rpms/scponly/F-8 scponly-4.6-CVE-2007-6415.patch, NONE, 1.1 scponly.spec, 1.7, 1.8
Toshio くらとみ (toshio)
fedora-extras-commits at redhat.com
Wed Feb 13 20:56:48 UTC 2008
- Previous message (by thread): rpms/policycoreutils/devel .cvsignore, 1.175, 1.176 policycoreutils-gui.patch, 1.55, 1.56 policycoreutils.spec, 1.508, 1.509 sources, 1.180, 1.181
- Next message (by thread): rpms/scponly/EL-4 scponly.spec,1.6,1.7
- Messages sorted by:
[ date ]
[ thread ]
[ subject ]
[ author ]
Author: toshio
Update of /cvs/pkgs/rpms/scponly/F-8
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv14657
Modified Files:
scponly.spec
Added Files:
scponly-4.6-CVE-2007-6415.patch
Log Message:
* Wed Feb 13 2008 Tomas Hoger <thoger at redhat.com> - 4.6-10
- Add patch to prevent restriction bypass using OpenSSH's scp options -F
and -o (CVE-2007-6415, #426072)
scponly-4.6-CVE-2007-6415.patch:
--- NEW FILE scponly-4.6-CVE-2007-6415.patch ---
diff -pruN scponly-4.6.orig/helper.c scponly-4.6/helper.c
--- scponly-4.6.orig/helper.c 2006-01-31 23:04:16.000000000 +0100
+++ scponly-4.6/helper.c 2008-02-13 20:11:58.000000000 +0100
@@ -181,10 +181,10 @@ int check_dangerous_args(char **av)
*/
opterr=cmdarg->strict;
while ((ch = getopt(ac, av, cmdarg->opts)) != -1)
- if (ch == cmdarg->badarg[0])
+ if (strchr(cmdarg->badarg, ch) || (cmdarg->strict && ch == '?'))
{
- syslog(LOG_ERR, "option %s is not permitted for use with %s (arg was %s)(%s))",
- cmdarg->badarg, cmdarg->name, optarg, logstamp());
+ syslog(LOG_ERR, "option -%c is not permitted for use with %s (arg was %s)(%s))",
+ ch, cmdarg->name, optarg, logstamp());
return 1;
}
#elif
diff -pruN scponly-4.6.orig/scponly.c scponly-4.6/scponly.c
--- scponly-4.6.orig/scponly.c 2006-01-31 00:09:40.000000000 +0100
+++ scponly-4.6/scponly.c 2008-02-13 20:11:58.000000000 +0100
@@ -92,7 +92,7 @@ cmd_arg_t dangerous_args[] =
* program name use getopt? strict optlist? optname optlist
*/
#ifdef ENABLE_SCP2
- { PROG_SCP, 1, 1, "S", "dfl:prtvBCc:i:P:q1246S:o:F:" },
+ { PROG_SCP, 1, 1, "SoF", "dfl:prtvBCc:i:P:q1246S:o:F:" },
#endif
#ifdef RSYNC_COMPAT
{ PROG_RSYNC, 1, 0, "e", "e:" },
Index: scponly.spec
===================================================================
RCS file: /cvs/pkgs/rpms/scponly/F-8/scponly.spec,v
retrieving revision 1.7
retrieving revision 1.8
diff -u -r1.7 -r1.8
--- scponly.spec 21 Aug 2007 14:59:40 -0000 1.7
+++ scponly.spec 13 Feb 2008 20:56:03 -0000 1.8
@@ -1,12 +1,13 @@
Summary: Restricted shell for ssh based file services
Name: scponly
Version: 4.6
-Release: 7%{?dist}
+Release: 10%{?dist}
License: BSD
Group: Applications/Internet
URL: http://sublimation.org/scponly/
Source: http://sublimation.org/scponly/scponly-%{version}.tgz
Patch0: scponly-install.patch
+Patch1: scponly-4.6-CVE-2007-6415.patch
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
# Checks only for location of binaries
@@ -24,10 +25,12 @@
%prep
%setup -q
%patch0 -p1
+%patch1 -p1 -b .CVE-2007-6415
%build
-%configure --enable-scp-compat --enable-rsync-compat --enable-winscp-compat \
- --enable-chrooted-binary
+%configure --enable-scp-compat --enable-winscp-compat --enable-chrooted-binary
+#--enable-rsync-compat
+
%{__make} %{?_smp_mflags} \
OPTS="%{optflags}"
@@ -55,6 +58,16 @@
%config(noreplace) %{_sysconfdir}/scponly/*
%changelog
+* Wed Feb 13 2008 Tomas Hoger <thoger at redhat.com> - 4.6-10
+- Add patch to prevent restriction bypass using OpenSSH's scp options -F
+ and -o (CVE-2007-6415, #426072)
+
+* Mon Feb 11 2008 Warren Togami <wtogami at redhat.com> - 4.6-9
+- rebuild with gcc-4.3
+
+* Tue Dec 11 2007 Toshio Kuratomi <a.badger at gmail.com> - 4.6-8
+- Disable rsync support due to security concerns: RH BZ#418201
+
* Tue Aug 21 2007 Warren Togami <wtogami at redhat.com> - 4.6-7
- rebuild
- Previous message (by thread): rpms/policycoreutils/devel .cvsignore, 1.175, 1.176 policycoreutils-gui.patch, 1.55, 1.56 policycoreutils.spec, 1.508, 1.509 sources, 1.180, 1.181
- Next message (by thread): rpms/scponly/EL-4 scponly.spec,1.6,1.7
- Messages sorted by:
[ date ]
[ thread ]
[ subject ]
[ author ]
More information about the fedora-extras-commits
mailing list