diff options
author | Diego Elio Pettenò <flameeyes@gentoo.org> | 2010-10-15 15:04:56 +0000 |
---|---|---|
committer | Diego Elio Pettenò <flameeyes@gentoo.org> | 2010-10-15 15:04:56 +0000 |
commit | 8a2dda98201141abb8e02335b650d96e1d624e27 (patch) | |
tree | 7d8215be409d9ae01a8a6486d7504af79e12f0cc /sys-auth | |
parent | Simplify dependencies (changed versioning scheme). (diff) | |
download | historical-8a2dda98201141abb8e02335b650d96e1d624e27.tar.gz historical-8a2dda98201141abb8e02335b650d96e1d624e27.tar.bz2 historical-8a2dda98201141abb8e02335b650d96e1d624e27.zip |
Remove old vulnerable version.
Package-Manager: portage-2.2_rc96/cvs/Linux x86_64
Diffstat (limited to 'sys-auth')
-rw-r--r-- | sys-auth/pam_krb5/ChangeLog | 6 | ||||
-rw-r--r-- | sys-auth/pam_krb5/Manifest | 11 | ||||
-rw-r--r-- | sys-auth/pam_krb5/files/pam_krb5-3.12-CVE-2009-0361-0362.patch | 194 | ||||
-rw-r--r-- | sys-auth/pam_krb5/pam_krb5-3.12.ebuild | 39 |
4 files changed, 9 insertions, 241 deletions
diff --git a/sys-auth/pam_krb5/ChangeLog b/sys-auth/pam_krb5/ChangeLog index ac8ea5093f96..75ca8d664606 100644 --- a/sys-auth/pam_krb5/ChangeLog +++ b/sys-auth/pam_krb5/ChangeLog @@ -1,6 +1,10 @@ # ChangeLog for sys-auth/pam_krb5 # Copyright 1999-2010 Gentoo Foundation; Distributed under the GPL v2 -# $Header: /var/cvsroot/gentoo-x86/sys-auth/pam_krb5/ChangeLog,v 1.37 2010/09/12 04:17:30 josejx Exp $ +# $Header: /var/cvsroot/gentoo-x86/sys-auth/pam_krb5/ChangeLog,v 1.38 2010/10/15 15:04:55 flameeyes Exp $ + + 15 Oct 2010; Diego E. Pettenò <flameeyes@gentoo.org> + -pam_krb5-3.12.ebuild, -files/pam_krb5-3.12-CVE-2009-0361-0362.patch: + Remove old vulnerable version. 12 Sep 2010; Joseph Jezak <josejx@gentoo.org> pam_krb5-4.3.ebuild: Marked ppc stable for bug #326953. diff --git a/sys-auth/pam_krb5/Manifest b/sys-auth/pam_krb5/Manifest index 6806f1e2e78f..9adafa560c54 100644 --- a/sys-auth/pam_krb5/Manifest +++ b/sys-auth/pam_krb5/Manifest @@ -1,17 +1,14 @@ -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 -AUX pam_krb5-3.12-CVE-2009-0361-0362.patch 7309 RMD160 06d55aa90457db36c23e470dcba3d3851c8f345a SHA1 5f85c68623bb334f07f5ef9ac7f937ba49abc0c7 SHA256 d1bc55e80b24cf27d6a90a282d9c8696c30f18d68195e4c3f222b611d3b62052 -DIST pam-krb5-3.12.tar.gz 153230 RMD160 053c6bce707c4f17986a64401bd688ed85cb240b SHA1 363b4c7a1031f134164190c2cf116f41170012ad SHA256 f5242f509212ab08cdf87b7f399469eca08ea8f3f885dc589d35b225d39b30db DIST pam-krb5-4.3.tar.gz 392664 RMD160 da84c425a23aa7f866de236075fd81767cc85d37 SHA1 6008e0988bcb4388d4398f6aed2a1443e53a2bd6 SHA256 485bd5ae7f2b0e7655ee67edf27756cbcb1de3ae7f35fce22909785557f23209 -EBUILD pam_krb5-3.12.ebuild 939 RMD160 c7ebbf9622989090e9b5feef8a4524eb5b32a8d4 SHA1 0c81e827e4e05734713111c57b47bc53cb7ed276 SHA256 12f23f3da34e9cc9f68b9c9bcb92832e39d03e11c78462562b4f68ca5e14e473 EBUILD pam_krb5-4.3.ebuild 891 RMD160 da75fd317a81b0469285df8037d315a0a8a2c5f0 SHA1 437d58f39aa02f63501769c0135271389f8b4259 SHA256 8d92b137ec9d5994c5cf3af575f84c783b649928f3431b8a33d20ecc263e138f -MISC ChangeLog 7194 RMD160 0fefea479f6f2134a57970286d8327c974313eb9 