Attachment 603051 Details for Bug 738398 – Improved upstream patch

[patch] Improved upstream patch

quagga-0.99.15-CVE-2011-3326.patch (text/plain), 2.28 KB, created by Adam Tkac on 2012-08-08 14:35:37 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Adam Tkac

Created: 2012-08-08 14:35:37 UTC

Size: 2.28 KB

patch

obsolete

>From 6b161fc12a15aba8824c84d1eb38e529aaf70769 Mon Sep 17 00:00:00 2001
>From: CROSS <info@codenomicon.com>
>Date: Mon, 26 Sep 2011 13:17:21 +0400
>Subject: [PATCH] ospfd: CVE-2011-3326 (uknown LSA type segfault)
>
>This vulnerability (CERT-FI #514837) was reported by CROSS project.
>They have also suggested a fix to the problem, which was found
>acceptable.
>
>Quagga ospfd does not seem to handle unknown LSA types in a Link State
>Update message correctly. If LSA type is something else than one
>supported
>by Quagga, the default handling of unknown types leads to an error.
>
>* ospf_flood.c
>  * ospf_flood(): check return value of ospf_lsa_install()
>---
> ospfd/ospf_flood.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
>diff --git a/ospfd/ospf_flood.c b/ospfd/ospf_flood.c
>index 77f2e16..004ed1a 100644
>--- a/ospfd/ospf_flood.c
>+++ b/ospfd/ospf_flood.c
>@@ -319,7 +319,8 @@ ospf_flood (struct ospf *ospf, struct ospf_neighbor *nbr,
>      procedure cannot overwrite the newly installed LSA until
>      MinLSArrival seconds have elapsed. */  
> 
>-  new = ospf_lsa_install (ospf, nbr->oi, new);
>+  if (! (new = ospf_lsa_install (ospf, nbr->oi, new)))
>+    return 0; /* unknown LSA type */
> 
>   /* Acknowledge the receipt of the LSA by sending a Link State
>      Acknowledgment packet back out the receiving interface. */
>-- 
>1.7.11.2
>
>From 70e3ca2ccedca2cae58bd91c968714cad0f9d5d6 Mon Sep 17 00:00:00 2001
>From: Thomas Ries <tries@gmx.net>
>Date: Thu, 27 Oct 2011 17:43:38 +0400
>Subject: [PATCH] ospfd: improve fix to CVE-2011-3326 (BZ#586)
>
>Make ospf_flood() propagate error returned by ospf_lsa_install() further
>to properly discard the malformed LSA, not just prevent the immediate
>crash.
>---
> ospfd/ospf_flood.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/ospfd/ospf_flood.c b/ospfd/ospf_flood.c
>index fc0bbf1..f72087b 100644
>--- a/ospfd/ospf_flood.c
>+++ b/ospfd/ospf_flood.c
>@@ -320,7 +320,7 @@ ospf_flood (struct ospf *ospf, struct ospf_neighbor *nbr,
>      MinLSArrival seconds have elapsed. */  
> 
>   if (! (new = ospf_lsa_install (ospf, nbr->oi, new)))
>-    return 0; /* unknown LSA type */
>+    return -1; /* unknown LSA type or any other error condition */
> 
>   /* Acknowledge the receipt of the LSA by sending a Link State
>      Acknowledgment packet back out the receiving interface. */
>-- 
>1.7.11.2
>

Actions: View | Diff

Attachments on bug 738398: 523213 | 603051