Date: Sun, 2 Oct 2005 16:47:41 +0200 (CEST) From: Emanuel Haupt <ehaupt@critical.ch> To: FreeBSD-gnats-submit@FreeBSD.org Subject: ports/86833: maintainer-update: ftp/weex - fixing a remote format string bug Message-ID: <200510021447.j92Elfti013499@beaver.critical.ch> Resent-Message-ID: <200510021450.j92EoD4q014360@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 86833 >Category: ports >Synopsis: maintainer-update: ftp/weex - fixing a remote format string bug >Confidential: no >Severity: critical >Priority: high >Responsible: freebsd-ports-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: maintainer-update >Submitter-Id: current-users >Arrival-Date: Sun Oct 02 14:50:13 GMT 2005 >Closed-Date: >Last-Modified: >Originator: Emanuel Haupt >Release: FreeBSD 6.0-BETA5 i386 >Organization: >Environment: System: FreeBSD beaver.critical.ch 6.0-BETA5 FreeBSD 6.0-BETA5 #0: Tue Sep 27 19:38:58 CEST 2005 root@beaver.critical.ch:/usr/obj/usr/src/RELENG_6/src/sys/BEAVER i386 >Description: ftp/weex suffers from a remote format string security bug. Someone who controls an FTP server that weex will log in to can set up malicious data in the account that weex will use, and that will cause a format string bug that will allow remote code execution. It will only happen when weex is first run or when its cache files are rebuilt with the -r option, though. This behaviour is verified in versions 2.6.1 and 2.6.1.5 >How-To-Repeat: >Fix: See: http://critical.ch/weex.log --- weex.patch begins here --- Index: Makefile =================================================================== RCS file: /home/ncvs/ports/ftp/weex/Makefile,v retrieving revision 1.2 diff -u -r1.2 Makefile --- Makefile 13 Sep 2005 18:18:40 -0000 1.2 +++ Makefile 2 Oct 2005 09:15:03 -0000 @@ -7,6 +7,7 @@ PORTNAME= weex PORTVERSION= 2.6.1.5 +PORTREVISION= 1 CATEGORIES= ftp MASTER_SITES= ${MASTER_SITE_SOURCEFORGE_EXTENDED} MASTER_SITE_SUBDIR= ${PORTNAME} Index: pkg-descr =================================================================== RCS file: /home/ncvs/ports/ftp/weex/pkg-descr,v retrieving revision 1.1 diff -u -r1.1 pkg-descr --- pkg-descr 8 Sep 2005 11:13:30 -0000 1.1 +++ pkg-descr 2 Oct 2005 09:15:03 -0000 @@ -9,6 +9,3 @@ * caching to speed up the synchronization process WWW: http://weex.sourceforge.net/ - -- ehaupt -ehaupt@critical.ch Index: files/patch-src-log.c =================================================================== RCS file: files/patch-src-log.c diff -N files/patch-src-log.c --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ files/patch-src-log.c 2 Oct 2005 09:15:03 -0000 @@ -0,0 +1,11 @@ +--- src/log.c.orig Mon Aug 18 11:52:38 2003 ++++ src/log.c Sun Oct 2 11:06:58 2005 +@@ -183,7 +183,7 @@ + + fp=log_open(); + for(i=0;i<max_log;i++){ +- fprintf(fp,log_str[i]); ++ fprintf(fp,"%s",log_str[i]); + free(log_str[i]); + } + free(log_str); --- weex.patch ends here --- >Release-Note: >Audit-Trail: >Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200510021447.j92Elfti013499>