ppp: Security Advisory - CVE-2015-3310
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3310 Buffer overflow in the rc_mksid function in plugins/radius/util.c in Paul's PPP Package (ppp) 2.4.6 and earlier, when the PID for pppd is greater than 65535, allows remote attackers to cause a denial of service (crash) via a start accounting message to the RADIUS server. oe-core is using ppp 2.4.7, and this CVE say ppp 2.4.7 was not effected, but I found this buggy codes are same between 2.4.6 and 2.4.7, and 2.4.7 should have this issue. (From OE-Core rev: 5b549c6d73e91fdbd0b618a752d618deb1449ef9) Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
parent
0bbd310e0d
commit
2d2d5e6977
|
@ -0,0 +1,29 @@
|
|||
ppp: Buffer overflow in radius plugin
|
||||
|
||||
From: https://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;bug=782450
|
||||
|
||||
Upstream-Status: Backport
|
||||
|
||||
On systems with more than 65535 processes running, pppd aborts when
|
||||
sending a "start" accounting message to the RADIUS server because of a
|
||||
buffer overflow in rc_mksid.
|
||||
|
||||
The process id is used in rc_mksid to generate a pseudo-unique string,
|
||||
assuming that the hex representation of the pid will be at most 4
|
||||
characters (FFFF). __sprintf_chk(), used when compiling with
|
||||
optimization levels greater than 0 and FORTIFY_SOURCE, detects the
|
||||
buffer overflow and makes pppd crash.
|
||||
|
||||
The following patch fixes the problem.
|
||||
|
||||
--- ppp-2.4.6.orig/pppd/plugins/radius/util.c
|
||||
+++ ppp-2.4.6/pppd/plugins/radius/util.c
|
||||
@@ -77,7 +77,7 @@ rc_mksid (void)
|
||||
static unsigned short int cnt = 0;
|
||||
sprintf (buf, "%08lX%04X%02hX",
|
||||
(unsigned long int) time (NULL),
|
||||
- (unsigned int) getpid (),
|
||||
+ (unsigned int) getpid () % 65535,
|
||||
cnt & 0xFF);
|
||||
cnt++;
|
||||
return buf;
|
|
@ -29,6 +29,7 @@ SRC_URI = "http://ppp.samba.org/ftp/ppp/ppp-${PV}.tar.gz \
|
|||
file://provider \
|
||||
file://0001-ppp-Fix-compilation-errors-in-Makefile.patch \
|
||||
file://ppp@.service \
|
||||
file://fix-CVE-2015-3310.patch \
|
||||
"
|
||||
|
||||
SRC_URI[md5sum] = "78818f40e6d33a1d1de68a1551f6595a"
|
||||
|
|
Loading…
Reference in New Issue