Your message dated Tue, 17 Mar 2015 22:17:05 +0000
with message-id <e1yxznn-0002ao...@franck.debian.org>
and subject line Bug#780139: fixed in checkpw 1.02-1+deb7u1
has caused the Debian Bug report #780139,
regarding CVE-2015-0885
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)
--
780139: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=780139
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: checkpw
Severity: grave
Tags: security
Hi Gerrit,
please see
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0885
(feel free to lower the severity, I don't know checkpw myself)
I'm attaching a cleaned-up diff between the 1.03 and 1.02 releases.
Cheers,
Moritz
diff -Naur checkpw-1.02/checkapoppw.c checkpw-1.03/checkapoppw.c
--- checkpw-1.02/checkapoppw.c 2002-01-07 08:25:10.000000000 +0100
+++ checkpw-1.03/checkapoppw.c 2015-02-21 00:42:57.000000000 +0100
@@ -85,7 +85,7 @@
pw = getpwnam(login);
if (pw) break;
if (errno == error_txtbsy) die(111);
- for (; ext != login && *ext != '-'; --ext);
+ do {--ext;} while (ext != login && *ext != '-');
if (ext == login) die(1);
if (i) login[i] = '-';
i = ext - login;
diff -Naur checkpw-1.02/checkpw.c checkpw-1.03/checkpw.c
--- checkpw-1.02/checkpw.c 2002-01-07 08:23:51.000000000 +0100
+++ checkpw-1.03/checkpw.c 2015-02-21 00:42:33.000000000 +0100
@@ -71,7 +71,7 @@
pw = getpwnam(login);
if (pw) break;
if (errno == error_txtbsy) die(111);
- for (; ext != login && *ext != '-'; --ext);
+ do {--ext;} while (ext != login && *ext != '-');
if (ext == login) die(1);
if (i) login[i] = '-';
i = ext - login;
--- End Message ---
--- Begin Message ---
Source: checkpw
Source-Version: 1.02-1+deb7u1
We believe that the bug you reported is fixed in the latest version of
checkpw, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 780...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Salvatore Bonaccorso <car...@debian.org> (supplier of updated checkpw package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 16 Mar 2015 13:20:09 +0100
Source: checkpw
Binary: checkpw
Architecture: source amd64
Version: 1.02-1+deb7u1
Distribution: wheezy-security
Urgency: high
Maintainer: Gerrit Pape <p...@smarden.org>
Changed-By: Salvatore Bonaccorso <car...@debian.org>
Description:
checkpw - checks password which is stored in ~/Maildir/.password
Closes: 780139
Changes:
checkpw (1.02-1+deb7u1) wheezy-security; urgency=high
.
* Non-maintainer upload by the Security Team.
* CVE-2015-0885: Fix denial of service via -- in usernames (Closes: #780139)
Checksums-Sha1:
e0eeb81fd87be9aba1148d70ca359d4dfc2f215a 1592 checkpw_1.02-1+deb7u1.dsc
6a290aedf75f34401efc329c9eb1eb650e3181df 28631 checkpw_1.02.orig.tar.gz
0f68be23961de2f489ceaeb3b8276124b45dbcd0 6867 checkpw_1.02-1+deb7u1.diff.gz
4fef9a749cb0a99bb97cb4aea8b56015c947f91d 19572 checkpw_1.02-1+deb7u1_amd64.deb
Checksums-Sha256:
b96dcacae34fd526b84e437f41465cfa1505fa58c201e0c7004ebc514f9ef63b 1592
checkpw_1.02-1+deb7u1.dsc
685a7fd4f4c783d0dcee342d109b0e492d3251e3c0cbc0ef77d33613cac6bced 28631
checkpw_1.02.orig.tar.gz
d3fb6b5c43d0728c691997000e848c51b6a406fb7e817dca986ddda4992d0478 6867
checkpw_1.02-1+deb7u1.diff.gz
2fc5946c28e5dba5b117fcb1b9978b377115b20397db07bf5eb26b418e7bc612 19572
checkpw_1.02-1+deb7u1_amd64.deb
Files:
251c2ce9afa9eae7318cfeb182c9cedb 1592 mail optional checkpw_1.02-1+deb7u1.dsc
0f71643b3e4f6b856f44d1fedd6ceb38 28631 mail optional checkpw_1.02.orig.tar.gz
8c25c507688045224ad4713129f880d5 6867 mail optional
checkpw_1.02-1+deb7u1.diff.gz
09e9c6b8aa22bf0549e3e5e4d32e143f 19572 mail optional
checkpw_1.02-1+deb7u1_amd64.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBCgAGBQJVBs1KAAoJEAVMuPMTQ89EeKYP/0Jj65jWl2AWPM4OrtaBJ1jR
iI0avosHvpFtqmVdPgrS8VQjFwjvIfJb1x2QoQDro/S16RZEcv1avLfkak3XG/3k
hL6KI2A6KDxmpCQlNCDfaYEv14zeopu44v/ju+x3DmiqlpCpFjdV4Q6x0SI4xCad
A1VXlPiCJEupFq3nQ0TiR8BD95qLe0GFfZB6Flz2HAAP3oszVyEnqIPo98ysIohA
8LP8ji83SLbT74k8v3cC1HOCL2nNJLXz/w9/AMs+HSCmpFpxAy7Kx23wRgvwSEB7
Gwd+BoD+JJV3e4UUqKXeWPIAkbmvDZEnOzbkyBt+XK/Uqi0CQF6+LpZC3VkFI3s7
+CCJYvT44oYdD4EZmEz2e1EpuPDEic1aZFykENYDT0f6KaqJ564gt8n2cTkexQQ1
xgrRsi8nCIM0k7vcqTjhIXtMfPeO0G/d6huQI6yUBIghj1urcKJ3OiQMD0Mnt0rB
KVXZBVJO0h1rwtS4HIyKFafNRJkONYxVgxS3tzr1OhcrL4LlNJVhiGROFs6oc8vb
OIhbb3nRr9bqrgw4R9rQq9kCAu9qLNmhu6MI88CGDRF6ESPTSF55EibURgG6Gagn
loQM4AZcVl+HPIRAmRzJjEWUilDqci4gvVixvRijtMlFPTGxVqiEH9i0tvqzqNG3
qIhqoOIgeuoMLq1K/k20
=8yGQ
-----END PGP SIGNATURE-----
--- End Message ---
