diff options
Diffstat (limited to 'main/hostapd')
| -rw-r--r-- | main/hostapd/APKBUILD | 11 | ||||
| -rw-r--r-- | main/hostapd/CVE-2012-4445.patch | 45 |
2 files changed, 55 insertions, 1 deletions
diff --git a/main/hostapd/APKBUILD b/main/hostapd/APKBUILD index 7b25f79919..13739da065 100644 --- a/main/hostapd/APKBUILD +++ b/main/hostapd/APKBUILD @@ -1,7 +1,7 @@ # Maintainer: Natanael Copa <ncopa@alpinelinux.org> pkgname=hostapd pkgver=1.0 -pkgrel=1 +pkgrel=2 pkgdesc="daemon for wireless software access points" url="http://hostap.epitest.fi/hostapd/" arch="all" @@ -10,7 +10,9 @@ depends= makedepends="openssl-dev libnl-dev" install= subpackages="$pkgname-doc" +patches="CVE-2012-4445.patch" source="http://hostap.epitest.fi/releases/$pkgname-$pkgver.tar.gz + $patches $pkgname.initd $pkgname.confd" @@ -20,6 +22,12 @@ _builddir="$srcdir"/$pkgname-$pkgver/hostapd prepare() { local conf="$_builddir/.config" + cd "$_builddir"/.. + for i in $patches; do + msg $i + patch -p1 -i "$srcdir"/$i || return 1 + done + cd "$_builddir" sed -i -e "s:/etc/hostapd:/etc/hostapd/hostapd:g" \ hostapd.conf @@ -110,5 +118,6 @@ package() { } md5sums="236247a7bbd4f60d5fa3e99849d1ffc9 hostapd-1.0.tar.gz +0d01d4641e0c33f79c1f4372613655bf CVE-2012-4445.patch de734b22c3ad1e85309b5634d29c6225 hostapd.initd c91382209042defa04e79d0ae841a29e hostapd.confd" diff --git a/main/hostapd/CVE-2012-4445.patch b/main/hostapd/CVE-2012-4445.patch new file mode 100644 index 0000000000..552307d279 --- /dev/null +++ b/main/hostapd/CVE-2012-4445.patch @@ -0,0 +1,45 @@ +From: Jouni Malinen <j@w1.fi> +Date: Sun, 7 Oct 2012 17:06:29 +0000 (+0300) +Subject: EAP-TLS server: Fix TLS Message Length validation +X-Git-Url: http://w1.fi/gitweb/gitweb.cgi?p=hostap.git;a=commitdiff_plain;h=586c446e0ff42ae00315b014924ec669023bd8de + +EAP-TLS server: Fix TLS Message Length validation + +EAP-TLS/PEAP/TTLS/FAST server implementation did not validate TLS +Message Length value properly and could end up trying to store more +information into the message buffer than the allocated size if the first +fragment is longer than the indicated size. This could result in hostapd +process terminating in wpabuf length validation. Fix this by rejecting +messages that have invalid TLS Message Length value. + +This would affect cases that use the internal EAP authentication server +in hostapd either directly with IEEE 802.1X or when using hostapd as a +RADIUS authentication server and when receiving an incorrectly +constructed EAP-TLS message. Cases where hostapd uses an external +authentication are not affected. + +Thanks to Timo Warns for finding and reporting this issue. + +Signed-hostap: Jouni Malinen <j@w1.fi> +intended-for: hostap-1 +--- + +diff --git a/src/eap_server/eap_server_tls_common.c b/src/eap_server/eap_server_tls_common.c +index 31be2ec..46f282b 100644 +--- a/src/eap_server/eap_server_tls_common.c ++++ b/src/eap_server/eap_server_tls_common.c +@@ -228,6 +228,14 @@ static int eap_server_tls_process_fragment(struct eap_ssl_data *data, + return -1; + } + ++ if (len > message_length) { ++ wpa_printf(MSG_INFO, "SSL: Too much data (%d bytes) in " ++ "first fragment of frame (TLS Message " ++ "Length %d bytes)", ++ (int) len, (int) message_length); ++ return -1; ++ } ++ + data->tls_in = wpabuf_alloc(message_length); + if (data->tls_in == NULL) { + wpa_printf(MSG_DEBUG, "SSL: No memory for message"); |