diff options
Diffstat (limited to 'user/cyrus-sasl')
| -rw-r--r-- | user/cyrus-sasl/APKBUILD | 100 | ||||
| -rw-r--r-- | user/cyrus-sasl/CVE-2013-4122.patch | 117 | ||||
| -rw-r--r-- | user/cyrus-sasl/cyrus-sasl-2.1.25-avoid_pic_overwrite.patch | 27 | ||||
| -rw-r--r-- | user/cyrus-sasl/cyrus-sasl-2.1.26-size_t.patch | 12 | ||||
| -rw-r--r-- | user/cyrus-sasl/saslauthd.initd | 22 |
5 files changed, 278 insertions, 0 deletions
diff --git a/user/cyrus-sasl/APKBUILD b/user/cyrus-sasl/APKBUILD new file mode 100644 index 000000000..d8b789fd3 --- /dev/null +++ b/user/cyrus-sasl/APKBUILD @@ -0,0 +1,100 @@ +# Contributor: Leonardo Arena <rnalrd@alpinelinux.org> +# Maintainer: +pkgname=cyrus-sasl +pkgver=2.1.26 +pkgrel=13 +pkgdesc="Cyrus Simple Authentication Service Layer (SASL)" +url="https://www.cyrusimap.org/sasl/" +arch="all" +options="!check" # No test suite. +license="BSD-4-Clause" +subpackages="$pkgname-dev $pkgname-doc $pkgname-gssapi $pkgname-gs2 + $pkgname-scram $pkgname-ntlm $pkgname-crammd5 $pkgname-digestmd5 + libsasl $pkgname-openrc" +depends="" +makedepends="db-dev openssl-dev heimdal-dev + autoconf automake libtool" +source="ftp://ftp.cyrusimap.org/$pkgname/$pkgname-$pkgver.tar.gz + saslauthd.initd + cyrus-sasl-2.1.25-avoid_pic_overwrite.patch + cyrus-sasl-2.1.26-size_t.patch + CVE-2013-4122.patch + " + +# secfixes: +# 2.1.26-r7: +# - CVE-2013-4122 + +prepare() { + cd "$builddir" + default_prepare + + # the libtool they ship is broken + sed 's/AM_CONFIG_HEADER/AC_CONFIG_HEADERS/' -i configure.in + rm -rf config/config.guess config/config.sub config/ltconfig \ + config/ltmain.sh config/libtool.m4 autom4te.cache + libtoolize -c && aclocal -I config -I cmulocal \ + && automake -a -c && autoheader && autoconf +} + +build() { + cd "$builddir" + ./configure \ + --build=$CBUILD \ + --host=$CHOST \ + --prefix=/usr \ + --sysconfdir=/etc \ + --localstatedir=/var \ + --disable-anon \ + --enable-cram \ + --enable-digest \ + --enable-login \ + --enable-ntlm \ + --disable-otp \ + --enable-plain \ + --with-gss_impl=heimdal \ + --with-devrandom=/dev/urandom \ + --without-ldap \ + --with-saslauthd=/var/run/saslauthd \ + --mandir=/usr/share/man + # parallel build is broken + make -j1 +} + +package() { + cd "$builddir" + make -j1 DESTDIR="$pkgdir" install + install -D -m644 COPYING "$pkgdir"/usr/share/licenses/$pkgname/COPYING + + install -Dm755 ../saslauthd.initd "$pkgdir"/etc/init.d/saslauthd + install -d "$pkgdir"/var/run/saslauthd +} + +_plugindir=usr/lib/sasl2 +_plugin() { + depends= + replaces="libsasl" + pkgdesc="Cyrus SASL plugin for $2" + mkdir -p "$subpkgdir"/$_plugindir + mv "$pkgdir"/$_plugindir/lib${1}.so* "$subpkgdir"/$_plugindir/ +} + +gssapi() { _plugin gssapiv2 "Kerberos (GSSAPI)"; } +gs2() { _plugin gs2 GS2; } +scram() { _plugin scram SCRAM; } +ntlm() { _plugin ntlm NTLM; } +crammd5() { _plugin crammd5 CRAM-MD5; } +digestmd5() { _plugin digestmd5 DIGEST-MD5; } + +libsasl() { + depends= + pkgdesc="Cyrus Simple Authentication and Security Layer (SASL) library" + mkdir -p "$subpkgdir"/usr + mv "$pkgdir"/usr/lib "$subpkgdir"/usr/ +} + +sha512sums="78819cb9bb38bea4537d6770d309deeeef09ff44a67526177609d3e1257ff4334d2b5e5131d5a1e4dea7430d8db1918ea9d171f0dee38b5e8337f4b72ed068f0 cyrus-sasl-2.1.26.tar.gz +71a00a22f91f0fb6ba2796acede321a0f071b1d7a99616f0e36c354213777f30575c340b6df392dcbfc103ba7640d046144882f6a7b505f59709bb5c429b44d8 saslauthd.initd +033e3634116e1d3b316052dbe0b671cca0fcfb6063fca1a97d990c422c2ce05109a1e424e84ed9928dc0312a325a7248f2d2e3f9547f84453b36331c01f63be5 