aboutsummaryrefslogtreecommitdiffstats
path: root/main
diff options
context:
space:
mode:
authorNatanael Copa <ncopa@alpinelinux.org>2016-05-30 17:39:08 +0000
committerNatanael Copa <ncopa@alpinelinux.org>2016-05-30 17:39:08 +0000
commit6accf4596e89dcb7b86120055f9bdbf781b15bc0 (patch)
tree4be4c0ed36215b864d1ff7bf79d88ea18d9ef09c /main
parent2806116f403724817d994e53a2ab9cc9dd330867 (diff)
downloadaports-6accf4596e89dcb7b86120055f9bdbf781b15bc0.tar.bz2
aports-6accf4596e89dcb7b86120055f9bdbf781b15bc0.tar.xz
main/hostapd: security fix for CVE-2016-4476
fixes #5645
Diffstat (limited to 'main')
-rw-r--r--main/hostapd/0001-WPS-Reject-a-Credential-with-invalid-passphrase.patch82
-rw-r--r--main/hostapd/APKBUILD6
2 files changed, 87 insertions, 1 deletions
diff --git a/main/hostapd/0001-WPS-Reject-a-Credential-with-invalid-passphrase.patch b/main/hostapd/0001-WPS-Reject-a-Credential-with-invalid-passphrase.patch
new file mode 100644
index 0000000000..acad6be0a4
--- /dev/null
+++ b/main/hostapd/0001-WPS-Reject-a-Credential-with-invalid-passphrase.patch
@@ -0,0 +1,82 @@
+From ecbb0b3dc122b0d290987cf9c84010bbe53e1022 Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <jouni@qca.qualcomm.com>
+Date: Fri, 4 Mar 2016 17:20:18 +0200
+Subject: [PATCH 1/5] WPS: Reject a Credential with invalid passphrase
+
+WPA/WPA2-Personal passphrase is not allowed to include control
+characters. Reject a Credential received from a WPS Registrar both as
+STA (Credential) and AP (AP Settings) if the credential is for WPAPSK or
+WPA2PSK authentication type and includes an invalid passphrase.
+
+This fixes an issue where hostapd or wpa_supplicant could have updated
+the configuration file PSK/passphrase parameter with arbitrary data from
+an external device (Registrar) that may not be fully trusted. Should
+such data include a newline character, the resulting configuration file
+could become invalid and fail to be parsed.
+
+Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
+---
+ src/utils/common.c | 12 ++++++++++++
+ src/utils/common.h | 1 +
+ src/wps/wps_attr_process.c | 10 ++++++++++
+ 3 files changed, 23 insertions(+)
+
+diff --git a/src/utils/common.c b/src/utils/common.c
+index 450e2c6..27b7c02 100644
+--- a/src/utils/common.c
++++ b/src/utils/common.c
+@@ -697,6 +697,18 @@ int is_hex(const u8 *data, size_t len)
+ }
+
+
++int has_ctrl_char(const u8 *data, size_t len)
++{
++ size_t i;
++
++ for (i = 0; i < len; i++) {
++ if (data[i] < 32 || data[i] == 127)
++ return 1;
++ }
++ return 0;
++}
++
++
+ size_t merge_byte_arrays(u8 *res, size_t res_len,
+ const u8 *src1, size_t src1_len,
+ const u8 *src2, size_t src2_len)
+diff --git a/src/utils/common.h b/src/utils/common.h
+index 701dbb2..a972240 100644
+--- a/src/utils/common.h
++++ b/src/utils/common.h
+@@ -488,6 +488,7 @@ const char * wpa_ssid_txt(const u8 *ssid, size_t ssid_len);
+
+ char * wpa_config_parse_string(const char *value, size_t *len);
+ int is_hex(const u8 *data, size_t len);
++int has_ctrl_char(const u8 *data, size_t len);
+ size_t merge_byte_arrays(u8 *res, size_t res_len,
+ const u8 *src1, size_t src1_len,
+ const u8 *src2, size_t src2_len);
+diff --git a/src/wps/wps_attr_process.c b/src/wps/wps_attr_process.c
+index eadb22f..e8c4579 100644
+--- a/src/wps/wps_attr_process.c
++++ b/src/wps/wps_attr_process.c
+@@ -229,6 +229,16 @@ static int wps_workaround_cred_key(struct wps_credential *cred)
+ cred->key_len--;
+ #endif /* CONFIG_WPS_STRICT */
+ }
++
++
++ if (cred->auth_type & (WPS_AUTH_WPAPSK | WPS_AUTH_WPA2PSK) &&
