diff options
Diffstat (limited to 'cyrus-sasl')
-rw-r--r-- | cyrus-sasl/fix-CVE-2013-4122.diff | 92 |
1 files changed, 0 insertions, 92 deletions
diff --git a/cyrus-sasl/fix-CVE-2013-4122.diff b/cyrus-sasl/fix-CVE-2013-4122.diff deleted file mode 100644 index 87512964f..000000000 --- a/cyrus-sasl/fix-CVE-2013-4122.diff +++ /dev/null @@ -1,92 +0,0 @@ -diff -r -u cyrus-sasl-2.1.26-orig/pwcheck/pwcheck_getpwnam.c cyrus-sasl-2.1.26/pwcheck/pwcheck_getpwnam.c ---- cyrus-sasl-2.1.26-orig/pwcheck/pwcheck_getpwnam.c 2012-01-28 00:31:36.000000000 +0100 -+++ cyrus-sasl-2.1.26/pwcheck/pwcheck_getpwnam.c 2014-07-16 13:14:09.989720984 +0200 -@@ -32,6 +32,7 @@ - char *password; - { - char* r; -+ char* crpt_passwd; - struct passwd *pwd; - - pwd = getpwnam(userid); -@@ -41,7 +42,7 @@ - else if (pwd->pw_passwd[0] == '*') { - r = "Account disabled"; - } -- else if (strcmp(pwd->pw_passwd, crypt(password, pwd->pw_passwd)) != 0) { -+ else if (!(crpt_passwd = crypt(password, pwd->pw_passwd)) || strcmp(pwd->pw_passwd, (const char *)crpt_passwd) != 0) { - r = "Incorrect password"; - } - else { -diff -r -u cyrus-sasl-2.1.26-orig/pwcheck/pwcheck_getspnam.c cyrus-sasl-2.1.26/pwcheck/pwcheck_getspnam.c ---- cyrus-sasl-2.1.26-orig/pwcheck/pwcheck_getspnam.c 2012-01-28 00:31:36.000000000 +0100 -+++ cyrus-sasl-2.1.26/pwcheck/pwcheck_getspnam.c 2014-07-16 13:22:36.257720924 +0200 -@@ -32,13 +32,14 @@ - char *password; - { - struct spwd *pwd; -+ char *crpt_passwd; - - pwd = getspnam(userid); - if (!pwd) { - return "Userid not found"; - } - -- if (strcmp(pwd->sp_pwdp, crypt(password, pwd->sp_pwdp)) != 0) { -+ if (!(crpt_passwd = crypt(password, pwd->sp_pwdp)) || strcmp(pwd->sp_pwdp, (const char *)crpt_passwd) != 0) { - return "Incorrect password"; - } - else { -diff -r -u cyrus-sasl-2.1.26-orig/saslauthd/auth_getpwent.c cyrus-sasl-2.1.26/saslauthd/auth_getpwent.c ---- cyrus-sasl-2.1.26-orig/saslauthd/auth_getpwent.c 2012-10-12 16:05:48.000000000 +0200 -+++ cyrus-sasl-2.1.26/saslauthd/auth_getpwent.c 2014-07-16 13:16:29.569720968 +0200 -@@ -77,6 +77,7 @@ - { - /* VARIABLES */ - struct passwd *pw; /* pointer to passwd file entry */ -+ char *crpt_passwd; /* encrypted password */ - int errnum; - /* END VARIABLES */ - -@@ -105,7 +106,7 @@ - } - } - -- if (strcmp(pw->pw_passwd, (const char *)crypt(password, pw->pw_passwd))) { -+ if (!(crpt_passwd = crypt(password, pw->pw_passwd)) || strcmp(pw->pw_passwd, (const char *)crpt_passwd)) { - if (flags & VERBOSE) { - syslog(LOG_DEBUG, "DEBUG: auth_getpwent: %s: invalid password", login); - } -diff -r -u cyrus-sasl-2.1.26-orig/saslauthd/auth_shadow.c cyrus-sasl-2.1.26/saslauthd/auth_shadow.c ---- cyrus-sasl-2.1.26-orig/saslauthd/auth_shadow.c 2012-10-12 16:05:48.000000000 +0200 -+++ cyrus-sasl-2.1.26/saslauthd/auth_shadow.c 2014-07-16 13:18:20.208720954 +0200 -@@ -210,8 +210,7 @@ - RETURN("NO Insufficient permission to access NIS authentication database (saslauthd)"); - } - -- cpw = strdup((const char *)crypt(password, sp->sp_pwdp)); -- if (strcmp(sp->sp_pwdp, cpw)) { -+ if (!(cpw = crypt(password, sp->sp_pwdp)) || strcmp(sp->sp_pwdp, (const char *)cpw)) { - if (flags & VERBOSE) { - /* - * This _should_ reveal the SHADOW_PW_LOCKED prefix to an -@@ -221,10 +220,8 @@ - syslog(LOG_DEBUG, "DEBUG: auth_shadow: pw mismatch: '%s' != '%s'", - sp->sp_pwdp, cpw); - } -- free(cpw); - RETURN("NO Incorrect password"); - } -- free(cpw); - - /* - * The following fields will be set to -1 if: -@@ -286,7 +283,7 @@ - RETURN("NO Invalid username"); - } - -- if (strcmp(upw->upw_passwd, crypt(password, upw->upw_passwd)) != 0) { -+ if (!(cpw = crypt(password, upw->upw_passwd)) || (strcmp(upw->upw_passwd, (const char *)cpw) != 0)) { - if (flags & VERBOSE) { - syslog(LOG_DEBUG, "auth_shadow: pw mismatch: %s != %s", - password, upw->upw_passwd); |