Skip site navigation (1)Skip section navigation (2)
Date:      Tue, 4 Nov 2014 23:32:46 +0000 (UTC)
From:      Dag-Erling Smørgrav <des@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-releng@freebsd.org
Subject:   svn commit: r274112 - in releng/9.1: . contrib/tnftp/src secure/usr.sbin/sshd sys/cddl/contrib/opensolaris/uts/common/fs/zfs sys/conf sys/kern
Message-ID:  <201411042332.sA4NWkBD078862@svn.freebsd.org>

next in thread | raw e-mail | index | archive | help
Author: des
Date: Tue Nov  4 23:32:45 2014
New Revision: 274112
URL: https://svnweb.freebsd.org/changeset/base/274112

Log:
  [SA-14:24] Fix denial of service attack against sshd(8).
  [SA-14:25] Fix kernel stack disclosure in setlogin(2) / getlogin(2).
  [SA-14:26] Fix remote command execution in ftp(1).
  [EN-14:12] Fix NFSv4 and ZFS cache consistency issue.
  
  Approved by:	so (des)

Modified:
  releng/9.1/UPDATING
  releng/9.1/contrib/tnftp/src/fetch.c
  releng/9.1/secure/usr.sbin/sshd/Makefile
  releng/9.1/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_vnops.c
  releng/9.1/sys/conf/newvers.sh
  releng/9.1/sys/kern/kern_prot.c

Modified: releng/9.1/UPDATING
==============================================================================
--- releng/9.1/UPDATING	Tue Nov  4 23:32:15 2014	(r274111)
+++ releng/9.1/UPDATING	Tue Nov  4 23:32:45 2014	(r274112)
@@ -9,6 +9,20 @@ handbook.
 Items affecting the ports and packages system can be found in
 /usr/ports/UPDATING.  Please read that file before running portupgrade.
 
+20141104:	p22	FreeBSD-SA-14:24.sshd
+			FreeBSD-SA-14:25.setlogin
+			FreeBSD-SA-14:26.ftp
+			FreeBSD-EN-14:12.zfs
+
+	Fix denial of service attack against sshd(8). [SA-14:24]
+
+	Fix kernel stack disclosure in setlogin(2) / getlogin(2).
+	[SA-14:25]
+
+	Fix remote command execution in ftp(1). [SA-14:26]
+
+	Fix NFSv4 and ZFS cache consistency issue. [EN-14:12]
+
 20141022:	p21	FreeBSD-EN-14:10.tzdata
 
 	Time zone data file update. [EN-14:10]

Modified: releng/9.1/contrib/tnftp/src/fetch.c
==============================================================================
--- releng/9.1/contrib/tnftp/src/fetch.c	Tue Nov  4 23:32:15 2014	(r274111)
+++ releng/9.1/contrib/tnftp/src/fetch.c	Tue Nov  4 23:32:45 2014	(r274112)
@@ -547,7 +547,7 @@ fetch_url(const char *url, const char *p
 	url_decode(decodedpath);
 
 	if (outfile)
-		savefile = ftp_strdup(outfile);
+		savefile = outfile;
 	else {
 		cp = strrchr(decodedpath, '/');		/* find savefile */
 		if (cp != NULL)
@@ -571,8 +571,7 @@ fetch_url(const char *url, const char *p
 	rangestart = rangeend = entitylen = -1;
 	mtime = -1;
 	if (restartautofetch) {
-		if (strcmp(savefile, "-") != 0 && *savefile != '|' &&
-		    stat(savefile, &sb) == 0)
+		if (stat(savefile, &sb) == 0)
 			restart_point = sb.st_size;
 	}
 	if (urltype == FILE_URL_T) {		/* file:// URLs */
@@ -1098,17 +1097,25 @@ fetch_url(const char *url, const char *p
 	}		/* end of ftp:// or http:// specific setup */
 
 			/* Open the output file. */
-	if (strcmp(savefile, "-") == 0) {
-		fout = stdout;
-	} else if (*savefile == '|') {
-		oldintp = xsignal(SIGPIPE, SIG_IGN);
-		fout = popen(savefile + 1, "w");
-		if (fout == NULL) {
-			warn("Can't execute `%s'", savefile + 1);
-			goto cleanup_fetch_url;
+
+	/*
+	 * Only trust filenames with special meaning if they came from
+	 * the command line
+	 */
+	if (outfile == savefile) {
+		if (strcmp(savefile, "-") == 0) {
+			fout = stdout;
+		} else if (*savefile == '|') {
+			oldintp = xsignal(SIGPIPE, SIG_IGN);
+			fout = popen(savefile + 1, "w");
+			if (fout == NULL) {
+				warn("Can't execute `%s'", savefile + 1);
+				goto cleanup_fetch_url;
+			}
+			closefunc = pclose;
 		}
-		closefunc = pclose;
-	} else {
+	}
+	if (fout == NULL) {
 		if ((rangeend != -1 && rangeend <= restart_point) ||
 		    (rangestart == -1 && filesize != -1 && filesize <= restart_point)) {
 			/* already done */
@@ -1318,7 +1325,8 @@ fetch_url(const char *url, const char *p
 		(*closefunc)(fout);
 	if (res0)
 		freeaddrinfo(res0);
-	FREEPTR(savefile);
+	if (savefile != outfile)
+		FREEPTR(savefile);
 	FREEPTR(uuser);
 	if (pass != NULL)
 		memset(pass, 0, strlen(pass));

