[libmodule-signature-perl] 01/04: Add CVE-2015-3406_CVE-2015-3407_CVE-2015-3408.patch patch

Salvatore Bonaccorso carnil at debian.org
Thu May 14 16:40:45 UTC 2015


This is an automated email from the git hooks/post-receive script.

carnil pushed a commit to branch wheezy
in repository libmodule-signature-perl.

commit dc93dceee5bbfde31a21341478139472c4fb4e98
Author: Salvatore Bonaccorso <carnil at debian.org>
Date:   Tue May 12 22:10:02 2015 +0200

    Add CVE-2015-3406_CVE-2015-3407_CVE-2015-3408.patch patch
    
    CVE-2015-3406: Module::Signature parses the unsigned portion of the
    SIGNATURE file as the signed portion due to incorrect handling of PGP
    signature boundaries.
    
    CVE-2015-3407: Module::Signature incorrectly handles files that are not
    listed in the SIGNATURE file. This includes some files in the t/
    directory that would execute when tests are run.
    
    CVE-2015-3408: Module::Signature uses two argument open() calls to read
    the files when generating checksums from the signed manifest, allowing
    to embed arbitrary shell commands into the SIGNATURE file that would
    execute during the signature verification process.
    
    Closes: #783451
---
 ...CVE-2015-3406_CVE-2015-3407_CVE-2015-3408.patch | 174 +++++++++++++++++++++
 debian/patches/series                              |   1 +
 2 files changed, 175 insertions(+)

