Date: 28 Jun 2004 16:29:29 -0000 From: Thomas-Martin Seck <tmseck@netcologne.de> To: FreeBSD-gnats-submit@FreeBSD.org Subject: ports/68448: [Maintainer] www/squid: fix FOLLOW_XFF, use vendor patch for NTLM vulnerability Message-ID: <20040628162929.2211.qmail@laurel.tmseck.homedns.org> Resent-Message-ID: <200406281630.i5SGUP0C048835@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 68448 >Category: ports >Synopsis: [Maintainer] www/squid: fix FOLLOW_XFF, use vendor patch for NTLM vulnerability >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-ports-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: maintainer-update >Submitter-Id: current-users >Arrival-Date: Mon Jun 28 16:30:25 GMT 2004 >Closed-Date: >Last-Modified: >Originator: Thomas-Martin Seck >Release: FreeBSD 4.10-STABLE i386 >Organization: a private site in Germany >Environment: FreeBSD ports collection as of June, 28th, 2004. >Description: - fix the patch that simulates the autotools bootstrap for the follow-xff- patchset (thanks to Michael Ranner for spotting the problem and testing the fix). While at it, wordsmith the comments in the patch. - use the official patch for the NTLM auth helper vulnerability, see <http://www.squid-cache.org/Versions/v2/2.5/bugs/>; for details. This patch is functionally identical to the FreeBSD patch in files/patch-helpers-ntlm_auth-SMB-libntlmssp.c - build install the SMB basic authentication helpers by default, too - bump PORTREVISION Note to committer: please 'cvs rm' files/patch-helpers-ntlm_auth-SMB-libntlmssp.c >How-To-Repeat: >Fix: Apply this patch: Index: distinfo =================================================================== --- distinfo (.../www/squid) (revision 101) +++ distinfo (.../local/squid) (revision 101) @@ -48,3 +48,5 @@ SIZE (squid2.5/squid-2.5.STABLE5-CONNECT_log_size.patch) = 2011 MD5 (squid2.5/squid-2.5.STABLE5-proxy_abuse.patch) = 8b169a288a0491a760f4d04c4f5eab21 SIZE (squid2.5/squid-2.5.STABLE5-proxy_abuse.patch) = 761 +MD5 (squid2.5/squid-2.5.STABLE5-ntlm_auth_overflow.patch) = 30c7c5e2ba03655dbde9d3e65409baed +SIZE (squid2.5/squid-2.5.STABLE5-ntlm_auth_overflow.patch) = 3198 Index: files/follow_xff-configure.patch =================================================================== --- files/follow_xff-configure.patch (.../www/squid) (revision 101) +++ files/follow_xff-configure.patch (.../local/squid) (revision 101) @@ -1,10 +1,23 @@ -!Patch configure directly to enable testing for the -!--enable-follow-x-forwarding-for configuration option -!instead of running configure.in through autoconf as in the -!original follow-XFF patchset from devel.squid-cache.org. +!Simulate the autotools bootstrap of the follow-x-forwarded-for patchset. +! !Beware that all line number informations in configure.log greater -!than 2972 are offset by -29 (correcting all line numbers would have +!than 2972 are offset by at least -29 (correcting all line numbers would have !bloated the patch by 92kB!) +--- include/autoconf.h.in.orig Sat Jan 18 02:46:11 2003 ++++ include/autoconf.h.in Thu Jun 24 13:19:07 2004 +@@ -291,6 +291,12 @@ + #define USE_IDENT 1 + + /* ++ * Compile in support for following X-Forwarded-For headers? ++ * Enabled by default. ++ */ ++#define FOLLOW_X_FORWARDED_FOR 1 ++ ++/* + * If your system has statvfs(), and if it actually works! + */ + #undef HAVE_STATVFS --- configure.orig Tue Mar 2 10:18:14 2004 +++ configure Tue Mar 2 10:18:56 2004 @@ -222,6 +222,12 @@ Index: files/patch-helpers-ntlm_auth-SMB-libntlmssp.c =================================================================== --- files/patch-helpers-ntlm_auth-SMB-libntlmssp.c (.../www/squid) (revision 101) +++ files/patch-helpers-ntlm_auth-SMB-libntlmssp.c (.../local/squid) (revision 101) @@ -1,78 +0,0 @@ -This patch fixes a buffer overflow vulnerability in the NTLM auth -helper which was reported by iDefense on the 07th June 2004. -Original advisory: -<http://www.idefense.com/application/poi/display?id=107&type=vulnerabilities&flashstatus=false>; -CVE-ID: CAN-2004-0541 -Patch and correction obtained from: -<http://www.squid-cache.org/~wessels/patch/libntlmssp.c.patch>; -<http://www.squid-cache.org/bugs/show_bug.cgi?id=998>; - ---- helpers/ntlm_auth/SMB/libntlmssp.c.orig Fri Nov 30 10:50:06 2001 -+++ helpers/ntlm_auth/SMB/libntlmssp.c Fri Jun 18 13:17:35 2004 -@@ -161,7 +161,10 @@ make_challenge(char *domain, char *domai - #define min(A,B) (A<B?A:B) - - int ntlm_errno; --static char credentials[1024]; /* we can afford to waste */ -+#define MAX_USERNAME_LEN 255 -+#define MAX_DOMAIN_LEN 255 -+#define MAX_PASSWD_LEN 31 -+static char credentials[MAX_USERNAME_LEN+MAX_DOMAIN_LEN+2]; /* we can afford to waste */ - - - /* Fetches the user's credentials from the challenge. -@@ -197,7 +200,7 @@ char * - ntlm_check_auth(ntlm_authenticate * auth, int auth_length) - { - int rv; -- char pass[25] /*, encrypted_pass[40] */; -+ char pass[MAX_PASSWD_LEN+1]; - char *domain = credentials; - char *user; - lstring tmp; -@@ -215,6 +218,11 @@ ntlm_check_auth(ntlm_authenticate * auth - ntlm_errno = NTLM_LOGON_ERROR; - return NULL; - } -+ if (tmp.l > MAX_DOMAIN_LEN) { -+ debug("Domain string exceeds %d bytes, rejecting\n", MAX_DOMAIN_LEN); -+ ntlm_errno = NTLM_LOGON_ERROR; -+ return NULL; -+ } - memcpy(domain, tmp.str, tmp.l); - user = domain + tmp.l; - *user++ = '\0'; -@@ -226,20 +234,30 @@ ntlm_check_auth(ntlm_authenticate * auth - ntlm_errno = NTLM_LOGON_ERROR; - return NULL; - } -+ if (tmp.l > MAX_USERNAME_LEN) { -+ debug("Username string exceeds %d bytes, rejecting\n", MAX_USERNAME_LEN); -+ ntlm_errno = NTLM_LOGON_ERROR; -+ return NULL; -+ } - memcpy(user, tmp.str, tmp.l); - *(user + tmp.l) = '\0'; - - -- /* Authenticating against the NT response doesn't seem to work... */ -+ /* Authenticating against the NT response doesn't seem to work... */ - tmp = ntlm_fetch_string((char *) auth, auth_length, &auth->lmresponse); - if (tmp.str == NULL || tmp.l == 0) { - fprintf(stderr, "No auth at all. Returning no-auth\n"); - ntlm_errno = NTLM_LOGON_ERROR; - return NULL; - } -- -+ if (tmp.l > MAX_PASSWD_LEN) { -+ debug("Password string exceeds %d bytes, rejecting\n", MAX_PASSWD_LEN); -+ ntlm_errno = NTLM_LOGON_ERROR; -+ return NULL; -+ } -+ - memcpy(pass, tmp.str, tmp.l); -- pass[25] = '\0'; -+ pass[min(MAX_PASSWD_LEN,tmp.l)] = '\0'; - - #if 1 - debug ("Empty LM pass detection: user: '%s', ours:'%s', his: '%s'" Index: Makefile =================================================================== --- Makefile (.../www/squid) (revision 101) +++ Makefile (.../local/squid) (revision 101) @@ -29,7 +29,7 @@ PORTNAME= squid PORTVERSION= 2.5.5 -PORTREVISION= 11 +PORTREVISION= 12 CATEGORIES= www MASTER_SITES= \ ftp://ftp.squid-cache.org/pub/%SUBDIR%/ \ @@ -65,7 +65,8 @@ squid-2.5.STABLE5-dns_localhost.patch \ squid-2.5.STABLE5-msnt_auth_doc.patch \ squid-2.5.STABLE5-CONNECT_log_size.patch \ - squid-2.5.STABLE5-proxy_abuse.patch + squid-2.5.STABLE5-proxy_abuse.patch \ + squid-2.5.STABLE5-ntlm_auth_overflow.patch PATCH_DIST_STRIP= -p1 MAINTAINER= tmseck@netcologne.de @@ -123,7 +124,7 @@ # Authentication methods and modules: -basic_auth= NCSA PAM YP MSNT winbind +basic_auth= NCSA PAM YP MSNT SMB winbind external_acl= ip_user unix_group wbinfo_group winbind_group MAN8+= pam_auth.8 squid_unix_group.8 .if defined(WITH_SQUID_LDAP_AUTH) >Release-Note: >Audit-Trail: >Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040628162929.2211.qmail>