From ebd9ac4d994a3add33ec11ecc42ca45b912af0d1 Mon Sep 17 00:00:00 2001 From: Maciej Mrozowski Date: Mon, 10 May 2010 22:08:32 +0000 Subject: [PATCH] CVE-2010-1000 Package-Manager: portage-2.2_rc67/cvs/Linux x86_64 --- kde-base/kget/ChangeLog | 10 +- kde-base/kget/Manifest | 17 +- .../kget/files/kget-4.4.3_CVE-2010-1000.patch | 212 ++++++++++++++++++ ...kget-4.4.2.ebuild => kget-4.4.2-r1.ebuild} | 6 +- ...kget-4.4.3.ebuild => kget-4.4.3-r1.ebuild} | 6 +- 5 files changed, 235 insertions(+), 16 deletions(-) create mode 100644 kde-base/kget/files/kget-4.4.3_CVE-2010-1000.patch rename kde-base/kget/{kget-4.4.2.ebuild => kget-4.4.2-r1.ebuild} (83%) rename kde-base/kget/{kget-4.4.3.ebuild => kget-4.4.3-r1.ebuild} (83%) diff --git a/kde-base/kget/ChangeLog b/kde-base/kget/ChangeLog index dc4d353d060e..f74978751cbf 100644 --- a/kde-base/kget/ChangeLog +++ b/kde-base/kget/ChangeLog @@ -1,6 +1,14 @@ # ChangeLog for kde-base/kget # Copyright 1999-2010 Gentoo Foundation; Distributed under the GPL v2 -# $Header: /var/cvsroot/gentoo-x86/kde-base/kget/ChangeLog,v 1.157 2010/05/03 21:41:55 alexxy Exp $ +# $Header: /var/cvsroot/gentoo-x86/kde-base/kget/ChangeLog,v 1.158 2010/05/10 22:08:32 reavertm Exp $ + +*kget-4.4.3-r1 (10 May 2010) +*kget-4.4.2-r1 (10 May 2010) + + 10 May 2010; Maciej Mrozowski -kget-4.4.2.ebuild, + +kget-4.4.2-r1.ebuild, -kget-4.4.3.ebuild, +kget-4.4.3-r1.ebuild, + +files/kget-4.4.3_CVE-2010-1000.patch: + CVE-2010-1000 03 May 2010; Alexey Shvetsov -kget-4.4.1.ebuild: Drop KDE SC 4.4.1 diff --git a/kde-base/kget/Manifest b/kde-base/kget/Manifest index c2b0cdd4177a..009244daa874 100644 --- a/kde-base/kget/Manifest +++ b/kde-base/kget/Manifest @@ -1,20 +1,11 @@ ------BEGIN PGP SIGNED MESSAGE----- -Hash: SHA1 - +AUX kget-4.4.3_CVE-2010-1000.patch 7534 RMD160 fb949345da07032b8054a3293525340ce23ecac9 SHA1 5604dfcf0ab6c5e98ba4a20a1971419abb85c608 SHA256 256ea5b2eeef1352db9591e1632128ef084ace13701d42c9694cd95f481818f4 DIST kdenetwork-4.3.3.tar.bz2 7379886 RMD160 191dfbd73112b8194bcebf63c6e26abe9f6df299 SHA1 b842f0cfe629a597e74b367037d53d95215efc0c SHA256 dfb58714eb7a97175641f7ddd68cf52fe2ad628f75386958db4bd0a027890279 DIST kdenetwork-4.3.5.tar.bz2 7384719 RMD160 fc631b631957ba49084c2b006d8cef35f2ea3435 SHA1 b94ad996624e170c3a3c3d3a82dd54ca7f2d7910 SHA256 32b1f3d8522bbf98ea141838e8ac9d63fe9a913a59a331ff61f0364b6f3f7ccf DIST kdenetwork-4.4.2.tar.bz2 8318434 RMD160 0ce46b379edb72fcdcba956fbe0d9be1026903eb SHA1 c76ffbae19941d800e3daee54e8fac991f1acec2 SHA256 a63828de08d4782b52f35f7b480a572f8f91db95223bcff41f7de0b07b5c3423 DIST kdenetwork-4.4.3.tar.bz2 8319875 RMD160 90814afa79a259ee36b82ae160b64fe79c90a837 SHA1 67237e0142f5d4edc893a7dcafffa79f998c534e SHA256 8f79ec7084114434f30ae02d2b782e297859fe830c6bd048cf3b0494f7e94cdc EBUILD kget-4.3.3.ebuild 1021 RMD160 830a47ef2654c60b363f65b1050963283a94ad8b SHA1 56d18cd81d15555e071bc03eb0f75c581bc76698 SHA256 b9cad40fe8ee28c5f0a0ed37c3f3d07f0bc10af4385f49fb07d860de98ed567d EBUILD kget-4.3.5.ebuild 990 RMD160 f40d46934c1d05d9df59372ee8a43a33d486d043 SHA1 16e2e05211ddfdfc0b8dd2a1e2c8b5d35ed540d0 SHA256 46f5c996daae80179b73cc5f6418ea8106a2de894455cd79453245b020ad2f36 -EBUILD kget-4.4.2.ebuild 994 RMD160 ceea40bb6daec8a0abbd5a253115e0a1fb4c2258 SHA1 bf1ae5542123543f5d8ba0ae9829b9cfe80803a9 SHA256 9dd30f0d0fc476dbba609512a30d031a7175dcc7b20e1df047999cceea030a66 -EBUILD kget-4.4.3.ebuild 995 RMD160 