diff options
| author | Natanael Copa <ncopa@alpinelinux.org> | 2013-04-12 13:12:09 +0000 |
|---|---|---|
| committer | Natanael Copa <ncopa@alpinelinux.org> | 2013-04-12 13:16:06 +0000 |
| commit | d3000ca276c8bfbf8c074afed284de427aae83b9 (patch) | |
| tree | bc94cc090c250c955faa9473ab10860fbb6e5c54 | |
| parent | 062bb700ce703861444fbd608806926be84424e6 (diff) | |
| download | aports-d3000ca276c8bfbf8c074afed284de427aae83b9.tar.bz2 aports-d3000ca276c8bfbf8c074afed284de427aae83b9.tar.xz | |
main/curl: security fix (CVE-2013-1944)
fixes #1779
| -rw-r--r-- | main/curl/APKBUILD | 8 | ||||
| -rw-r--r-- | main/curl/CVE-2013-1944.patch | 57 |
2 files changed, 62 insertions, 3 deletions
diff --git a/main/curl/APKBUILD b/main/curl/APKBUILD index 7c460cddc..f95e35480 100644 --- a/main/curl/APKBUILD +++ b/main/curl/APKBUILD @@ -1,7 +1,7 @@ # Maintainer: Natanael Copa <ncopa@alpinelinux.org> pkgname=curl pkgver=7.25.0 -pkgrel=0 +pkgrel=1 pkgdesc="An URL retrival utility and library" url="http://curl.haxx.se" arch="all" @@ -9,7 +9,8 @@ license="MIT" depends= depends_dev="zlib-dev openssl-dev libssh2-dev" makedepends="$depends_dev" -source="http://curl.haxx.se/download/curl-$pkgver.tar.bz2" +source="http://curl.haxx.se/download/curl-$pkgver.tar.bz2 + CVE-2013-1944.patch" subpackages="$pkgname-doc $pkgname-dev" _builddir="$srcdir/$pkgname-$pkgver" @@ -39,4 +40,5 @@ package() { rm "$pkgdir"/usr/lib/*.la || return 1 } -md5sums="f0303d47d9d3e6e4f08c2863c6504823 curl-7.25.0.tar.bz2" +md5sums="f0303d47d9d3e6e4f08c2863c6504823 curl-7.25.0.tar.bz2 +89747e560198704ab25c21eade95cbd2 CVE-2013-1944.patch" diff --git a/main/curl/CVE-2013-1944.patch b/main/curl/CVE-2013-1944.patch new file mode 100644 index 000000000..18d9c2d39 --- /dev/null +++ b/main/curl/CVE-2013-1944.patch @@ -0,0 +1,57 @@ +From 3604fde3d3c9b0d0e389e079aecf470d123ba180 Mon Sep 17 00:00:00 2001 +From: YAMADA Yasuharu <yasuharu.yamada@access-company.com> +Date: Thu, 11 Apr 2013 00:17:15 +0200 +Subject: [PATCH] cookie: fix tailmatching to prevent cross-domain leakage + +Cookies set for 'example.com' could accidentaly also be sent by libcurl +to the 'bexample.com' (ie with a prefix to the first domain name). + +This is a security vulnerabilty, CVE-2013-1944. + +Bug: http://curl.haxx.se/docs/adv_20130412.html +--- + lib/cookie.c | 24 +++++++++++++++++++----- + 1 file changed, 19 insertions(+), 5 deletions(-) + +diff --git a/lib/cookie.c b/lib/cookie.c +index 4b9ec0b..a67204e 100644 +--- a/lib/cookie.c ++++ b/lib/cookie.c +@@ -118,15 +118,29 @@ static void freecookie(struct Cookie *co) + free(co); + } + +-static bool tailmatch(const char *little, const char *bigone) ++static bool tailmatch(const char *cooke_domain, const char *hostname) + { +- size_t littlelen = strlen(little); +- size_t biglen = strlen(bigone); ++ size_t cookie_domain_len = strlen(cooke_domain); ++ size_t hostname_len = strlen(hostname); + +- if(littlelen > biglen) ++ if(hostname_len < cookie_domain_len) + return FALSE; + +- return Curl_raw_equal(little, bigone+biglen-littlelen) ? TRUE : FALSE; ++ if(!Curl_raw_equal(cooke_domain, hostname+hostname_len-cookie_domain_len)) ++ return FALSE; ++ ++ /* A lead char of cookie_domain is not '.'. ++ RFC6265 4.1.2.3. The Domain Attribute says: ++ For example, if the value of the Domain attribute is ++ "example.com", the user agent will include the cookie in the Cookie ++ header when making HTTP requests to example.com, www.example.com, and ++ www.corp.example.com. ++ */ ++ if(hostname_len == cookie_domain_len) ++ return TRUE; ++ if('.' == *(hostname + hostname_len - cookie_domain_len - 1)) ++ return TRUE; ++ return FALSE; + } + + /* +-- +1.7.10.4 + |