Date: Tue, 09 Aug 2005 11:50:16 +0400 From: Andrej Zverev <az@inec.ru> To: FreeBSD-gnats-submit@FreeBSD.org Subject: ports/84691: [update] net/gaim - security CAN-2005-2370 Message-ID: <E1E2OsK-000NAd-V0@az.inec.ru> Resent-Message-ID: <200508090800.j7980efC064836@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 84691
>Category: ports
>Synopsis: [update] net/gaim - security CAN-2005-2370
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: freebsd-ports-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Tue Aug 09 08:00:40 GMT 2005
>Closed-Date:
>Last-Modified:
>Originator: Andrej Zverev
>Release: FreeBSD 5.4-RELEASE-p1 i386
>Organization:
>Environment:
System: FreeBSD az.inec.ru 5.4-RELEASE-p1 FreeBSD 5.4-RELEASE-p1 #2: Wed Jul 6 12:10:32 MSD 2005 root@az.inec.ru:/usr/obj/usr/src/sys/GENERIC i386
>Description:
See CAN-2005-2370
Patch from debain project
>How-To-Repeat:
>Fix:
--- gaim.diff begins here ---
diff -Nru gaim.orig/Makefile gaim/Makefile
--- gaim.orig/Makefile Sat Jul 9 21:35:43 2005
+++ gaim/Makefile Thu Aug 4 11:09:22 2005
@@ -7,6 +7,7 @@
PORTNAME= gaim
PORTVERSION= 1.4.0
+PORTREVISION= 1
CATEGORIES?= net
MASTER_SITES= ${MASTER_SITE_SOURCEFORGE}
MASTER_SITE_SUBDIR= ${PORTNAME}
diff -Nru gaim.orig/files/patch-src_protocols_gg_libgg.c gaim/files/patch-src_protocols_gg_libgg.c
--- gaim.orig/files/patch-src_protocols_gg_libgg.c Thu Jan 1 03:00:00 1970
+++ gaim/files/patch-src_protocols_gg_libgg.c Thu Aug 4 10:58:29 2005
@@ -0,0 +1,16 @@
+# see CAN-2005-2370
+--- src/protocols/gg/libgg.c.orig Wed Mar 2 14:53:57 2005
++++ src/protocols/gg/libgg.c Thu Aug 4 10:49:06 2005
+@@ -1099,7 +1099,11 @@
+ e->event.status60.descr = buf;
+
+ if (len > 4 && p[h->length - 5] == 0)
+- e->event.status60.time = *((int*) (p + h->length - 4));
++ {
++ uint32_t t;
++ memcpy(&t, p + h->length - 4, sizeof(uint32_t));
++ e->event.status60.time = t;
++ }
+ }
+
+ break;
--- gaim.diff ends here ---
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?E1E2OsK-000NAd-V0>