPDATING ============================================================================== --- releng/9.3/UPDATING Wed Mar 16 19:46:22 2016 (r296952) +++ releng/9.3/UPDATING Wed Mar 16 22:30:03 2016 (r296953) @@ -11,6 +11,12 @@ handbook: Items affecting the ports and packages system can be found in /usr/ports/UPDATING. Please read that file before running portupgrade. +20160316 p39 FreeBSD-SA-16:14.openssh-xauth + FreeBSD-SA-16:15.sysarch + + Fix OpenSSH xauth(1) command injection. [SA-16:14] + Fix incorrect argument validation in sysarch(2). [SA-16:15] + 20160310 p38 FreeBSD-SA-16:13.bind FreeBSD-SA-16:12.openssl [revised] Modified: releng/9.3/crypto/openssh/session.c ============================================================================== --- releng/9.3/crypto/openssh/session.c Wed Mar 16 19:46:22 2016 (r296952) +++ releng/9.3/crypto/openssh/session.c Wed Mar 16 22:30:03 2016 (r296953) @@ -48,6 +48,7 @@ __RCSID("$FreeBSD$"); #include +#include #include #include #include @@ -294,6 +295,21 @@ do_authenticated(Authctxt *authctxt) do_cleanup(authctxt); } +/* Check untrusted xauth strings for metacharacters */ +static int +xauth_valid_string(const char *s) +{ + size_t i; + + for (i = 0; s[i] != '\0'; i++) { + if (!isalnum((u_char)s[i]) && + s[i] != '.' && s[i] != ':' && s[i] != '/' && + s[i] != '-' && s[i] != '_') + return 0; + } + return 1; +} + /* * Prepares for an interactive session. This is called after the user has * been successfully authenticated. During this message exchange, pseudo @@ -367,7 +383,13 @@ do_authenticated1(Authctxt *authctxt) s->screen = 0; } packet_check_eom(); - success = session_setup_x11fwd(s); + if (xauth_valid_string(s->auth_proto) && + xauth_valid_string(s->auth_data)) + success = session_setup_x11fwd(s); + else { + success = 0; + error("Invalid X11 forwarding data"); + } if (!success) { free(s->auth_proto); free(s->auth_data); @@ -2199,7 +2221,13 @@ session_x11_req(Session *s) s->screen = packet_get_int(); packet_check_eom(); - success = session_setup_x11fwd(s); + if (xauth_valid_string(s->auth_proto) && + xauth_valid_string(s->auth_data)) + success = session_setup_x11fwd(s); + else { + success = 0; + error("Invalid X11 forwarding data"); + } if (!success) { free(s->auth_proto); free(s->auth_data); Modified: releng/9.3/sys/amd64/amd64/sys_machdep.c ============================================================================== --- releng/9.3/sys/amd64/amd64/sys_machdep.c Wed Mar 16 19:46:22 2016 (r296952) +++ releng/9.3/sys/amd64/amd64/sys_machdep.c Wed Mar 16 22:30:03 2016 (r296953) @@ -586,8 +586,8 @@ amd64_set_ldt(td, uap, descs) struct i386_ldt_args *uap; struct user_segment_descriptor *descs; { - int error = 0, i; - int largest_ld; + int error = 0; + unsigned int largest_ld, i; struct mdproc *mdp = &td->td_proc->p_md; struct proc_ldt *pldt; struct user_segment_descriptor *dp; Modified: releng/9.3/sys/conf/newvers.sh ============================================================================== --- releng/9.3/sys/conf/newvers.sh Wed Mar 16 19:46:22 2016 (r296952) +++ releng/9.3/sys/conf/newvers.sh Wed Mar 16 22:30:03 2016 (r296953) @@ -32,7 +32,7 @@ TYPE="FreeBSD" REVISION="9.3" -BRANCH="RELEASE-p38" +BRANCH="RELEASE-p39" if [ "X${BRANCH_OVERRIDE}" != "X" ]; then BRANCH=${BRANCH_OVERRIDE} fi