Modified: releng/9.1/secure/usr.sbin/sshd/Makefile
==============================================================================
--- releng/9.1/secure/usr.sbin/sshd/Makefile	Tue Nov  4 23:32:15 2014	(r274111)
+++ releng/9.1/secure/usr.sbin/sshd/Makefile	Tue Nov  4 23:32:45 2014	(r274112)
@@ -42,6 +42,16 @@ LDADD+=	 -lgssapi_krb5 -lgssapi -lkrb5 -
 DPADD+=	${LIBCRYPTO} ${LIBCRYPT}
 LDADD+=	-lcrypto -lcrypt
 
+# Fix the order of NEEDED entries for libthr and libc. The libthr
+# needs to interpose libc symbols, leaving the libthr loading as
+# dependency of krb causes reversed order and broken interposing. Put
+# the threading library last on the linker command line, just before
+# the -lc added by a compiler driver.
+.if ${MK_KERBEROS_SUPPORT} != "no"
+DPADD+= ${LIBPTHREAD}
+LDADD+= -lpthread
+.endif
+
 .if defined(LOCALBASE)
 CFLAGS+= -DXAUTH_PATH=\"${LOCALBASE}/bin/xauth\"
 .endif

Modified: releng/9.1/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_vnops.c
==============================================================================
--- releng/9.1/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_vnops.c	Tue Nov  4 23:32:15 2014	(r274111)
+++ releng/9.1/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_vnops.c	Tue Nov  4 23:32:45 2014	(r274112)
@@ -2721,6 +2721,7 @@ zfs_getattr(vnode_t *vp, vattr_t *vap, i
 #endif
 	vap->va_seq = zp->z_seq;
 	vap->va_flags = 0;	/* FreeBSD: Reset chflags(2) flags. */
+	vap->va_filerev = zp->z_seq;
 
 	/*
 	 * Add in any requested optional attributes and the create time.

Modified: releng/9.1/sys/conf/newvers.sh
==============================================================================
--- releng/9.1/sys/conf/newvers.sh	Tue Nov  4 23:32:15 2014	(r274111)
+++ releng/9.1/sys/conf/newvers.sh	Tue Nov  4 23:32:45 2014	(r274112)
@@ -32,7 +32,7 @@
 
 TYPE="FreeBSD"
 REVISION="9.1"
-BRANCH="RELEASE-p21"
+BRANCH="RELEASE-p22"
 if [ "X${BRANCH_OVERRIDE}" != "X" ]; then
 	BRANCH=${BRANCH_OVERRIDE}
 fi

Modified: releng/9.1/sys/kern/kern_prot.c
==============================================================================
--- releng/9.1/sys/kern/kern_prot.c	Tue Nov  4 23:32:15 2014	(r274111)
+++ releng/9.1/sys/kern/kern_prot.c	Tue Nov  4 23:32:45 2014	(r274112)
@@ -2073,19 +2073,20 @@ struct getlogin_args {
 int
 sys_getlogin(struct thread *td, struct getlogin_args *uap)
 {
-	int error;
 	char login[MAXLOGNAME];
 	struct proc *p = td->td_proc;
+	size_t len;
 
 	if (uap->namelen > MAXLOGNAME)
 		uap->namelen = MAXLOGNAME;
 	PROC_LOCK(p);
 	SESS_LOCK(p->p_session);
-	bcopy(p->p_session->s_login, login, uap->namelen);
+	len = strlcpy(login, p->p_session->s_login, uap->namelen) + 1;
 	SESS_UNLOCK(p->p_session);
 	PROC_UNLOCK(p);
-	error = copyout(login, uap->namebuf, uap->namelen);
-	return(error);
+	if (len > uap->namelen)
+		return (ERANGE);
+	return (copyout(login, uap->namebuf, len));
 }
 
 /*
@@ -2104,21 +2105,23 @@ sys_setlogin(struct thread *td, struct s
 	int error;
 	char logintmp[MAXLOGNAME];
 
+	CTASSERT(sizeof(p->p_session->s_login) >= sizeof(logintmp));
+
 	error = priv_check(td, PRIV_PROC_SETLOGIN);
 	if (error)
 		return (error);
 	error = copyinstr(uap->namebuf, logintmp, sizeof(logintmp), NULL);
-	if (error == ENAMETOOLONG)
-		error = EINVAL;
-	else if (!error) {
-		PROC_LOCK(p);
-		SESS_LOCK(p->p_session);
-		(void) memcpy(p->p_session->s_login, logintmp,
-		    sizeof(logintmp));
-		SESS_UNLOCK(p->p_session);
-		PROC_UNLOCK(p);
+	if (error != 0) {
+		if (error == ENAMETOOLONG)
+			error = EINVAL;
+		return (error);
 	}
-	return (error);
+	PROC_LOCK(p);
+	SESS_LOCK(p->p_session);
+	strcpy(p->p_session->s_login, logintmp);
+	SESS_UNLOCK(p->p_session);
+	PROC_UNLOCK(p);
+	return (0);
 }
 
 void



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201411042332.sA4NWkBD078862>