From owner-freebsd-ports-bugs@FreeBSD.ORG Mon Jun 28 16:30:25 2004 Return-Path: Delivered-To: freebsd-ports-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id D22DB16A4DF for ; Mon, 28 Jun 2004 16:30:25 +0000 (GMT) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id C64B143D1D for ; Mon, 28 Jun 2004 16:30:25 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) i5SGUPYm048836 for ; Mon, 28 Jun 2004 16:30:25 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.12.11/8.12.11/Submit) id i5SGUP0C048835; Mon, 28 Jun 2004 16:30:25 GMT (envelope-from gnats) Resent-Date: Mon, 28 Jun 2004 16:30:25 GMT Resent-Message-Id: <200406281630.i5SGUP0C048835@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-ports-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Thomas-Martin Seck Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 05B0316A4CF for ; Mon, 28 Jun 2004 16:29:28 +0000 (GMT) Received: from smtp1.netcologne.de (smtp1.netcologne.de [194.8.194.112]) by mx1.FreeBSD.org (Postfix) with ESMTP id 6985143D39 for ; Mon, 28 Jun 2004 16:29:27 +0000 (GMT) (envelope-from thomas@laurel.tmseck.homedns.org) Received: from laurel.tmseck.homedns.org (xdsl-81-173-177-26.netcologne.de [81.173.177.26]) by smtp1.netcologne.de (Postfix) with SMTP id D138E38DB4 for ; Mon, 28 Jun 2004 18:29:23 +0200 (MEST) Received: (qmail 2212 invoked by uid 1001); 28 Jun 2004 16:29:29 -0000 Message-Id: <20040628162929.2211.qmail@laurel.tmseck.homedns.org> Date: 28 Jun 2004 16:29:29 -0000 From: Thomas-Martin Seck To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 Subject: ports/68448: [Maintainer] www/squid: fix FOLLOW_XFF, use vendor patch for NTLM vulnerability X-BeenThere: freebsd-ports-bugs@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: Thomas-Martin Seck List-Id: Ports bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 28 Jun 2004 16:30:26 -0000 >Number: 68448 >Category: ports >Synopsis: [Maintainer] www/squid: fix FOLLOW_XFF, use vendor patch for NTLM vulnerability >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-ports-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: maintainer-update >Submitter-Id: current-users >Arrival-Date: Mon Jun 28 16:30:25 GMT 2004 >Closed-Date: >Last-Modified: >Originator: Thomas-Martin Seck >Release: FreeBSD 4.10-STABLE i386 >Organization: a private site in Germany >Environment: FreeBSD ports collection as of June, 28th, 2004. >Description: - fix the patch that simulates the autotools bootstrap for the follow-xff- patchset (thanks to Michael Ranner for spotting the problem and testing the fix). While at it, wordsmith the comments in the patch. - use the official patch for the NTLM auth helper vulnerability, see for details. This patch is functionally identical to the FreeBSD patch in files/patch-helpers-ntlm_auth-SMB-libntlmssp.c - build install the SMB basic authentication helpers by default, too - bump PORTREVISION Note to committer: please 'cvs rm' files/patch-helpers-ntlm_auth-SMB-libntlmssp.c >How-To-Repeat: >Fix: Apply this patch: Index: distinfo =================================================================== --- distinfo (.../www/squid) (revision 101) +++ distinfo (.../local/squid) (revision 101) @@ -48,3 +48,5 @@ SIZE (squid2.5/squid-2.5.STABLE5-CONNECT_log_size.patch) = 2011 MD5 (squid2.5/squid-2.5.STABLE5-proxy_abuse.patch) = 8b169a288a0491a760f4d04c4f5eab21 SIZE (squid2.5/squid-2.5.STABLE5-proxy_abuse.patch) = 761 +MD5 (squid2.5/squid-2.5.STABLE5-ntlm_auth_overflow.patch) = 30c7c5e2ba03655dbde9d3e65409baed +SIZE (squid2.5/squid-2.5.STABLE5-ntlm_auth_overflow.patch) = 3198 Index: files/follow_xff-configure.patch =================================================================== --- files/follow_xff-configure.patch (.../www/squid) (revision 101) +++ files/follow_xff-configure.patch (.../local/squid) (revision 101) @@ -1,10 +1,23 @@ -!Patch configure directly to enable testing for the -!