rpms/tog-pegasus/F-8 pegasus-2.6.1-cve-2008-0003.patch, NONE, 1.1 tog-pegasus.spec, 1.51, 1.52

[Vitezslav Crhonek (vcrhonek)]

Author: vcrhonek

Update of /cvs/extras/rpms/tog-pegasus/F-8
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv1576

Modified Files:
	tog-pegasus.spec 
Added Files:
	pegasus-2.6.1-cve-2008-0003.patch 
Log Message:
Fix PAM authentication buffer overflow (CVE-2008-0003)

pegasus-2.6.1-cve-2008-0003.patch:

--- NEW FILE pegasus-2.6.1-cve-2008-0003.patch ---
Index: pegasus/src/Pegasus/Security/Authentication/PAMBasicAuthenticatorUnix.cpp
===================================================================
RCS file: /cvs/MSB/pegasus/src/Pegasus/Security/Authentication/PAMBasicAuthenticatorUnix.cpp,v
retrieving revision 1.34.4.1
diff -u -r1.34.4.1 PAMBasicAuthenticatorUnix.cpp
--- pegasus/src/Pegasus/Security/Authentication/PAMBasicAuthenticatorUnix.cpp	4 Apr 2007 11:04:52 -0000	1.34.4.1
+++ pegasus/src/Pegasus/Security/Authentication/PAMBasicAuthenticatorUnix.cpp	31 Dec 2007 18:31:24 -0000
@@ -38,6 +38,8 @@
 //
 //%/////////////////////////////////////////////////////////////////////////////
 
+// NOCHKSRC
+
 #include <Pegasus/Common/System.h>
 #include <Pegasus/Common/Tracer.h>
 #include <Pegasus/Config/ConfigManager.h>
@@ -387,7 +389,8 @@
                 // copy the user password
                 // 
                 resp[i]->resp = (char *)malloc(PAM_MAX_MSG_SIZE);
-                strcpy(resp[i]->resp, mydata->userPassword);
+                strncpy(resp[i]->resp, mydata->userPassword, PAM_MAX_MSG_SIZE);
+                resp[i]->resp[PAM_MAX_MSG_SIZE - 1] = 0;
                 resp[i]->resp_retcode = 0;
                 break;
 
Index: pegasus/src/Pegasus/Security/Cimservera/cimservera.cpp
===================================================================
RCS file: /cvs/MSB/pegasus/src/Pegasus/Security/Cimservera/Attic/cimservera.cpp,v
retrieving revision 1.6
diff -u -r1.6 cimservera.cpp
--- pegasus/src/Pegasus/Security/Cimservera/cimservera.cpp	30 Jan 2006 16:18:29 -0000	1.6
+++ pegasus/src/Pegasus/Security/Cimservera/cimservera.cpp	31 Dec 2007 18:31:24 -0000
@@ -29,14 +29,10 @@
 //
 //==============================================================================
 //
-// Author: Ben Heilbronn, Hewlett-Packard Company(ben_heilbronn at hp.com)
-//
-//         Parts of this code originated within PAMBasicAuthenticator.
-//
-// Modified By: Sushma Fernandes, Hewlett-Packard Company(sushma_fernandes at hp.com)
-//
 //%/////////////////////////////////////////////////////////////////////////////
 
+// NOCHKSRC
+
 #include <Pegasus/Common/System.h>
 #include <Pegasus/Common/String.h>
 #include <Pegasus/Common/FileSystem.h>
@@ -185,7 +181,8 @@
                 // copy the user password
                 // 
                 resp[i]->resp = (char *)malloc(PAM_MAX_MSG_SIZE);
-                strcpy(resp[i]->resp, mydata->userPassword);
+                strncpy(resp[i]->resp, mydata->userPassword, PAM_MAX_MSG_SIZE);
+                resp[i]->resp[PAM_MAX_MSG_SIZE - 1] = 0;
                 resp[i]->resp_retcode = 0;
                 break;
 


Index: tog-pegasus.spec
===================================================================
RCS file: /cvs/extras/rpms/tog-pegasus/F-8/tog-pegasus.spec,v
retrieving revision 1.51
retrieving revision 1.52
diff -u -r1.51 -r1.52
--- tog-pegasus.spec	10 Oct 2007 10:22:50 -0000	1.51
+++ tog-pegasus.spec	10 Jan 2008 10:48:54 -0000	1.52
@@ -41,7 +41,7 @@
 %endif
 
 Version: 		2.6.1
-Release: 		2%{?dist}
+Release: 		3%{?dist}
 Epoch:   		2
 #
 Summary:   		OpenPegasus WBEM Services for Linux
@@ -78,6 +78,7 @@
 #
 Patch39:		pegasus-2.6.0-cimuser.patch
 Patch40:		pegasus-2.6.1-init_script.patch
+Patch41:		pegasus-2.6.1-cve-2008-0003.patch
 #
 Conflicts: 		openwbem
 Provides: 		tog-pegasus-cimserver
@@ -140,6 +141,7 @@
 %patch11 -p1 -b .fix-tests
 %patch39 -p1 -b .cimuser
 %patch40 -p1 -b .init_script
+%patch41 -p1 -b .cve-2008-0003
 find . -name 'CVS' -exec /bin/rm -rf '{}' ';' >/dev/null 2>&1 ||:;
 
 %build
@@ -435,6 +437,10 @@
 
 
 %changelog
+* Thu Jan 10 2008 Vitezslav Crhonek <vcrhonek at redhat.com> - 2.6.1-3
+- Fix PAM authentication buffer overflow (CVE-2008-0003)
+  Resolves: #427829
+
 * Tue Oct  9 2007 Vitezslav Crhonek <vcrhonek at redhat.com> - 2.6.1-2
 - Fix files permissions
   Resolves: #200906