|
 |
6d61af |
2014-12-12 11:06:03+00:00, stenn@psp-fb1.ntp.org +12 -3
|
|
|
6d61af |
[Sec 2667] buffer overflow in crypto_recv()
|
|
|
6d61af |
|
|
|
6d61af |
--- 1.168/ntpd/ntp_crypto.c 2014-11-15 04:41:02 +00:00
|
|
|
6d61af |
+++ 1.169/ntpd/ntp_crypto.c 2014-12-12 11:06:03 +00:00
|
|
|
6d61af |
@@ -820,15 +820,24 @@ crypto_recv(
|
|
|
6d61af |
* errors.
|
|
|
6d61af |
*/
|
|
|
6d61af |
if (vallen == (u_int)EVP_PKEY_size(host_pkey)) {
|
|
|
6d61af |
+ u_int32 *cookiebuf = malloc(
|
|
|
6d61af |
+ RSA_size(host_pkey->pkey.rsa));
|
|
|
6d61af |
+ if (!cookiebuf) {
|
|
|
6d61af |
+ rval = XEVNT_CKY;
|
|
|
6d61af |
+ break;
|
|
|
6d61af |
+ }
|
|
|
6d61af |
+
|
|
|
6d61af |
if (RSA_private_decrypt(vallen,
|
|
|
6d61af |
(u_char *)ep->pkt,
|
|
|
6d61af |
- (u_char *)&temp32,
|
|
|
6d61af |
+ (u_char *)cookiebuf,
|
|
|
6d61af |
host_pkey->pkey.rsa,
|
|
|
6d61af |
- RSA_PKCS1_OAEP_PADDING) <= 0) {
|
|
|
6d61af |
+ RSA_PKCS1_OAEP_PADDING) != 4) {
|
|
|
6d61af |
rval = XEVNT_CKY;
|
|
|
6d61af |
+ free(cookiebuf);
|
|
|
6d61af |
break;
|
|
|
6d61af |
} else {
|
|
|
6d61af |
- cookie = ntohl(temp32);
|
|
|
6d61af |
+ cookie = ntohl(*cookiebuf);
|
|
|
6d61af |
+ free(cookiebuf);
|
|
|
6d61af |
}
|
|
|
6d61af |
} else {
|
|
|
6d61af |
rval = XEVNT_CKY;
|
|
|
6d61af |
|
|
|
6d61af |
2014-12-12 11:13:40+00:00, stenn@psp-fb1.ntp.org +16 -1
|
|
|
6d61af |
[Sec 2668] buffer overflow in ctl_putdata()
|
|
|
6d61af |
|
|
|
6d61af |
--- 1.190/ntpd/ntp_control.c 2014-11-15 04:41:02 +00:00
|
|
|
6d61af |
+++ 1.191/ntpd/ntp_control.c 2014-12-12 11:13:40 +00:00
|
|
|
6d61af |
@@ -801,6 +801,10 @@ static char *reqend;
|
|
|
6d61af |
static char *reqpt;
|
|
|
6d61af |
static char *reqend;
|
|
|
6d61af |
|
|
|
6d61af |
+#ifndef MIN
|
|
|
6d61af |
+#define MIN(a, b) (((a) <= (b)) ? (a) : (b))
|
|
|
6d61af |
+#endif
|
|
|
6d61af |
+
|
|
|
6d61af |
/*
|
|
|
6d61af |
* init_control - initialize request data
|
|
|
6d61af |
*/
|
|
|
6d61af |
@@ -1316,6 +1320,7 @@ ctl_putdata(
|
|
|
6d61af |
)
|
|
|
6d61af |
{
|
|
|
6d61af |
int overhead;
|
|
|
6d61af |
+ unsigned int currentlen;
|
|
|
6d61af |
|
|
|
6d61af |
overhead = 0;
|
|
|
6d61af |
if (!bin) {
|
|
|
6d61af |
@@ -1338,12 +1343,22 @@ ctl_putdata(
|
|
|
6d61af |
/*
|
|
|
6d61af |
* Save room for trailing junk
|
|
|
6d61af |
*/
|
|
|
6d61af |
- if (dlen + overhead + datapt > dataend) {
|
|
|
6d61af |
+ while (dlen + overhead + datapt > dataend) {
|
|
|
6d61af |
/*
|
|
|
6d61af |
* Not enough room in this one, flush it out.
|
|
|
6d61af |
*/
|
|
|
6d61af |
+ currentlen = MIN(dlen, dataend - datapt);
|
|
|
6d61af |
+
|
|
|
6d61af |
+ memcpy(datapt, dp, currentlen);
|
|
|
6d61af |
+
|
|
|
6d61af |
+ datapt += currentlen;
|
|
|
6d61af |
+ dp += currentlen;
|
|
|
6d61af |
+ dlen -= currentlen;
|
|
|
6d61af |
+ datalinelen += currentlen;
|
|
|
6d61af |
+
|
|
|
6d61af |
ctl_flushpkt(CTL_MORE);
|
|
|
6d61af |
}
|
|
|
6d61af |
+
|
|
|
6d61af |
memmove((char *)datapt, dp, (unsigned)dlen);
|
|
|
6d61af |
datapt += dlen;
|
|
|
6d61af |
datalinelen += dlen;
|
|
|
6d61af |
|
|
|
6d61af |
2014-12-12 11:19:37+00:00, stenn@psp-fb1.ntp.org +14 -0
|
|
|
6d61af |
[Sec 2669] buffer overflow in configure()
|
|
|
6d61af |
|
|
|
6d61af |
--- 1.191/ntpd/ntp_control.c 2014-12-12 11:13:40 +00:00
|
|
|
6d61af |
+++ 1.192/ntpd/ntp_control.c 2014-12-12 11:19:37 +00:00
|
|
|
6d61af |
@@ -3290,6 +3290,20 @@ static void configure(
|
|
|
6d61af |
|
|
|
6d61af |
/* Initialize the remote config buffer */
|
|
|
6d61af |
data_count = reqend - reqpt;
|
|
|
6d61af |
+
|
|
|
6d61af |
+ if (data_count > sizeof(remote_config.buffer) - 2) {
|
|
|
6d61af |
+ snprintf(remote_config.err_msg,
|
|
|
6d61af |
+ sizeof(remote_config.err_msg),
|
|
|
6d61af |
+ "runtime configuration failed: request too long");
|
|
|
6d61af |
+ ctl_putdata(remote_config.err_msg,
|
|
|
6d61af |
+ strlen(remote_config.err_msg), 0);
|
|
|
6d61af |
+ ctl_flushpkt(0);
|
|
|
6d61af |
+ msyslog(LOG_NOTICE,
|
|
|
6d61af |
+ "runtime config from %s rejected: request too long",
|
|
|
6d61af |
+ stoa(&rbufp->recv_srcadr));
|
|
|
6d61af |
+ return;
|
|
|
6d61af |
+ }
|
|
|
6d61af |
+
|
|
|
6d61af |
memcpy(remote_config.buffer, reqpt, data_count);
|
|
|
6d61af |
if (data_count > 0
|
|
|
6d61af |
&& '\n' != remote_config.buffer[data_count - 1])
|
|
|
6d61af |
|