aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorSimon L. B. Nielsen <simon@FreeBSD.org>2012-11-22 22:52:15 +0000
committerSimon L. B. Nielsen <simon@FreeBSD.org>2012-11-22 22:52:15 +0000
commit9ea3d85408ec76bac872c871a2703bdec06491f7 (patch)
treee92c1f3c0e508b8a3885c317713c8ac60d761e53
parent6e9d26e200dd8e987fde707f8225e9e243e9ea14 (diff)
downloadsrc-9ea3d85408ec76bac872c871a2703bdec06491f7.tar.gz
src-9ea3d85408ec76bac872c871a2703bdec06491f7.zip
Fix multiple Denial of Service vulnerabilities with named(8).
Fix insufficient message length validation for EAP-TLS messages. Fix Linux compatibility layer input validation error. Security: FreeBSD-SA-12:06.bind Security: FreeBSD-SA-12:07.hostapd Security: FreeBSD-SA-12:08.linux Security: CVE-2012-4244, CVE-2012-5166, CVE-2012-4445, CVE-2012-4576 Approved by: re Approved by: security-officer
Notes
Notes: svn path=/releng/9.1/; revision=243417
-rw-r--r--contrib/wpa/src/eap_server/eap_server_tls_common.c8
-rw-r--r--sys/compat/linux/linux_ioctl.c5
2 files changed, 11 insertions, 2 deletions
diff --git a/contrib/wpa/src/eap_server/eap_server_tls_common.c b/contrib/wpa/src/eap_server/eap_server_tls_common.c
index 25ae683f0668..625ff52a4c2b 100644
--- a/contrib/wpa/src/eap_server/eap_server_tls_common.c
+++ b/contrib/wpa/src/eap_server/eap_server_tls_common.c
@@ -225,6 +225,14 @@ static int eap_server_tls_process_fragment(struct eap_ssl_data *data,
return -1;
}
+ if (len > message_length) {
+ wpa_printf(MSG_INFO, "SSL: Too much data (%d bytes) in "
+ "first fragment of frame (TLS Message "
+ "Length %d bytes)",
+ (int) len, (int) message_length);
+ return -1;
+ }
+
data->tls_in = wpabuf_alloc(message_length);
if (data->tls_in == NULL) {
wpa_printf(MSG_DEBUG, "SSL: No memory for message");
diff --git a/sys/compat/linux/linux_ioctl.c b/sys/compat/linux/linux_ioctl.c
index a2b1dc02c407..168e68012625 100644
--- a/sys/compat/linux/linux_ioctl.c
+++ b/sys/compat/linux/linux_ioctl.c
@@ -2260,8 +2260,9 @@ again:
ifc.ifc_len = valid_len;
sbuf_finish(sb);
- memcpy(PTRIN(ifc.ifc_buf), sbuf_data(sb), ifc.ifc_len);
- error = copyout(&ifc, uifc, sizeof(ifc));
+ error = copyout(sbuf_data(sb), PTRIN(ifc.ifc_buf), ifc.ifc_len);
+ if (error == 0)
+ error = copyout(&ifc, uifc, sizeof(ifc));
sbuf_delete(sb);
CURVNET_RESTORE();