cyrus-sasl-2.1.25-avoid_pic_overwrite.patch +fe4c3e6d5230eb50b9e6885129760a12e7bce316b41a3e58b2c550fa83526b91205cd827f7d1367751313559875d32982b95b024b1a22300ac5b35214e7c2b78 cyrus-sasl-2.1.26-size_t.patch +08964bc3ad713e137b8f05f9bac345d79676d14784bc37525f195e8e2a3e6740428237b64f7eeeacc0c71ed6cf1664c6e9c2267ac6df327761d92174a1853744 CVE-2013-4122.patch" diff --git a/user/cyrus-sasl/CVE-2013-4122.patch b/user/cyrus-sasl/CVE-2013-4122.patch new file mode 100644 index 000000000..38f2595a5 --- /dev/null +++ b/user/cyrus-sasl/CVE-2013-4122.patch @@ -0,0 +1,117 @@ +From dedad73e5e7a75d01a5f3d5a6702ab8ccd2ff40d Mon Sep 17 00:00:00 2001 +From: mancha <mancha1@hush.com> +Date: Thu, 11 Jul 2013 10:08:07 +0100 +Subject: Handle NULL returns from glibc 2.17+ crypt() + +Starting with glibc 2.17 (eglibc 2.17), crypt() fails with EINVAL +(w/ NULL return) if the salt violates specifications. Additionally, +on FIPS-140 enabled Linux systems, DES/MD5-encrypted passwords +passed to crypt() fail with EPERM (w/ NULL return). + +When using glibc's crypt(), check return value to avoid a possible +NULL pointer dereference. + +Patch by mancha1@hush.com. + +diff --git a/pwcheck/pwcheck_getpwnam.c b/pwcheck/pwcheck_getpwnam.c +index 4b34222..400289c 100644 +--- a/pwcheck/pwcheck_getpwnam.c ++++ b/pwcheck/pwcheck_getpwnam.c +@@ -32,6 +32,7 @@ char *userid; + char *password; + { + char* r; ++ char* crpt_passwd; + struct passwd *pwd; + + pwd = getpwnam(userid); +@@ -41,7 +42,7 @@ char *password; + else if (pwd->pw_passwd[0] == '*') { + r = "Account disabled"; + } +- else if (strcmp(pwd->pw_passwd, crypt(password, pwd->pw_passwd)) != 0) { ++ else if (!(crpt_passwd = crypt(password, pwd->pw_passwd)) || strcmp(pwd->pw_passwd, (const char *)crpt_passwd) != 0) { + r = "Incorrect password"; + } + else { +diff --git a/pwcheck/pwcheck_getspnam.c b/pwcheck/pwcheck_getspnam.c +index 2b11286..6d607bb 100644 +--- a/pwcheck/pwcheck_getspnam.c ++++ b/pwcheck/pwcheck_getspnam.c +@@ -32,13 +32,15 @@ char *userid; + char *password; + { + struct spwd *pwd; ++ char *crpt_passwd; + + pwd = getspnam(userid); + if (!pwd) { + return "Userid not found"; + } + +- if (strcmp(pwd->sp_pwdp, crypt(password, pwd->sp_pwdp)) != 0) { ++ crpt_passwd = crypt(password, pwd->sp_pwdp); ++ if (!crpt_passwd || strcmp(pwd->sp_pwdp, (const char *)crpt_passwd) != 0) { + return "Incorrect password"; + } + else { +diff --git a/saslauthd/auth_getpwent.c b/saslauthd/auth_getpwent.c +index fc8029d..d4ebe54 100644 +--- a/saslauthd/auth_getpwent.c ++++ b/saslauthd/auth_getpwent.c +@@ -77,6 +77,7 @@ auth_getpwent ( + { + /* VARIABLES */ + struct passwd *pw; /* pointer to passwd file entry */ ++ char *crpt_passwd; /* encrypted password */ + int errnum; + /* END VARIABLES */ + +@@ -105,7 +106,8 @@ auth_getpwent ( + } + } + +- if (strcmp(pw->pw_passwd, (const char *)crypt(password, pw->pw_passwd))) { ++ crpt_passwd = crypt(password, pw->pw_passwd); ++ if (!crpt_passwd || strcmp(pw->pw_passwd, (const char *)crpt_passwd)) { + if (flags & VERBOSE) { + syslog(LOG_DEBUG, "DEBUG: auth_getpwent: %s: invalid password", login); + } +diff --git a/saslauthd/auth_shadow.c b/saslauthd/auth_shadow.c +index 677131b..1988afd 100644 +--- a/saslauthd/auth_shadow.c ++++ b/saslauthd/auth_shadow.c +@@ -210,8 +210,8 @@ auth_shadow ( + RETURN("NO Insufficient permission to access NIS authentication database (saslauthd)"); + } + +- cpw = strdup((const char *)crypt(password, sp->sp_pwdp)); +- if (strcmp(sp->sp_pwdp, cpw)) { ++ cpw = crypt(password, sp->sp_pwdp); ++ if (!cpw || strcmp(sp->sp_pwdp, (const char *)cpw)) { + if (flags & VERBOSE) { + /* + * This _should_ reveal the SHADOW_PW_LOCKED prefix to an +@@ -221,10 +221,8 @@ auth_shadow ( + syslog(LOG_DEBUG, "DEBUG: auth_shadow: pw mismatch: '%s' != '%s'", + sp->sp_pwdp, cpw); + } +- free(cpw); + RETURN("NO Incorrect password"); + } +- free(cpw); + + /* + * The following fields will be set to -1 if: +@@ -286,7 +284,7 @@ auth_shadow ( + RETURN("NO Invalid username"); + } + +- if (strcmp(upw->upw_passwd, crypt(password, upw->upw_passwd)) != 0) { ++ if (!(cpw = crypt(password, upw->upw_passwd)) || (strcmp(upw->upw_passwd, (const char *)cpw) != 0)) { + if (flags & VERBOSE) { + syslog(LOG_DEBUG, "auth_shadow: pw mismatch: %s != %s", + password, upw->upw_passwd); +-- +cgit v0.10.2 + diff --git a/user/cyrus-sasl/cyrus-sasl-2.1.25-avoid_pic_overwrite.patch b/user/cyrus-sasl/cyrus-sasl-2.1.25-avoid_pic_overwrite.patch new file mode 100644 index 000000000..2e5b1750d --- /dev/null +++ b/user/cyrus-sasl/cyrus-sasl-2.1.25-avoid_pic_overwrite.patch @@ -0,0 +1,27 @@ +Author: Fabian Fagerholm <fabbe@debian.org> +Description: This patch makes sure the non-PIC version of libsasldb.a, which +is created out of non-PIC objects, is not going to overwrite the PIC version, +which is created out of PIC objects. The PIC version is placed in .libs, and +the non-PIC version in the current directory. This ensures that both non-PIC +and PIC versions are available in the correct locations. +--- a/lib/Makefile.am ++++ b/lib/Makefile.am +@@ -78,7 +78,7 @@ endif + + libsasl2.a: libsasl2.la $(SASL_STATIC_OBJS) + @echo adding static plugins and dependencies +- $(AR) cru .libs/$@ $(SASL_STATIC_OBJS) ++ $(AR) cru $@ $(SASL_STATIC_OBJS) + @for i in ./libsasl2.la ../sasldb/libsasldb.la ../plugins/lib*.la; do \ + if test ! -f $$i; then continue; fi; . $$i; \ + for j in $$dependency_libs foo; do \ +--- a/sasldb/Makefile.am ++++ b/sasldb/Makefile.am +@@ -63,6 +63,6 @@ libsasldb_a_SOURCES = + EXTRA_libsasldb_a_SOURCES = + + libsasldb.a: libsasldb.la $(SASL_DB_BACKEND_STATIC) +- $(AR) cru .libs/$@ $(SASL_DB_BACKEND_STATIC) ++ $(AR) cru $@ $(SASL_DB_BACKEND_STATIC) + + diff --git a/user/cyrus-sasl/cyrus-sasl-2.1.26-size_t.patch b/user/cyrus-sasl/cyrus-sasl-2.1.26-size_t.patch new file mode 100644 index 000000000..cde823835 --- /dev/null +++ b/user/cyrus-sasl/cyrus-sasl-2.1.26-size_t.patch @@ -0,0 +1,12 @@ +diff -up cyrus-sasl-2.1.26/include/sasl.h.size_t cyrus-sasl-2.1.26/include/sasl.h +--- cyrus-sasl-2.1.26/include/sasl.h.size_t 2012-10-12 09:05:48.000000000 -0500 ++++ cyrus-sasl-2.1.26/include/sasl.h 2013-01-31 13:21:04.007739327 -0600 +@@ -223,6 +223,8 @@ extern "C" { + * they must be called before all other SASL functions: + */ + ++#include <sys/types.h> ++ + /* memory allocation functions which may optionally be replaced: + */ + typedef void *sasl_malloc_t(size_t); diff --git a/user/cyrus-sasl/saslauthd.initd b/user/cyrus-sasl/saslauthd.initd new file mode 100644 index 000000000..2707f533d --- /dev/null +++ b/user/cyrus-sasl/saslauthd.initd @@ -0,0 +1,22 @@ +#!/sbin/openrc-run +# Copyright 1999-2007 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/dev-libs/cyrus-sasl/files/saslauthd2.rc6,v 1.7 2007/04/07 13:03:55 chtekk Exp $ + +depend() { + need net + after firewall +} + +start() { + ebegin "Starting saslauthd" + start-stop-daemon --start --quiet --exec /usr/sbin/saslauthd \ + -- ${SASLAUTHD_OPTS} + eend $? +} + +stop() { + ebegin "Stopping saslauthd" + start-stop-daemon --stop --quiet --pidfile /var/run/saslauthd/saslauthd.pid + eend $? +} |