SHA1 24877c88d7744f5f2819f8cb2f80e60bfdddd025 SHA256 a0cbcc653c36e8c7975fa60b730d7732f3a00386a191afacec7ff026a2bfcc47 +MISC ChangeLog 7359 RMD160 0352b13bb1c04578d2a2437dce7a431efd94a1c6 SHA1 4a59b5ae0502d2b3f9207fa094a47d5049e388c6 SHA256 b3b02ef1d2a499eec9ca9ef6ee4ee606f0051851311aef59db7f967b1a9b79cc MISC metadata.xml 451 RMD160 0484c019600155e553c2cfaf86c74dfac631548b SHA1 f3a976f35770f6dc73d4cc28bc096f3ef4b69f2d SHA256 45b71bfd60f3c6bfd08649c7121f31a5f2f927f33d711ded05202cdc70298200 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.16 (GNU/Linux) -iEYEARECAAYFAkyMU2kACgkQcsIHjyDViGRFAgCeP7xABuEvoiPBLQpFnV6GWjhP -Gt0AoIAJJS2qI5LT9SqWl4lMg8tKyRx2 -=UJFD +iEYEARECAAYFAky4bXsACgkQAiZjviIA2XgyrgCgrNYD8ngBlw26ACeSfyqy62mf +5SQAoNkNWLiMxvkpbLcWJ9iAN8YGzrFM +=0Nl8 -----END PGP SIGNATURE----- diff --git a/sys-auth/pam_krb5/files/pam_krb5-3.12-CVE-2009-0361-0362.patch b/sys-auth/pam_krb5/files/pam_krb5-3.12-CVE-2009-0361-0362.patch deleted file mode 100644 index 542679a42b6f..000000000000 --- a/sys-auth/pam_krb5/files/pam_krb5-3.12-CVE-2009-0361-0362.patch +++ /dev/null @@ -1,194 +0,0 @@ -diff --git a/api-auth.c b/api-auth.c -index 55df461..f6af390 100644 ---- a/api-auth.c -+++ b/api-auth.c -@@ -494,6 +494,37 @@ pam_sm_setcred(pam_handle_t *pamh, int flags, int argc, const char **argv) - if (reinit) { - const char *name, *k5name; - -+ /* -+ * Solaris su calls pam_setcred as root with PAM_REINITIALIZE_CREDS, -+ * preserving the user-supplied environment. An xlock program may -+ * also do this if it's setuid root and doesn't drop credentials -+ * before calling pam_setcred. -+ * -+ * There isn't any safe way of reinitializing the exiting ticket cache -+ * for the user if we're setuid without calling setreuid(). Calling -+ * setreuid() is possible, but if the calling application is threaded, -+ * it will change credentials for the whole application, with possibly -+ * bizarre and unintended (and insecure) results. Trying to verify -+ * ownership of the existing ticket cache before using it fails under -+ * various race conditions (for example, having one of the elements of -+ * the path be a symlink and changing the target of that symlink -+ * between our check and the call to krb5_cc_resolve. Without calling -+ * setreuid(), we run the risk of replacing a file owned by another -+ * user with a credential cache. -+ * -+ * We could fail with an error in the setuid case, which would be -+ * maximally safe, but it would prevent use of the module for -+ * authentication with programs such as Solaris su. Failure to -+ * reinitialize the cache is normally not a serious problem, just a -+ * missing feature. We therefore log an error and exit with -+ * PAM_SUCCESS for the setuid case. -+ */ -+ if (pamk5_compat_issetugid()) { -+ pamk5_error(args, "credential reinitialization in a setuid" -+ " context ignored"); -+ pamret = PAM_SUCCESS; -+ goto done; -+ } - name = pamk5_get_krb5ccname(args, "KRB5CCNAME"); - if (name == NULL) - name = krb5_cc_default_name(ctx->context); -diff --git a/compat.c b/compat.c -index e6ad6b0..1bf981d 100644 ---- a/compat.c -+++ b/compat.c -@@ -24,6 +24,7 @@ - # include <security/pam_modutil.h> - #endif - #include <stdlib.h> -+#include <unistd.h> - - #if !defined(HAVE_KRB5_GET_ERROR_MESSAGE) && !defined(HAVE_KRB5_GET_ERR_TEXT) - # if !defined(HAVE_KRB5_GET_ERROR_STRING) -@@ -146,6 +147,39 @@ pamk5_compat_free_error(krb5_context ctx, const char *msg) - - - /* -+ * AIX's NAS Kerberos implementation mysteriously provides the struct and the -+ * krb5_verify_init_creds function but not this function. -+ */ -+#ifndef HAVE_KRB5_VERIFY_INIT_CREDS_OPT_INIT -+void -+krb5_verify_init_creds_opt_init(krb5_verify_init_creds_opt *opt) -+{ -+ opt->flags = 0; -+ opt->ap_req_nofail = 0; -+} -+#endif -+ -+ -+/* -+ * MIT provides a krb5_init_secure_context that ignores all the environment -+ * variables that may otherwise influence context creation. We call that -+ * function if we detect that we're setuid. Heimdal doesn't have this -+ * function, but instead automatically ignores the environment variables if it -+ * detects we're setuid. This means that we should be able to fall back -+ * safely to krb5_init_context if krb5_init_secure_context isn't available. -+ */ -+krb5_error_code -+pamk5_compat_secure_context(krb5_context *ctx) -+{ -+#ifdef HAVE_KRB5_INIT_SECURE_CONTEXT -+ return krb5_init_secure_context(ctx); -+#else -+ return krb5_init_context(ctx); -+#endif -+} -+ -+ -+/* - * Linux PAM provides a thread-safe version of getpwnam that we want to use if - * available. If it's not, fall back on getpwnam. (Ideally, we should check - * for getpwnam_r and use it, but I haven't written that routine.) -@@ -162,14 +196,19 @@ pamk5_compat_getpwnam(struct pam_args *args UNUSED, const char *user) - - - /* -- * AIX's NAS Kerberos implementation mysteriously provides the struct and the -- * krb5_verify_init_creds function but not this function. -+ * Call the Solaris issetugid function if available. If not, check whether -+ * the real and effective UIDs and GIDs match. - */ --#ifndef HAVE_KRB5_VERIFY_INIT_CREDS_OPT_INIT --void --krb5_verify_init_creds_opt_init(krb5_verify_init_creds_opt *opt) -+int -+pamk5_compat_issetugid(void) - { -- opt->flags = 0; -- opt->ap_req_nofail = 0; --} -+#ifdef HAVE_ISSETUGID -+ return issetugid(); -+#else -+ if (getuid() != geteuid()) -+ return 1; -+ if (getgid() != getegid()) -+ return 1; -+ return 0; - #endif -+} -diff --git a/configure.ac b/configure.ac -index 6835a2d..2d04f58 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -21,6 +22,10 @@ AC_PROG_MAKE_SET - AC_CANONICAL_HOST - AC_AIX - -+dnl Check for the Solaris issetugid function, which is nicer than comparing -+dnl real and effective UIDs and GIDs. -+AC_CHECK_FUNCS([issetugid]) -+ - dnl Probe for the functionality of the PAM libraries and their include file - dnl naming. Mac OS X puts them in pam/* instead of security/*. - AC_SEARCH_LIBS([pam_set_data], [pam]) -@@ -46,6 +51,7 @@ AC_CHECK_FUNCS([krb5_appdefault_string \ - krb5_get_init_creds_opt_set_change_password_prompt \ - krb5_get_init_creds_opt_set_default_flags \ - krb5_get_init_creds_opt_set_pa \ -+ krb5_init_secure_context \ - krb5_verify_init_creds_opt_init]) - AC_CHECK_FUNCS([krb5_get_init_creds_opt_set_pkinit], - [RRA_FUNC_KRB5_GET_INIT_CREDS_OPT_SET_PKINIT_ARGS]) -diff --git a/context.c b/context.c -index 9a70aa7..8475d81 100644 ---- a/context.c -+++ b/context.c -@@ -66,7 +66,10 @@ pamk5_context_new(struct pam_args *args) - goto done; - } - ctx->name = strdup(name); -- retval = krb5_init_context(&ctx->context); -+ if (pamk5_compat_issetugid()) -+ retval = pamk5_compat_secure_context(&ctx->context); -+ else -+ retval = krb5_init_context(&ctx->context); - if (retval != 0) { - pamk5_error_krb5(args, "krb5_init_context", retval); - retval = PAM_SERVICE_ERR; -diff --git a/internal.h b/internal.h -index 48c5b74..7356e8a 100644 ---- a/internal.h -+++ b/internal.h -@@ -247,6 +247,12 @@ krb5_error_code pamk5_compat_set_realm(struct pam_args *, const char *) - __attribute__((__visibility__("hidden"))); - void pamk5_compat_free_realm(struct pam_args *) - __attribute__((__visibility__("hidden"))); -+krb5_error_code pamk5_compat_secure_context(krb5_context *) -+ __attribute__((__visibility__("hidden"))); -+ -+/* Calls issetugid if available, otherwise checks effective IDs. */ -+int pamk5_compat_issetugid(void) -+ __attribute__((__visibility__("hidden"))); - - /* Calls pam_modutil_getpwnam if available, otherwise getpwnam. */ - struct passwd *pamk5_compat_getpwnam(struct pam_args *, const char *) -diff --git a/options.c b/options.c -index b03ee0a..e8f9da5 100644 ---- a/options.c -+++ b/options.c -@@ -276,7 +276,10 @@ pamk5_args_parse(pam_handle_t *pamh, int flags, int argc, const char **argv) - * proceed; we'll die soon enough later and this way we'll die after we - * know whether to debug things. - */ -- retval = krb5_init_context(&c); -+ if (pamk5_compat_issetugid()) -+ retval = pamk5_compat_secure_context(&c); -+ else -+ retval = krb5_init_context(&c); - if (retval != 0) - c = NULL; - if (c != NULL) { diff --git a/sys-auth/pam_krb5/pam_krb5-3.12.ebuild b/sys-auth/pam_krb5/pam_krb5-3.12.ebuild deleted file mode 100644 index 823a545dc6f3..000000000000 --- a/sys-auth/pam_krb5/pam_krb5-3.12.ebuild +++ /dev/null @@ -1,39 +0,0 @@ -# Copyright 1999-2009 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 -# $Header: /var/cvsroot/gentoo-x86/sys-auth/pam_krb5/pam_krb5-3.12.ebuild,v 1.4 2009/02/14 16:33:54 armin76 Exp $ - -inherit multilib eutils pam - -DESCRIPTION="Kerberos 5 PAM Authentication Module" -HOMEPAGE="http://www.eyrie.org/~eagle/software/pam-krb5/" -SRC_URI="http://archives.eyrie.org/software/ARCHIVE/pam-krb5/pam-krb5-${PV}.tar.gz" - -LICENSE="|| ( BSD-2 GPL-2 )" -SLOT="0" -KEYWORDS="amd64 ppc sparc x86" -IUSE="doc" - -DEPEND="virtual/krb5" -RDEPEND="${DEPEND}" -S="${WORKDIR}/${P/_/-}" - -src_unpack() { - unpack ${A} - cd "${S}" - epatch "${FILESDIR}/${P}-CVE-2009-0361-0362.patch" -} - -src_compile() { - econf \ - --libdir=/$(get_libdir)\ - || die "econf failed" - emake || die "emake failed" -} - -src_install() { - newpammod pam_krb5.so pam_krb5.so - if use doc; then - doman pam_krb5.5 - dodoc CHANGES CHANGES-old NEWS README TODO - fi; -} |