diff --git a/debian/patches/CVE-2015-3406_CVE-2015-3407_CVE-2015-3408.patch b/debian/patches/CVE-2015-3406_CVE-2015-3407_CVE-2015-3408.patch
new file mode 100644
index 0000000..80f996f
--- /dev/null
+++ b/debian/patches/CVE-2015-3406_CVE-2015-3407_CVE-2015-3408.patch
@@ -0,0 +1,174 @@
+Description: Fix CVE-2015-3406, CVE-2015-3407 and CVE-2015-3408
+ CVE-2015-3406: Module::Signature parses the unsigned portion of the
+ SIGNATURE file as the signed portion due to incorrect handling of PGP
+ signature boundaries.
+ .
+ CVE-2015-3407: Module::Signature incorrectly handles files that are not
+ listed in the SIGNATURE file. This includes some files in the t/
+ directory that would execute when tests are run.
+ .
+ CVE-2015-3408: Module::Signature uses two argument open() calls to read
+ the files when generating checksums from the signed manifest, allowing
+ to embed arbitrary shell commands into the SIGNATURE file that would
+ execute during the signature verification process.
+Origin: upstream, https://github.com/audreyt/module-signature/commit/8a9164596fa5952d4fbcde5aa1c7d1c7bc85372f
+Bug-Debian: https://bugs.debian.org/783451
+Forwarded: not-needed
+Author: Audrey Tang <audreyt at audreyt.org>
+Reviewed-by: Salvatore Bonaccorso <carnil at debian.org>
+Last-Update: 2015-05-12
+Applied-Upstream: 0.75
+
+--- a/Makefile.PL
++++ b/Makefile.PL
+@@ -9,6 +9,7 @@ readme_from     'lib/Module/Signature.pm
+ repository      'http://github.com/audreyt/module-signature';
+ install_script  'script/cpansign';
+ build_requires  'Test::More', 0, 'IPC::Run', 0;
++requires        'File::Temp';
+ 
+ # On Win32 (excluding cygwin) we know that IO::Socket::INET,
+ # which is needed for keyserver stuff, doesn't work. In fact
+--- a/lib/Module/Signature.pm
++++ b/lib/Module/Signature.pm
+@@ -57,6 +57,8 @@ sub _cipher_map {
+     my @lines = split /\015?\012/, $sigtext;
+     my %map;
+     for my $line (@lines) {
++        last if $line eq '-----BEGIN PGP SIGNATURE-----';
++        next if $line =~ /^---/ .. $line eq '';
+         my($cipher,$digest,$file) = split " ", $line, 3;
+         return unless defined $file;
+         $map{$file} = [$cipher, $digest];
+@@ -65,7 +67,7 @@ sub _cipher_map {
+ }
+ 
+ sub verify {
+-    my %args = ( skip => 1, @_ );
++    my %args = ( @_ );
+     my $rv;
+ 
+     (-r $SIGNATURE) or do {
+@@ -177,6 +179,11 @@ sub _fullcheck {
+         ($mani, $file) = ExtUtils::Manifest::fullcheck();
+     }
+     else {
++        my $_maniskip = &ExtUtils::Manifest::maniskip;
++        local *ExtUtils::Manifest::maniskip = sub { sub {
++            return unless $skip;
++            return $_maniskip->(@_);
++        } };
+         ($mani, $file) = ExtUtils::Manifest::fullcheck();
+     }
+ 
+@@ -222,6 +229,11 @@ sub _verify_gpg {
+ 
+     my $keyserver = _keyserver($version);
+ 
++    require File::Temp;
++    my $fh = File::Temp->new();
++    print $fh $sigtext;
++    close $fh;
++
+     my @quiet = $Verbose ? () : qw(-q --logger-fd=1);
+     my @cmd = (
+         qw(gpg --verify --batch --no-tty), @quiet, ($KeyServer ? (
+@@ -229,7 +241,7 @@ sub _verify_gpg {
+             ($AutoKeyRetrieve and $version ge '1.0.7')
+                 ? '--keyserver-options=auto-key-retrieve'
+                 : ()
+-        ) : ()), $SIGNATURE
++        ) : ()), $fh->filename
+     );
+ 
+     my $output = '';
+@@ -241,6 +253,7 @@ sub _verify_gpg {
+         my $cmd = join ' ', @cmd;
+         $output = `$cmd`;
+     }
++    unlink $fh->filename;
+ 
+     if( $? ) {
+         print STDERR $output;
+@@ -269,7 +282,7 @@ sub _verify_crypt_openpgp {
+     my $pgp = Crypt::OpenPGP->new(
+         ($KeyServer) ? ( KeyServer => $KeyServer, AutoKeyRetrieve => $AutoKeyRetrieve ) : (),
+     );
+-    my $rv = $pgp->handle( Filename => $SIGNATURE )
++    my $rv = $pgp->handle( Data => $sigtext )
+         or die $pgp->errstr;
+ 
+     return SIGNATURE_BAD if (!$rv->{Validity} and $AutoKeyRetrieve);
+@@ -292,32 +305,35 @@ sub _read_sigfile {
+     my $well_formed;
+ 
+     local *D;
+-    open D, $sigfile or die "Could not open $sigfile: $!";
++    open D, "< $sigfile" or die "Could not open $sigfile: $!";
+ 
+     if ($] >= 5.006 and <D> =~ /\r/) {
+         close D;
+-        open D, $sigfile or die "Could not open $sigfile: $!";
++        open D, '<', $sigfile or die "Could not open $sigfile: $!";
+         binmode D, ':crlf';
+     } else {
+         close D;
+-        open D, $sigfile or die "Could not open $sigfile: $!";
++        open D, "< $sigfile" or die "Could not open $sigfile: $!";
+     }
+ 
++    my $begin = "-----BEGIN PGP SIGNED MESSAGE-----\n";
++    my $end = "-----END PGP SIGNATURE-----\n";
+     while (<D>) {
+-        next if (1 .. /^-----BEGIN PGP SIGNED MESSAGE-----/);
+-        last if /^-----BEGIN PGP SIGNATURE/;
+-
++        next if (1 .. ($_ eq $begin));
+         $signature .= $_;
++        return "$begin$signature" if $_ eq $end;
+     }
+ 
+-    return ((split(/\n+/, $signature, 2))[1]);
++    return;
+ }
+ 
+ sub _compare {
+     my ($str1, $str2, $ok) = @_;
+ 
+     # normalize all linebreaks
++    $str1 =~ s/^-----BEGIN PGP SIGNED MESSAGE-----\n(?:.+\n)*\n//;
+     $str1 =~ s/[^\S ]+/\n/g; $str2 =~ s/[^\S ]+/\n/g;
++    $str1 =~ s/-----BEGIN PGP SIGNATURE-----\n(?:.+\n)*$//;
+ 
+     return $ok if $str1 eq $str2;
+ 
+@@ -328,7 +344,7 @@ sub _compare {
+     }
+     else {
+         local (*D, *S);
+-        open S, $SIGNATURE or die "Could not open $SIGNATURE: $!";
++        open S, "< $SIGNATURE" or die "Could not open $SIGNATURE: $!";
+         open D, "| diff -u $SIGNATURE -" or (warn "Could not call diff: $!", return SIGNATURE_MISMATCH);
+         while (<S>) {
+             print D $_ if (1 .. /^-----BEGIN PGP SIGNED MESSAGE-----/);
+@@ -391,9 +407,9 @@ sub _sign_gpg {
+         die "Cannot find $sigfile.tmp, signing aborted.\n";
+     };
+ 
+-    open D, "$sigfile.tmp" or die "Cannot open $sigfile.tmp: $!";
++    open D, "< $sigfile.tmp" or die "Cannot open $sigfile.tmp: $!";
+ 
+-    open S, ">$sigfile" or do {
++    open S, "> $sigfile" or do {
+         unlink "$sigfile.tmp";
+         die "Could not write to $sigfile: $!";
+     };
+@@ -576,7 +592,7 @@ sub _mkdigest_files {
+         }
+         else {
+             local *F;
+-            open F, $file or die "Cannot open $file for reading: $!";
++            open F, "< $file" or die "Cannot open $file for reading: $!";
+             if (-B $file) {
+                 binmode(F);
+                 $obj->addfile(*F);
diff --git a/debian/patches/series b/debian/patches/series
index 4ce935e..2b511c0 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1 +1,2 @@
 CVE-2013-2145.patch
+CVE-2015-3406_CVE-2015-3407_CVE-2015-3408.patch

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-perl/packages/libmodule-signature-perl.git



More information about the Pkg-perl-cvs-commits mailing list