61e9c13495e5f5febda2d55c10e25bdcde9061e5 SHA1 ef3ff4937a5b0ee64e47e296d84c6d4ebc4c42de SHA256 faf608e50aacdbb7d6946232fc39480e232b0b6321870fe9429140bdc4306f55 -MISC ChangeLog 18012 RMD160 b8e63c3c245ff70d1751372bdcf185b6bf089f96 SHA1 b85cc3a31d1ed9825d6a1b70cd59e1019f82d3b2 SHA256 0dae17905dfc97a8a66c2dff7706a4652d1317cb2a6854212e190696ee33fe85 +EBUILD kget-4.4.2-r1.ebuild 1060 RMD160 d0d388a416b7361a1d563cbdb1b7076aba1d56f2 SHA1 876240075b248ae91064b1f595fe1d884386cbae SHA256 653da1bf1f2a4b8dff5a380c6ae7e53c991474d372b6a04c0cc078aaecf4419b +EBUILD kget-4.4.3-r1.ebuild 1060 RMD160 acd1450b5cf35f90924ca782e5e6791ae400da6e SHA1 80cbcbf1c426b3a28ab9ebfc4b5a590535bd1a7c SHA256 afb1619efc7e367321ad4b545516bd50e6851ff4fb6860bd5daa3e5edd4d983f +MISC ChangeLog 18273 RMD160 6482a01d748eff1179755313e6a102f54ffb1208 SHA1 7daf82bc544e99d565f585c6d1cdf87beccf86b3 SHA256 20e61f904b07a9b5534c34ea9a8e302613769a559b7f2cff9923b14156e033bc MISC metadata.xml 156 RMD160 ecce3b981f150c45ae1e84e2d208e678d6124259 SHA1 b64f7c0b4e5db816d82ad19848f72118af129d35 SHA256 2f4da28506b9d4185f320f67a6191d30c7a921217ed4447ed46ea0bc4aefc79a ------BEGIN PGP SIGNATURE----- -Version: GnuPG v2.0.15 (GNU/Linux) - -iEYEARECAAYFAkvfQ60ACgkQ5BmOA85PVLh56QCeKqLhX5ApIA/jjYce9FFlJwNb -2ukAnjBl1HWGh+bmzHk+JzY5OzG2sNr7 -=iiMV ------END PGP SIGNATURE----- diff --git a/kde-base/kget/files/kget-4.4.3_CVE-2010-1000.patch b/kde-base/kget/files/kget-4.4.3_CVE-2010-1000.patch new file mode 100644 index 000000000000..64e65994e381 --- /dev/null +++ b/kde-base/kget/files/kget-4.4.3_CVE-2010-1000.patch @@ -0,0 +1,212 @@ +diff --git a/kget/transfer-plugins/metalink/metalink.cpp b/kget/transfer-plugins/metalink/metalink.cpp +index 605d4e1..c7d5d75 100644 +--- a/kget/transfer-plugins/metalink/metalink.cpp ++++ b/kget/transfer-plugins/metalink/metalink.cpp +@@ -99,6 +99,7 @@ void Metalink::start() + void Metalink::metalinkInit(const KUrl &src, const QByteArray &data) + { + kDebug(5001); ++ + bool justDownloaded = !m_localMetalinkLocation.isValid(); + if (!src.isEmpty()) + { +@@ -121,7 +122,9 @@ void Metalink::metalinkInit(const KUrl &src, const QByteArray &data) + //error + if (!m_metalink.isValid()) + { +- kDebug(5001) << "Unknown error when trying to load the .metalink-file"; ++ kError(5001) << "Unknown error when trying to load the .metalink-file. Metalink is not valid."; ++ setStatus(Job::Aborted); ++ setTransferChange(Tc_Status, true); + return; + } + +@@ -202,7 +205,7 @@ void Metalink::metalinkInit(const KUrl &src, const QByteArray &data) + if (!m_dataSourceFactory.size()) + { + KMessageBox::error(0, i18n("Download failed, no working URLs were found."), i18n("Error")); +- setStatus(Job::Aborted, i18n("An error occurred...."), SmallIcon("document-preview")); ++ setStatus(Job::Aborted); + setTransferChange(Tc_Status, true); + return; + } +@@ -227,16 +230,29 @@ void Metalink::metalinkInit(const KUrl &src, const QByteArray &data) + ui.treeView->hideColumn(FileItem::SignatureVerified); + dialog->setMainWidget(widget); + dialog->setCaption(i18n("File Selection")); +- dialog->setButtons(KDialog::Ok); +- connect(dialog, SIGNAL(finished()), this, SLOT(filesSelected())); ++ dialog->setButtons(KDialog::Ok | KDialog::Cancel); ++ connect(dialog, SIGNAL(finished(int)), this, SLOT(fileDlgFinished(int))); + + dialog->show(); + } + } + +-void Metalink::filesSelected() ++void Metalink::fileDlgFinished(int