--enable-follow-x-forwarding-for configuration option -!instead of running configure.in through autoconf as in the -!original follow-XFF patchset from devel.squid-cache.org. +!Simulate the autotools bootstrap of the follow-x-forwarded-for patchset. +! !Beware that all line number informations in configure.log greater -!than 2972 are offset by -29 (correcting all line numbers would have +!than 2972 are offset by at least -29 (correcting all line numbers would have !bloated the patch by 92kB!) +--- include/autoconf.h.in.orig Sat Jan 18 02:46:11 2003 ++++ include/autoconf.h.in Thu Jun 24 13:19:07 2004 +@@ -291,6 +291,12 @@ + #define USE_IDENT 1 + + /* ++ * Compile in support for following X-Forwarded-For headers? ++ * Enabled by default. ++ */ ++#define FOLLOW_X_FORWARDED_FOR 1 ++ ++/* + * If your system has statvfs(), and if it actually works! + */ + #undef HAVE_STATVFS --- configure.orig Tue Mar 2 10:18:14 2004 +++ configure Tue Mar 2 10:18:56 2004 @@ -222,6 +222,12 @@ Index: files/patch-helpers-ntlm_auth-SMB-libntlmssp.c =================================================================== --- files/patch-helpers-ntlm_auth-SMB-libntlmssp.c (.../www/squid) (revision 101) +++ files/patch-helpers-ntlm_auth-SMB-libntlmssp.c (.../local/squid) (revision 101) @@ -1,78 +0,0 @@ -This patch fixes a buffer overflow vulnerability in the NTLM auth -helper which was reported by iDefense on the 07th June 2004. -Original advisory: - -CVE-ID: CAN-2004-0541 -Patch and correction obtained from: - - - ---- helpers/ntlm_auth/SMB/libntlmssp.c.orig Fri Nov 30 10:50:06 2001 -+++ helpers/ntlm_auth/SMB/libntlmssp.c Fri Jun 18 13:17:35 2004 -@@ -161,7 +161,10 @@ make_challenge(char *domain, char *domai - #define min(A,B) (A MAX_DOMAIN_LEN) { -+ debug("Domain string exceeds %d bytes, rejecting\n", MAX_DOMAIN_LEN); -+ ntlm_errno = NTLM_LOGON_ERROR; -+ return NULL; -+ } - memcpy(domain, tmp.str, tmp.l); - user = domain + tmp.l; - *user++ = '\0'; -@@ -226,20 +234,30 @@ ntlm_check_auth(ntlm_authenticate * auth - ntlm_errno = NTLM_LOGON_ERROR; - return NULL; - } -+ if (tmp.l > MAX_USERNAME_LEN) { -+ debug("Username string exceeds %d bytes, rejecting\n", MAX_USERNAME_LEN); -+ ntlm_errno = NTLM_LOGON_ERROR; -+ return NULL; -+ } - memcpy(user, tmp.str, tmp.l); - *(user + tmp.l) = '\0'; - - -- /* Authenticating against the NT response doesn't seem to work... */ -+ /* Authenticating against the NT response doesn't seem to work... */ - tmp = ntlm_fetch_string((char *) auth, auth_length, &auth->lmresponse); - if (tmp.str == NULL || tmp.l == 0) { - fprintf(stderr, "No auth at all. Returning no-auth\n"); - ntlm_errno = NTLM_LOGON_ERROR; - return NULL; - } -- -+ if (tmp.l > MAX_PASSWD_LEN) { -+ debug("Password string exceeds %d bytes, rejecting\n", MAX_PASSWD_LEN); -+ ntlm_errno = NTLM_LOGON_ERROR; -+ return NULL; -+ } -+ - memcpy(pass, tmp.str, tmp.l); -- pass[25] = '\0'; -+ pass[min(MAX_PASSWD_LEN,tmp.l)] = '\0'; - - #if 1 - debug ("Empty LM pass detection: user: '%s', ours:'%s', his: '%s'" Index: Makefile =================================================================== --- Makefile (.../www/squid) (revision 101) +++ Makefile (.../local/squid) (revision 101) @@ -29,7 +29,7 @@ PORTNAME= squid PORTVERSION= 2.5.5 -PORTREVISION= 11 +PORTREVISION= 12 CATEGORIES= www MASTER_SITES= \ ftp://ftp.squid-cache.org/pub/%SUBDIR%/ \ @@ -65,7 +65,8 @@ squid-2.5.STABLE5-dns_localhost.patch \ squid-2.5.STABLE5-msnt_auth_doc.patch \ squid-2.5.STABLE5-CONNECT_log_size.patch \ - squid-2.5.STABLE5-proxy_abuse.patch + squid-2.5.STABLE5-proxy_abuse.patch \ + squid-2.5.STABLE5-ntlm_auth_overflow.patch PATCH_DIST_STRIP= -p1 MAINTAINER= tmseck@netcologne.de @@ -123,7 +124,7 @@ # Authentication methods and modules: -basic_auth= NCSA PAM YP MSNT winbind +basic_auth= NCSA PAM YP MSNT SMB winbind external_acl= ip_user unix_group wbinfo_group winbind_group MAN8+= pam_auth.8 squid_unix_group.8 .if defined(WITH_SQUID_LDAP_AUTH) >Release-Note: >Audit-Trail: >Unformatted: