Date: Tue, 2 Jun 2015 09:35:24 +0000 (UTC) From: John Marino <marino@FreeBSD.org> To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r388312 - in head/security/wpa_supplicant: . files Message-ID: <201506020935.t529ZOKb097144@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: marino Date: Tue Jun 2 09:35:23 2015 New Revision: 388312 URL: https://svnweb.freebsd.org/changeset/ports/388312 Log: security/wpa_supplicant: Address 3 latest security advisories These are combined upstream patches 2015-2, 2015-3, 2015-4 They address the following security advisories: * CVE-2015-4141 * CVE-2015-4142 * CVE-2015-4143 * CVE-2015-4144 * CVE-2015-4145 * CVE-2015-4146 These advisories also apply to net/hostapd PR: 200568 Submitted by: Jason Unovitch Added: head/security/wpa_supplicant/files/patch-src_ap_wmm.c (contents, props changed) head/security/wpa_supplicant/files/patch-src_eap__peer_eap__pwd.c (contents, props changed) head/security/wpa_supplicant/files/patch-src_eap__server_eap__server__pwd.c (contents, props changed) head/security/wpa_supplicant/files/patch-src_wps_httpread.c (contents, props changed) Modified: head/security/wpa_supplicant/Makefile Modified: head/security/wpa_supplicant/Makefile ============================================================================== --- head/security/wpa_supplicant/Makefile Tue Jun 2 09:23:15 2015 (r388311) +++ head/security/wpa_supplicant/Makefile Tue Jun 2 09:35:23 2015 (r388312) @@ -2,7 +2,7 @@ PORTNAME= wpa_supplicant PORTVERSION= 2.4 -PORTREVISION= 2 +PORTREVISION= 3 CATEGORIES= security net MASTER_SITES= http://w1.fi/releases/ Added: head/security/wpa_supplicant/files/patch-src_ap_wmm.c ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/security/wpa_supplicant/files/patch-src_ap_wmm.c Tue Jun 2 09:35:23 2015 (r388312) @@ -0,0 +1,12 @@ +--- src/ap/wmm.c.orig 2015-03-15 17:30:39 UTC ++++ src/ap/wmm.c +@@ -274,6 +274,9 @@ void hostapd_wmm_action(struct hostapd_d + return; + } + ++ if (left < 0) ++ return; /* not a valid WMM Action frame */ ++ + /* extract the tspec info element */ + if (ieee802_11_parse_elems(pos, left, &elems, 1) == ParseFailed) { + hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211, Added: head/security/wpa_supplicant/files/patch-src_eap__peer_eap__pwd.c ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/security/wpa_supplicant/files/patch-src_eap__peer_eap__pwd.c Tue Jun 2 09:35:23 2015 (r388312) @@ -0,0 +1,77 @@ +--- src/eap_peer/eap_pwd.c.orig 2015-03-15 17:30:39 UTC ++++ src/eap_peer/eap_pwd.c +@@ -301,6 +301,23 @@ eap_pwd_perform_commit_exchange(struct e + BIGNUM *mask = NULL, *x = NULL, *y = NULL, *cofactor = NULL; + u16 offset; + u8 *ptr, *scalar = NULL, *element = NULL; ++ size_t prime_len, order_len; ++ ++ if (data->state != PWD_Commit_Req) { ++ ret->ignore = TRUE; ++ goto fin; ++ } ++ ++ prime_len = BN_num_bytes(data->grp->prime); ++ order_len = BN_num_bytes(data->grp->order); ++ ++ if (payload_len != 2 * prime_len + order_len) { ++ wpa_printf(MSG_INFO, ++ "EAP-pwd: Unexpected Commit payload length %u (expected %u)", ++ (unsigned int) payload_len, ++ (unsigned int) (2 * prime_len + order_len)); ++ goto fin; ++ } + + if (((data->private_value = BN_new()) == NULL) || + ((data->my_element = EC_POINT_new(data->grp->group)) == NULL) || +@@ -500,6 +517,18 @@ eap_pwd_perform_confirm_exchange(struct + u8 conf[SHA256_MAC_LEN], *cruft = NULL, *ptr; + int offset; + ++ if (data->state != PWD_Confirm_Req) { ++ ret->ignore = TRUE; ++ goto fin; ++ } ++ ++ if (payload_len != SHA256_MAC_LEN) { ++ wpa_printf(MSG_INFO, ++ "EAP-pwd: Unexpected Confirm payload length %u (expected %u)", ++ (unsigned int) payload_len, SHA256_MAC_LEN); ++ goto fin; ++ } ++ + /* + * first build up the ciphersuite which is group | random_function | + * prf +@@ -783,11 +812,23 @@ eap_pwd_process(struct eap_sm *sm, void + * if it's the first fragment there'll be a length field + */ + if (EAP_PWD_GET_LENGTH_BIT(lm_exch)) { ++ if (len < 2) { ++ wpa_printf(MSG_DEBUG, ++ "EAP-pwd: Frame too short to contain Total-Length field"); ++ ret->ignore = TRUE; ++ return NULL; ++ } + tot_len = WPA_GET_BE16(pos); + wpa_printf(MSG_DEBUG, "EAP-pwd: Incoming fragments whose " + "total length = %d", tot_len); + if (tot_len > 15000) + return NULL; ++ if (data->inbuf) { ++ wpa_printf(MSG_DEBUG, ++ "EAP-pwd: Unexpected new fragment start when previous fragment is still in use"); ++ ret->ignore = TRUE; ++ return NULL; ++ } + data->inbuf = wpabuf_alloc(tot_len); + if (data->inbuf == NULL) { + wpa_printf(MSG_INFO, "Out of memory to buffer " +@@ -873,6 +914,7 @@ eap_pwd_process(struct eap_sm *sm, void + /* + * we have output! Do we need to fragment it? + */ ++ lm_exch = EAP_PWD_GET_EXCHANGE(lm_exch); + len = wpabuf_len(data->outbuf); + if ((len + EAP_PWD_HDR_SIZE) > data->mtu) { + resp = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_PWD, data->mtu, Added: head/security/wpa_supplicant/files/patch-src_eap__server_eap__server__pwd.c ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/security/wpa_supplicant/files/patch-src_eap__server_eap__server__pwd.c Tue Jun 2 09:35:23 2015 (r388312) @@ -0,0 +1,60 @@ +--- src/eap_server/eap_server_pwd.c.orig 2015-03-15 17:30:39 UTC ++++ src/eap_server/eap_server_pwd.c +@@ -634,9 +634,21 @@ eap_pwd_process_commit_resp(struct eap_s + BIGNUM *x = NULL, *y = NULL, *cofactor = NULL; + EC_POINT *K = NULL, *point = NULL; + int res = 0; ++ size_t prime_len, order_len; + + wpa_printf(MSG_DEBUG, "EAP-pwd: Received commit response"); + ++ prime_len = BN_num_bytes(data->grp->prime); ++ order_len = BN_num_bytes(data->grp->order); ++ ++ if (payload_len != 2 * prime_len + order_len) { ++ wpa_printf(MSG_INFO, ++ "EAP-pwd: Unexpected Commit payload length %u (expected %u)", ++ (unsigned int) payload_len, ++ (unsigned int) (2 * prime_len + order_len)); ++ goto fin; ++ } ++ + if (((data->peer_scalar = BN_new()) == NULL) || + ((data->k = BN_new()) == NULL) || + ((cofactor = BN_new()) == NULL) || +@@ -752,6 +764,13 @@ eap_pwd_process_confirm_resp(struct eap_ + u8 conf[SHA256_MAC_LEN], *cruft = NULL, *ptr; + int offset; + ++ if (payload_len != SHA256_MAC_LEN) { ++ wpa_printf(MSG_INFO, ++ "EAP-pwd: Unexpected Confirm payload length %u (expected %u)", ++ (unsigned int) payload_len, SHA256_MAC_LEN); ++ goto fin; ++ } ++ + /* build up the ciphersuite: group | random_function | prf */ + grp = htons(data->group_num); + ptr = (u8 *) &cs; +@@ -901,11 +920,21 @@ static void eap_pwd_process(struct eap_s + * the first fragment has a total length + */ + if (EAP_PWD_GET_LENGTH_BIT(lm_exch)) { ++ if (len < 2) { ++ wpa_printf(MSG_DEBUG, ++ "EAP-pwd: Frame too short to contain Total-Length field"); ++ return; ++ } + tot_len = WPA_GET_BE16(pos); + wpa_printf(MSG_DEBUG, "EAP-pwd: Incoming fragments, total " + "length = %d", tot_len); + if (tot_len > 15000) + return; ++ if (data->inbuf) { ++ wpa_printf(MSG_DEBUG, ++ "EAP-pwd: Unexpected new fragment start when previous fragment is still in use"); ++ return; ++ } + data->inbuf = wpabuf_alloc(tot_len); + if (data->inbuf == NULL) { + wpa_printf(MSG_INFO, "EAP-pwd: Out of memory to " Added: head/security/wpa_supplicant/files/patch-src_wps_httpread.c ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/security/wpa_supplicant/files/patch-src_wps_httpread.c Tue Jun 2 09:35:23 2015 (r388312) @@ -0,0 +1,16 @@ +--- src/wps/httpread.c.orig 2015-03-15 17:30:39 UTC ++++ src/wps/httpread.c +@@ -533,6 +533,13 @@ static void httpread_read_handler(int sd + if (!isxdigit(*cbp)) + goto bad; + h->chunk_size = strtoul(cbp, NULL, 16); ++ if (h->chunk_size < 0 || ++ h->chunk_size > h->max_bytes) { ++ wpa_printf(MSG_DEBUG, ++ "httpread: Invalid chunk size %d", ++ h->chunk_size); ++ goto bad; ++ } + /* throw away chunk header + * so we have only real data + */
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201506020935.t529ZOKb097144>