result) + { ++ //BEGIN HACK if the dialog was not accepted untick every file, so that the download does not start ++ //generally setStatus should do the job as well, but does not as it appears ++ if (result != QDialog::Accepted) { ++ for (int row = 0; row < fileModel()->rowCount(); ++row) { ++ QModelIndex index = fileModel()->index(row, FileItem::File); ++ if (index.isValid()) { ++ fileModel()->setData(index, Qt::Unchecked, Qt::CheckStateRole); ++ } ++ } ++ } ++ //END ++ + QModelIndexList files = fileModel()->fileIndexes(FileItem::File); ++ int numFilesSelected = 0; + foreach (const QModelIndex &index, files) + { + const KUrl dest = fileModel()->getUrl(index); +@@ -244,6 +260,9 @@ void Metalink::filesSelected() + if (m_dataSourceFactory.contains(dest)) + { + m_dataSourceFactory[dest]->setDoDownload(doDownload); ++ if (doDownload) { ++ ++numFilesSelected; ++ } + } + } + +@@ -252,9 +271,15 @@ void Metalink::filesSelected() + processedSizeChanged(); + speedChanged(); + ++ //no files selected to download or dialog rejected, stop the download ++ if (!numFilesSelected || (result != QDialog::Accepted)) { ++ setStatus(Job::Stopped);//FIXME ++ setTransferChange(Tc_Status, true); ++ return; ++ } ++ + //some files may be set to download, so start them as long as the transfer is not stopped +- if (status() != Job::Stopped) +- { ++ if (status() != Job::Stopped) { + startMetalink(); + } + } +diff --git a/kget/transfer-plugins/metalink/metalink.h b/kget/transfer-plugins/metalink/metalink.h +index 41988cb..15e8698 100644 +--- a/kget/transfer-plugins/metalink/metalink.h ++++ b/kget/transfer-plugins/metalink/metalink.h +@@ -81,7 +81,7 @@ class Metalink : public Transfer + + private Q_SLOTS: + void metalinkInit(const KUrl &url = KUrl(), const QByteArray &data = QByteArray()); +- void filesSelected(); ++ void fileDlgFinished(int result); + void totalSizeChanged(KIO::filesize_t size); + void processedSizeChanged(); + void speedChanged(); +diff --git a/kget/ui/metalinkcreator/metalinker.cpp b/kget/ui/metalinkcreator/metalinker.cpp +index 9487c6f..019b571 100644 +--- a/kget/ui/metalinkcreator/metalinker.cpp ++++ b/kget/ui/metalinkcreator/metalinker.cpp +@@ -528,14 +528,14 @@ void KGetMetalink::Verification::clear() + + bool KGetMetalink::File::isValid() const + { +- return !name.isEmpty() && resources.isValid(); ++ return isValidNameAttribute() && resources.isValid(); + } + + void KGetMetalink::File::load(const QDomElement &e) + { + data.load(e); + +- name = e.attribute("name"); ++ name = QUrl::fromPercentEncoding(e.attribute("name").toAscii()); + size = e.firstChildElement("size").text().toULongLong(); + + verification.load(e); +@@ -575,6 +575,22 @@ void KGetMetalink::File::clear() + resources.clear(); + } + ++ ++bool KGetMetalink::File::isValidNameAttribute() const ++{ ++ if (name.isEmpty()) { ++ kError(5001) << "Name attribute of Metalink::File is empty."; ++ return false; ++ } ++ ++ if (name.contains(QRegExp("$(\\.\\.?)?/")) || name.contains("/../") || name.endsWith("/..")) { ++ kError(5001) << "Name attribute of Metalink::File contains directory traversal directives:" << name; ++ return false; ++ } ++ ++ return true; ++} ++ + #ifdef HAVE_NEPOMUK + QHash KGetMetalink::File::properties() const + { +@@ -584,13 +600,28 @@ QHash KGetMetalink::File::properties() const + + bool KGetMetalink::Files::isValid() const + { +- bool isValid = !files.empty(); +- foreach (const File &file, files) +- { +- isValid &= file.isValid(); ++ if (files.isEmpty()) { ++ return false; + } + +- return isValid; ++ QStringList fileNames; ++ foreach (const File &file, files) { ++ fileNames << file.name; ++ if (!file.isValid()) { ++ return false; ++ } ++ } ++ ++ //The value of name must be unique for each file ++ while (!fileNames.isEmpty()) { ++ const QString fileName = fileNames.takeFirst(); ++ if (fileNames.contains(fileName)) { ++ kError(5001) << "Metalink::File name" << fileName << "exists multiple times."; ++ return false; ++ } ++ } ++ ++ return true; + } + + void KGetMetalink::Files::load(const QDomElement &e) +@@ -751,7 +782,7 @@ void KGetMetalink::Metalink_v3::parseFiles(const QDomElement &e) + + for (QDomElement elem = filesElem.firstChildElement("file"); !elem.isNull(); elem = elem.nextSiblingElement("file")) { + File file; +- file.name = elem.attribute("name"); ++ file.name = QUrl::fromPercentEncoding(elem.attribute("name").toAscii()); + file.size = elem.firstChildElement("size").text().toULongLong(); + + file.data = parseCommonData(elem); +diff --git a/kget/ui/metalinkcreator/metalinker.h b/kget/ui/metalinkcreator/metalinker.h +index 36b5b82..867d1a7 100644 +--- a/kget/ui/metalinkcreator/metalinker.h ++++ b/kget/ui/metalinkcreator/metalinker.h +@@ -259,6 +259,14 @@ class File + KIO::filesize_t size; + CommonData data; + Resources resources; ++ ++ private: ++ /** ++ * Controlls if the name attribute is valid, i.e. it is not empty and ++ * does not contain any directory traversal directives or information, ++ * as described in the Metalink 4.0 specification 4.1.2.1. ++ */ ++ bool isValidNameAttribute() const; + }; + + class Files diff --git a/kde-base/kget/kget-4.4.2.ebuild b/kde-base/kget/kget-4.4.2-r1.ebuild similarity index 83% rename from kde-base/kget/kget-4.4.2.ebuild rename to kde-base/kget/kget-4.4.2-r1.ebuild index 60c319ceeda3..30310a822692 100644 --- a/kde-base/kget/kget-4.4.2.ebuild +++ b/kde-base/kget/kget-4.4.2-r1.ebuild @@ -1,6 +1,6 @@ # Copyright 1999-2010 Gentoo Foundation # Distributed under the terms of the GNU General Public License v2 -# $Header: /var/cvsroot/gentoo-x86/kde-base/kget/kget-4.4.2.ebuild,v 1.1 2010/03/30 21:02:32 spatz Exp $ +# $Header: /var/cvsroot/gentoo-x86/kde-base/kget/kget-4.4.2-r1.ebuild,v 1.1 2010/05/10 22:08:32 reavertm Exp $ EAPI="3" @@ -25,6 +25,10 @@ DEPEND="${RDEPEND} dev-libs/boost " +PATCHES=( + "${FILESDIR}/${PN}-4.4.3_CVE-2010-1000.patch" +) + src_configure() { mycmakeargs=( -DENABLE_EMBEDDED_TORRENT_SUPPORT=ON diff --git a/kde-base/kget/kget-4.4.3.ebuild b/kde-base/kget/kget-4.4.3-r1.ebuild similarity index 83% rename from kde-base/kget/kget-4.4.3.ebuild rename to kde-base/kget/kget-4.4.3-r1.ebuild index dd975ea72dc6..705c9264bf9c 100644 --- a/kde-base/kget/kget-4.4.3.ebuild +++ b/kde-base/kget/kget-4.4.3-r1.ebuild @@ -1,6 +1,6 @@ # Copyright 1999-2010 Gentoo Foundation # Distributed under the terms of the GNU General Public License v2 -# $Header: /var/cvsroot/gentoo-x86/kde-base/kget/kget-4.4.3.ebuild,v 1.1 2010/05/03 20:51:37 alexxy Exp $ +# $Header: /var/cvsroot/gentoo-x86/kde-base/kget/kget-4.4.3-r1.ebuild,v 1.1 2010/05/10 22:08:32 reavertm Exp $ EAPI="3" @@ -25,6 +25,10 @@ DEPEND="${RDEPEND} dev-libs/boost " +PATCHES=( + "${FILESDIR}/${PN}-4.4.3_CVE-2010-1000.patch" +) + src_configure() { mycmakeargs=( -DENABLE_EMBEDDED_TORRENT_SUPPORT=ON -- 2.26.2