[kernel] r6607 - in dists/sarge-security/kernel-2.4/source/kernel-source-2.4.27-2.4.27/debian: patches patches/series

[Dann Frazier]

Author: dannf
Date: Fri May 19 22:19:54 2006
New Revision: 6607

Added:
   dists/sarge-security/kernel-2.4/source/kernel-source-2.4.27-2.4.27/debian/patches/210_ipv4-id-no-increment.diff
Modified:
   dists/sarge-security/kernel-2.4/source/kernel-source-2.4.27-2.4.27/debian/changelog
   dists/sarge-security/kernel-2.4/source/kernel-source-2.4.27-2.4.27/debian/patches/series/2.4.27-10sarge3

Log:
* 210_ipv4-id-no-increment.diff
  [SECURITY] Fix vulnerability that allows remote attackers to conduct an
  Idle Scan attack, bypassing intended protections against such attacks
  See CVE-2006-1242

Modified: dists/sarge-security/kernel-2.4/source/kernel-source-2.4.27-2.4.27/debian/changelog
==============================================================================
--- dists/sarge-security/kernel-2.4/source/kernel-source-2.4.27-2.4.27/debian/changelog	(original)
+++ dists/sarge-security/kernel-2.4/source/kernel-source-2.4.27-2.4.27/debian/changelog	Fri May 19 22:19:54 2006
@@ -12,8 +12,12 @@
     [SECURITY] Fix remote DoS in SCTP code by discarding unexpected chunks
     received in CLOSED state instead of calling BUG()
     See CVE-2006-2271
+  * 210_ipv4-id-no-increment.diff
+    [SECURITY] Fix vulnerability that allows remote attackers to conduct an
+    Idle Scan attack, bypassing intended protections against such attacks
+    See CVE-2006-1242
 
- -- dann frazier <dannf at debian.org>  Thu, 18 May 2006 18:19:54 -0500
+ -- dann frazier <dannf at debian.org>  Fri, 19 May 2006 17:17:39 -0500
 
 kernel-source-2.4.27 (2.4.27-10sarge2) stable-security; urgency=high
 

Added: dists/sarge-security/kernel-2.4/source/kernel-source-2.4.27-2.4.27/debian/patches/210_ipv4-id-no-increment.diff
==============================================================================
--- (empty file)
+++ dists/sarge-security/kernel-2.4/source/kernel-source-2.4.27-2.4.27/debian/patches/210_ipv4-id-no-increment.diff	Fri May 19 22:19:54 2006
@@ -0,0 +1,50 @@
+Fix for CVE-2006-1242, applies to Sarge 2.4.27.
+
+Signed-off-by: Troy Heber <troyh at debian.org>
+
+diff-tree 6f78133bf7a06845afee5bcdff7c276bbceaaf55 (from 65851bbf2ab375b4c00f4571dfb5c1003625c12f)
+Author: Alexey Kuznetsov <kuznet at ms2.inr.ac.ru>
+Date:   Wed Mar 22 14:34:42 2006 -0800
+
+    [PATCH] TCP: Do not use inet->id of global tcp_socket when sending RST (CVE-2006-1242)
+    
+    The problem is in ip_push_pending_frames(), which uses:
+    
+            if (!df) {
+                    __ip_select_ident(iph, &rt->u.dst, 0);
+            } else {
+                    iph->id = htons(inet->id++);
+            }
+    
+    instead of ip_select_ident().
+    
+    Right now I think the code is a nonsense. Most likely, I copied it from
+    old ip_build_xmit(), where it was really special, we had to decide
+    whether to generate unique ID when generating the first (well, the last)
+    fragment.
+    
+    In ip_push_pending_frames() it does not make sense, it should use plain
+    ip_select_ident() instead.
+    
+    Signed-off-by: Alexey Kuznetsov <kuznet at ms2.inr.ac.ru>
+    Signed-off-by: David S. Miller <davem at davemloft.net>
+    Signed-off-by: Chris Wright <chrisw at sous-sol.org>
+    Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+
+
+diff -urN kernel-source-2.4.27.orig/net/ipv4/ip_output.c 2.4/net/ipv4/ip_output.c
+--- kernel-source-2.4.27.orig/net/ipv4/ip_output.c	2005-08-17 02:30:02.000000000 -0600
++++ 2.4/net/ipv4/ip_output.c	2006-05-18 11:27:20.000000000 -0600
+@@ -1151,11 +1151,7 @@
+ 	iph->tos = inet->tos;
+ 	iph->tot_len = htons(skb->len);
+ 	iph->frag_off = df;
+-	if (!df) {
+-		__ip_select_ident(iph, &rt->u.dst);
+-	} else {
+-		iph->id = htons(inet->id++);
+-	}
++	ip_select_ident(iph, &rt->u.dst, sk);
+ 	iph->ttl = ttl;
+ 	iph->protocol = sk->protocol;
+ 	iph->saddr = rt->rt_src;

Modified: dists/sarge-security/kernel-2.4/source/kernel-source-2.4.27-2.4.27/debian/patches/series/2.4.27-10sarge3
==============================================================================
--- dists/sarge-security/kernel-2.4/source/kernel-source-2.4.27-2.4.27/debian/patches/series/2.4.27-10sarge3	(original)
+++ dists/sarge-security/kernel-2.4/source/kernel-source-2.4.27-2.4.27/debian/patches/series/2.4.27-10sarge3	Fri May 19 22:19:54 2006
@@ -1,3 +1,4 @@
 + 207_smbfs-chroot-escape.diff
 + 208_ia64-die_if_kernel-returns.diff
 + 209_sctp-discard-unexpected-in-closed.diff
++ 210_ipv4-id-no-increment.diff