From 6d51ce39ae49581a2fd18a6f5bcea4b4f878a01e Mon Sep 17 00:00:00 2001 From: Joshua Brindle Date: Mon, 1 Nov 2004 14:03:44 +0000 Subject: [PATCH] version bump for CAN-2004-0816 --- sys-kernel/hardened-dev-sources/ChangeLog | 9 +++- sys-kernel/hardened-dev-sources/Manifest | 21 ++++++--- ... => digest-hardened-dev-sources-2.6.7-r10} | 0 ...ened-dev-sources-2.6.7.CAN-2004-0816.patch | 44 +++++++++++++++++++ ... => hardened-dev-sources-2.6.7-r10.ebuild} | 5 ++- 5 files changed, 71 insertions(+), 8 deletions(-) rename sys-kernel/hardened-dev-sources/files/{digest-hardened-dev-sources-2.6.7-r9 => digest-hardened-dev-sources-2.6.7-r10} (100%) create mode 100644 sys-kernel/hardened-dev-sources/files/hardened-dev-sources-2.6.7.CAN-2004-0816.patch rename sys-kernel/hardened-dev-sources/{hardened-dev-sources-2.6.7-r9.ebuild => hardened-dev-sources-2.6.7-r10.ebuild} (80%) diff --git a/sys-kernel/hardened-dev-sources/ChangeLog b/sys-kernel/hardened-dev-sources/ChangeLog index 84943e802d5e..a4e4b566c4a6 100644 --- a/sys-kernel/hardened-dev-sources/ChangeLog +++ b/sys-kernel/hardened-dev-sources/ChangeLog @@ -1,6 +1,13 @@ # ChangeLog for sys-kernel/hardened-dev-sources # Copyright 2000-2004 Gentoo Foundation; Distributed under the GPL v2 -# $Header: /var/cvsroot/gentoo-x86/sys-kernel/hardened-dev-sources/ChangeLog,v 1.40 2004/10/16 19:15:51 method Exp $ +# $Header: /var/cvsroot/gentoo-x86/sys-kernel/hardened-dev-sources/ChangeLog,v 1.41 2004/11/01 14:03:44 method Exp $ + +*hardened-dev-sources-2.6.7-r10 (01 Nov 2004) + + 01 Nov 2004; Joshua Brindle + hardened-dev-sources-2.6.7-r10.ebuild, hardened-dev-sources-2.6.7-r9.ebuild, + files/hardened-dev-sources-2.6.7.CAN-2004-0816.patch: + Add CAN-2004-0816 iptables patch *hardened-dev-sources-2.6.7-r9 (16 Oct 2004) diff --git a/sys-kernel/hardened-dev-sources/Manifest b/sys-kernel/hardened-dev-sources/Manifest index c3ef914d4252..c657df3991b8 100644 --- a/sys-kernel/hardened-dev-sources/Manifest +++ b/sys-kernel/hardened-dev-sources/Manifest @@ -1,9 +1,20 @@ -MD5 daa20bf7db5ecf989bdc9af98c9865fe ChangeLog 6863 -MD5 6ceac5877bbf8ffb6523d3d671031b73 hardened-dev-sources-2.6.7-r7.ebuild 1089 +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA1 + MD5 82fb2e488cf74ed7bdb51f1f521c1fe4 hardened-dev-sources-2.6.7-r8.ebuild 1092 -MD5 acc96490301c95a056b351e566342103 hardened-dev-sources-2.6.7-r9.ebuild 1085 +MD5 0b8ab20736a2b68476718b12a797d7ff hardened-dev-sources-2.6.7-r10.ebuild 1163 +MD5 80eac19822330fc7aa7083f482ff3209 ChangeLog 7131 MD5 73174f8e07b82c5df563b7196f87611c metadata.xml 299 +MD5 6ceac5877bbf8ffb6523d3d671031b73 hardened-dev-sources-2.6.7-r7.ebuild 1089 +MD5 8add7d7ef69d9ff384b7d4f5a0356cc3 files/digest-hardened-dev-sources-2.6.7-r10 219 +MD5 bc48c226344f94535c3ba2e0ce55bf24 files/hardened-dev-sources-2.6.7.CAN-2004-0816.patch 1694 +MD5 8204afea1d572b49a4a80d8da4eef0c9 files/hardened-dev-sources-2.6.7.CAN-2004-0596.patch 1033 MD5 efbbfbed471c50333a8c2fd2f2b0b061 files/digest-hardened-dev-sources-2.6.7-r7 219 MD5 0f763833ebbcbf0f2a8ac151454c3b29 files/digest-hardened-dev-sources-2.6.7-r8 219 -MD5 8add7d7ef69d9ff384b7d4f5a0356cc3 files/digest-hardened-dev-sources-2.6.7-r9 219 -MD5 8204afea1d572b49a4a80d8da4eef0c9 files/hardened-dev-sources-2.6.7.CAN-2004-0596.patch 1033 +-----BEGIN PGP SIGNATURE----- +Version: GnuPG v1.2.4 (GNU/Linux) + +iD8DBQFBhkFvI9RrrOsOLvcRAoFNAKCMpGB2M/KuUUBEQLzPTamjJYm8MACfRIBh +8UQ1yRKB8QcbIApuHZUibGQ= +=ZynH +-----END PGP SIGNATURE----- diff --git a/sys-kernel/hardened-dev-sources/files/digest-hardened-dev-sources-2.6.7-r9 b/sys-kernel/hardened-dev-sources/files/digest-hardened-dev-sources-2.6.7-r10 similarity index 100% rename from sys-kernel/hardened-dev-sources/files/digest-hardened-dev-sources-2.6.7-r9 rename to sys-kernel/hardened-dev-sources/files/digest-hardened-dev-sources-2.6.7-r10 diff --git a/sys-kernel/hardened-dev-sources/files/hardened-dev-sources-2.6.7.CAN-2004-0816.patch b/sys-kernel/hardened-dev-sources/files/hardened-dev-sources-2.6.7.CAN-2004-0816.patch new file mode 100644 index 000000000000..2cf3599efc47 --- /dev/null +++ b/sys-kernel/hardened-dev-sources/files/hardened-dev-sources-2.6.7.CAN-2004-0816.patch @@ -0,0 +1,44 @@ +Subject: Prevent ICMP crash in netfilter logging +From: Olaf Kirch +References: 46016 + +This patch fixes a remotely triggerable crash in the netfilter code +when looking at ICMP unreachables. It dies when trying to copy +BIGNUM bytes... + +Index: linux-2.6.5/net/ipv4/netfilter/ipt_LOG.c +=================================================================== +--- linux-2.6.5.orig/net/ipv4/netfilter/ipt_LOG.c 2004-02-19 11:36:37.000000000 +0100 ++++ linux-2.6.5/net/ipv4/netfilter/ipt_LOG.c 2004-09-24 15:48:54.000000000 +0200 +@@ -71,7 +71,7 @@ + printk("FRAG:%u ", ntohs(iph.frag_off) & IP_OFFSET); + + if ((info->logflags & IPT_LOG_IPOPT) +- && iph.ihl * 4 != sizeof(struct iphdr)) { ++ && iph.ihl * 4 > sizeof(struct iphdr)) { + unsigned char opt[4 * 15 - sizeof(struct iphdr)]; + unsigned int i, optsize; + +@@ -138,7 +138,7 @@ + printk("URGP=%u ", ntohs(tcph.urg_ptr)); + + if ((info->logflags & IPT_LOG_TCPOPT) +- && tcph.doff * 4 != sizeof(struct tcphdr)) { ++ && tcph.doff * 4 > sizeof(struct tcphdr)) { + unsigned char opt[4 * 15 - sizeof(struct tcphdr)]; + unsigned int i, optsize; + +Index: linux-2.6.5/net/ipv6/netfilter/ip6t_LOG.c +=================================================================== +--- linux-2.6.5.orig/net/ipv6/netfilter/ip6t_LOG.c 2004-09-24 15:47:00.000000000 +0200 ++++ linux-2.6.5/net/ipv6/netfilter/ip6t_LOG.c 2004-09-24 15:48:35.000000000 +0200 +@@ -188,7 +188,7 @@ + printk("URGP=%u ", ntohs(tcph->urg_ptr)); + + if ((info->logflags & IP6T_LOG_TCPOPT) +- && tcph->doff * 4 != sizeof(struct tcphdr)) { ++ && tcph->doff * 4 > sizeof(struct tcphdr)) { + unsigned int i; + + /* Max length: 127 "OPT (" 15*4*2chars ") " */ + diff --git a/sys-kernel/hardened-dev-sources/hardened-dev-sources-2.6.7-r9.ebuild b/sys-kernel/hardened-dev-sources/hardened-dev-sources-2.6.7-r10.ebuild similarity index 80% rename from sys-kernel/hardened-dev-sources/hardened-dev-sources-2.6.7-r9.ebuild rename to sys-kernel/hardened-dev-sources/hardened-dev-sources-2.6.7-r10.ebuild index f0c000249998..e174101a2430 100644 --- a/sys-kernel/hardened-dev-sources/hardened-dev-sources-2.6.7-r9.ebuild +++ b/sys-kernel/hardened-dev-sources/hardened-dev-sources-2.6.7-r10.ebuild @@ -1,6 +1,6 @@ # Copyright 1999-2004 Gentoo Foundation # Distributed under the terms of the GNU General Public License v2 -# $Header: /var/cvsroot/gentoo-x86/sys-kernel/hardened-dev-sources/hardened-dev-sources-2.6.7-r9.ebuild,v 1.2 2004/10/31 04:18:43 lv Exp $ +# $Header: /var/cvsroot/gentoo-x86/sys-kernel/hardened-dev-sources/hardened-dev-sources-2.6.7-r10.ebuild,v 1.1 2004/11/01 14:03:44 method Exp $ IUSE="" ETYPE="sources" @@ -17,7 +17,8 @@ HGPV_SRC="http://dev.gentoo.org/~tseng/kernel/hardened-patches-${KV_MAJOR}.${KV_ UNIPATCH_STRICTORDER="yes" UNIPATCH_EXCLUDE="1315_alpha" UNIPATCH_LIST="${DISTDIR}/hardened-patches-${KV_MAJOR}.${KV_MINOR}-${HGPV}.tar.bz2 - ${DISTDIR}/genpatches-${KV_MAJOR}.${KV_MINOR}-${GPV}-base.tar.bz2" + ${DISTDIR}/genpatches-${KV_MAJOR}.${KV_MINOR}-${GPV}-base.tar.bz2 + ${FILESDIR}/hardened-dev-sources-2.6.7.CAN-2004-0816.patch" UNIPATCH_DOCS="${WORKDIR}/patches/hardened-patches-${KV_MAJOR}.${KV_MINOR}-${HGPV}/0000_README" DESCRIPTION="Hardened sources for the ${KV_MAJOR}.${KV_MINOR} kernel tree" -- 2.26.2