Login
[x]
Log in using an account from:
Fedora Account System
Red Hat Associate
Red Hat Customer
Or login using a Red Hat Bugzilla account
Forgot Password
Login:
Hide Forgot
Create an Account
Red Hat Bugzilla – Attachment 161324 Details for
Bug 251774
CVE-2007-4129 coolkey file and directory permission flaw
[?]
New
Simple Search
Advanced Search
My Links
Browse
Requests
Reports
Current State
Search
Tabular reports
Graphical reports
Duplicates
Other Reports
User Changes
Plotly Reports
Bug Status
Bug Severity
Non-Defaults
|
Product Dashboard
Help
Page Help!
Bug Writing Guidelines
What's new
Browser Support Policy
5.0.4.rh83 Release notes
FAQ
Guides index
User guide
Web Services
Contact
Legal
This site requires JavaScript to be enabled to function correctly, please enable it.
[patch]
RHEL 5.1 patch. Includes both the patch file and patch to the spec file
patch (text/plain), 6.08 KB, created by
Bob Relyea
on 2007-08-15 02:12:25 UTC
(
hide
)
Description:
RHEL 5.1 patch. Includes both the patch file and patch to the spec file
Filename:
MIME Type:
Creator:
Bob Relyea
Created:
2007-08-15 02:12:25 UTC
Size:
6.08 KB
patch
obsolete
>? patch >Index: coolkey-cache-dir-move.patch >=================================================================== >RCS file: coolkey-cache-dir-move.patch >diff -N coolkey-cache-dir-move.patch >--- /dev/null 1 Jan 1970 00:00:00 -0000 >+++ coolkey-cache-dir-move.patch 15 Aug 2007 02:01:45 -0000 >@@ -0,0 +1,177 @@ >+Index: src/coolkey/machdep.cpp >+=================================================================== >+RCS file: /cvs/dirsec/coolkey/src/coolkey/machdep.cpp,v >+retrieving revision 1.4 >+diff -u -r1.4 machdep.cpp >+--- src/coolkey/machdep.cpp 14 Feb 2007 00:46:28 -0000 1.4 >++++ src/coolkey/machdep.cpp 15 Aug 2007 01:41:11 -0000 >+@@ -185,12 +185,20 @@ >+ #define MAP_INHERIT 0 >+ #endif >+ >++#ifndef BASEPATH >++#ifdef MAC >++#define BASEPATH "/var" >++#else >++#define BASEPATH "/var/cache" >++#endif >++#endif >++ >+ #ifdef FULL_CLEANUP >+ #define RESERVED_OFFSET 256 >+-#define MEMSEGPATH "/tmp/.pk11ipc" >++#define MEMSEGPATH BASEPATH"/coolkey-lock" >+ #else >+ #define RESERVED_OFFSET 0 >+-#define MEMSEGPATH "/tmp/.pk11ipc1" >++#define MEMSEGPATH BASEPATH"/coolkey" >+ #endif >+ >+ struct SHMemData { >+@@ -208,11 +216,6 @@ >+ #ifdef FULL_CLEANUP >+ flock(fd,LOCK_EX); >+ unsigned long ref = --(*(unsigned long *)addr); >+-#ifdef notdef >+- if (ref == 0) { >+- unlink(path); >+- } >+-#endif >+ flock(fd, LOCK_UN); >+ #endif >+ munmap(addr,size+RESERVED_OFFSET); >+@@ -225,6 +228,73 @@ >+ } >+ } >+ >++/* >++ * The cache directory is shared and accessible by anyone, make >++ * sure the cache file we are opening is really a valid cache file. >++ */ >++int safe_open(char *path, int flags, int mode, int size) >++{ >++ struct stat buf; >++ int fd, ret; >++ >++ fd = open (path, flags|O_NOFOLLOW, mode); >++ >++ if (fd < 0) { >++ return fd; >++ } >++ >++ ret = fstat(fd, &buf); >++ if (ret < 0) { >++ close (fd); >++ return ret; >++ } >++ >++ /* our cache files are pretty specific, make sure we are looking >++ * at the correct one */ >++ >++ /* first, we should own the file ourselves, don't open a file >++ * that someone else wanted us to see. */ >++ if (buf.st_uid != getuid()) { >++ close(fd); >++ errno = EACCES; >++ return -1; >++ } >++ >++ /* next, there should only be one link in this file. Don't >++ * use this code to trash another file */ >++ if (buf.st_nlink != 1) { >++ close(fd); >++ errno = EMLINK; >++ return -1; >++ } >++ >++ /* next, This better be a regular file */ >++ if (!S_ISREG(buf.st_mode)) { >++ close(fd); >++ errno = EACCES; >++ return -1; >++ } >++ >++ /* if the permissions don't match, something is wrong */ >++ if ((buf.st_mode & 03777) != mode) { >++ close(fd); >++ errno = EACCES; >++ return -1; >++ } >++ >++ /* finally the file should be the correct size. This >++ * check isn't so much to protect from an attack, as it is to >++ * detect a corrupted cache file */ >++ if (buf.st_size != size) { >++ close(fd); >++ errno = EACCES; >++ return -1; >++ } >++ >++ /* OK, the file checked out, ok to continue */ >++ return fd; >++} >++ >+ SHMem::SHMem(): shmemData(0) {} >+ >+ SHMem * >+@@ -248,7 +318,7 @@ >+ return NULL; >+ } >+ int mask = umask(0); >+- int ret = mkdir (MEMSEGPATH, 0777); >++ int ret = mkdir (MEMSEGPATH, 1777); >+ umask(mask); >+ if ((ret == -1) && (errno != EEXIST)) { >+ delete shmemData; >+@@ -264,21 +334,16 @@ >+ shmemData->path[sizeof(MEMSEGPATH)-1] = '/'; >+ strcpy(&shmemData->path[sizeof(MEMSEGPATH)],name); >+ >+- int mode = 0777; >+- if (strcmp(name,"token_names") != 0) { >+- /* each user gets his own uid array */ >+- sprintf(uid_str, "-%u",getuid()); >+- strcat(shmemData->path,uid_str); >+- mode = 0700; >+- } >++ sprintf(uid_str, "-%u",getuid()); >++ strcat(shmemData->path,uid_str); >++ int mode = 0600; >++ >+ shmemData->fd = open(shmemData->path, >+ O_CREAT|O_RDWR|O_EXCL|O_APPEND|O_EXLOCK, mode); >+- if (shmemData->fd < 0) { >+- needInit = false; >+- shmemData->fd = open(shmemData->path,O_RDWR|O_EXLOCK, mode); >+- } else { >++ if (shmemData->fd >= 0) { >+ char *buf; >+ int len = size+RESERVED_OFFSET; >++ int ret; >+ >+ buf = (char *)calloc(1,len); >+ if (!buf) { >+@@ -289,8 +354,22 @@ >+ delete shmemData; >+ return NULL; >+ } >+- write(shmemData->fd,buf,len); >++ ret = write(shmemData->fd,buf,len); >++ if (ret != len) { >++ unlink(shmemData->path); >++#ifdef FULL_CLEANUP >++ flock(shmemData->fd, LOCK_UN); >++#endif >++ delete shmemData; >++ return NULL; >++ } >++ >+ free(buf); >++ } else if (errno == EEXIST) { >++ needInit = false; >++ >++ shmemData->fd = safe_open(shmemData->path,O_RDWR|O_EXLOCK, mode, >++ size+RESERVED_OFFSET); >+ } >+ if (shmemData->fd < 0) { >+ delete shmemData; >Index: coolkey.spec >=================================================================== >RCS file: /cvs/dist/rpms/coolkey/RHEL-5/coolkey.spec,v >retrieving revision 1.23 >diff -u -r1.23 coolkey.spec >--- coolkey.spec 9 Jul 2007 18:03:59 -0000 1.23 >+++ coolkey.spec 15 Aug 2007 02:01:45 -0000 >@@ -22,11 +22,12 @@ > > Name: coolkey > Version: 1.1.0 >-Release: 3%{dist} >+Release: 4%{dist} > Summary: CoolKey PKCS #11 module > License: LGPL > URL: http://directory.fedora.redhat.com/wiki/CoolKey > Source: coolkey-%{version}.tar.gz >+Patch1: coolkey-cache-dir-move.patch > Group: System Environment/Libraries > BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) > BuildRequires: pcsc-lite-devel >@@ -56,6 +57,7 @@ > > %prep > %setup -q >+%patch1 -b .cache.dir.move > > %build > autoconf >@@ -66,6 +68,7 @@ > rm -rf $RPM_BUILD_ROOT > make install DESTDIR=$RPM_BUILD_ROOT > ln -s pkcs11/libcoolkeypk11.so $RPM_BUILD_ROOT/%{_libdir} >+mkdir -p $RPM_BUILD_ROOT/var/cache/coolkey > > %clean > rm -rf $RPM_BUILD_ROOT >@@ -95,6 +98,7 @@ > %{_libdir}/pkcs11/libcoolkeypk11.so > %{_libdir}/libckyapplet.so.1 > %{_libdir}/libckyapplet.so.1.0.0 >+%attr(1777,root,root) /var/cache/coolkey > > %files devel > %{_libdir}/libckyapplet.so >@@ -103,7 +107,10 @@ > > > %changelog >-* Thu May 31 2007 Bob Relyea <rrelyea@redhat.com> - 1.1.0-2 >+* Tue Aug 13 2007 Bob Relyea <rrelyea@redhat.com> - 1.1.0-4 >+- fix cache location to be more secure >+ >+* Thu May 31 2007 Bob Relyea <rrelyea@redhat.com> - 1.1.0-3 > - replace the install stuff > > * Thu May 31 2007 Bob Relyea <rrelyea@redhat.com> - 1.1.0-2
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
Attachments on
bug 251774
:
161102
| 161324