++ (cred->key_len < 8 || has_ctrl_char(cred->key, cred->key_len))) {
++ wpa_printf(MSG_INFO, "WPS: Reject credential with invalid WPA/WPA2-Personal passphrase");
++ wpa_hexdump_ascii_key(MSG_INFO, "WPS: Network Key",
++ cred->key, cred->key_len);
++ return -1;
++ }
++
+ return 0;
+ }
+
+--
+1.9.1
+
diff --git a/main/hostapd/APKBUILD b/main/hostapd/APKBUILD
index 59910c35b5..4bd35e67fe 100644
--- a/main/hostapd/APKBUILD
+++ b/main/hostapd/APKBUILD
@@ -1,7 +1,7 @@
# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
pkgname=hostapd
pkgver=2.5
-pkgrel=2
+pkgrel=3
pkgdesc="daemon for wireless software access points"
url="http://hostap.epitest.fi/hostapd/"
arch="all"
@@ -15,6 +15,7 @@ patches="
CVE-2012-4445.patch
0001-EAP-pwd-peer-Fix-last-fragment-length-validation.patch
0001-EAP-pwd-server-Fix-last-fragment-length-validation.patch
+ 0001-WPS-Reject-a-Credential-with-invalid-passphrase.patch
"
@@ -92,6 +93,7 @@ md5sums="69f9cec3f76d74f402864a43e4f8624f hostapd-2.5.tar.gz
0d01d4641e0c33f79c1f4372613655bf CVE-2012-4445.patch
ae911963ddb5426e4daeb080901f971d 0001-EAP-pwd-peer-Fix-last-fragment-length-validation.patch
0bafbab0d6dbd17172b92e4e52a745a7 0001-EAP-pwd-server-Fix-last-fragment-length-validation.patch
+09372e008bac7534dc807b3740e35fe6 0001-WPS-Reject-a-Credential-with-invalid-passphrase.patch
29b561d4ee34dc22a8a0ae0bf1db5c45 hostapd.initd
c91382209042defa04e79d0ae841a29e hostapd.confd"
sha256sums="8e272d954dc0d7026c264b79b15389ec2b2c555b32970de39f506b9f463ec74a hostapd-2.5.tar.gz
@@ -99,6 +101,7 @@ f296013d432740478f24de7214d07ff897e6e38cbfd01a73a3158014f94fd771 musl-fix-types
06dc7df2159fb0604191f66d35164caa5927963eebe77b5f2c389bd7590e2a49 CVE-2012-4445.patch
1ac039b13d88ff78ade418182cbef6e6c13f4ca9624fd4b3ce623b0442b43769 0001-EAP-pwd-peer-Fix-last-fragment-length-validation.patch
4b6503e7ad4e049cb9566af7c220c451f65e35794962e239e908a1460c38a626 0001-EAP-pwd-server-Fix-last-fragment-length-validation.patch
+560bab824aa2a0bbeb549e2d3df49b23aed1b1dd12ca8685eae16cc24669b077 0001-WPS-Reject-a-Credential-with-invalid-passphrase.patch
cae79127d088c047c1460d5b63eb67da1a830eb725a8c95e50070e516ad02800 hostapd.initd
6c14e88b14bb9a93d2dca69239d829f435e93180e621319aeed0f3987290dfba hostapd.confd"
sha512sums="bbb0547c29f4925aff8639cae3291ed020c2a9d989dd267be831b2418880916d2ec69003e36ecc796c348476086397cca8f63c52633f91c11a9c2ab72e1c83c0 hostapd-2.5.tar.gz
@@ -106,5 +109,6 @@ sha512sums="bbb0547c29f4925aff8639cae3291ed020c2a9d989dd267be831b2418880916d2ec6
619acce84516dead1e03e5da71657ea4c4b6f3ca8271574409773aeb316cbddc88095b50320804f457f001f4f3fe83053e660c008d8409f59bb4d3bfe058b601 CVE-2012-4445.patch
c1a222b75cfbec77a88d83adfb2dbf93c040b5e3541e225aa218de1a8a11ed129946852247252fe993a0a6e8229293312a63b30824cd45ca7e81fb02d2df376f 0001-EAP-pwd-peer-Fix-last-fragment-length-validation.patch
e29a0a3c88041c9a9d11801d311543c6c056b09d39798170e76cadeb407a3209d28f699a25cf58cc3484a60c420b2f5405cac56b1d03f8e7910469cb03971c28 0001-EAP-pwd-server-Fix-last-fragment-length-validation.patch
+e9ae7a6504cd6376f0fb24f79a21bc3996732451b474fe186769e1b098e47fdaedb08167fd90de900eb961e148577f24f24770d94050e60daa3a3f8de36a92c8 0001-WPS-Reject-a-Credential-with-invalid-passphrase.patch
b54b7c6aa17e5cb86a9b354a516eb2dbefb544df18471339c61d82776de447011a2ac290bea1e6c8beae4b6cebefafb8174683ea42fb773e9e8fe6c679f33ba3 hostapd.initd
0882263bbd7c0b05bf51f51d66e11a23a0b8ca7da2a3b8a30166d2c5f044c0c134e6bccb1d02c9e81819ca8fb0c0fb55c7121a08fe7233ccaa73ff8ab9a238fe hostapd.confd"