dev-libs/xml-security-c: Security fix for CVE-2009-0217

svn path=/sunrise/; revision=8832

diff --git a/dev-libs/xml-security-c/ChangeLog b/dev-libs/xml-security-c/ChangeLog
index fc9e58a5507648056fc417101a8e5edf9deb3ccb..1272ec4f24c2b29cd508387b7794ed85d6437516 100644 (file)
--- a/dev-libs/xml-security-c/ChangeLog
+++ b/dev-libs/xml-security-c/ChangeLog
@@ -2,6 +2,10 @@
 # Copyright 2000-2009 Gentoo Foundation; Distributed under the GPL v2
 # $Header: $
 
+  16 Jul 2009; Thomas Beierlein (TomJBE) <tb@forth-ev.de>
+  xml-security-c-1.5.0.ebuild, +files/CVE-2009-0217-fix.patch:
+  Security fix for CVE-2009-0217
+
   16 Jul 2009; Thomas Beierlein (TomJBE) <tb@forth-ev.de>
   -xml-security-c-1.4.0.ebuild, +xml-security-c-1.5.0.ebuild:
   Version bump

diff --git a/dev-libs/xml-security-c/Manifest b/dev-libs/xml-security-c/Manifest
index 3c14a8a5569254b388f6395215291128e7fd0fef..613652139f1201e451912967d26f5bb353966413 100644 (file)
--- a/dev-libs/xml-security-c/Manifest
+++ b/dev-libs/xml-security-c/Manifest
@@ -1,4 +1,5 @@
+AUX CVE-2009-0217-fix.patch 3674 RMD160 8d21c8e111dc28b28c668d9c1ceef4df11eecc35 SHA1 7856a29cfd5af2b9dc56420c1bbb3339fb1f65f0 SHA256 bbaee8b06cacb71df1ac4c4bae8b133acb1c9ea61b3522909fa8069655820403
 DIST xml-security-c-1.5.0.tar.gz 957148 RMD160 d40be42ee7f12f48509b2fa31d5029475be398de SHA1 f4c3fe56deac2461bd97ebda1b0b39f70fb20a04 SHA256 a790b6a2e4d5e204184aecc76fb2f0b40bedfd2a643532a7cadec7151dd78475
-EBUILD xml-security-c-1.5.0.ebuild 616 RMD160 1413f166be55b1e4dc05c47b3cf1cf7bbdad0de5 SHA1 3f0f6fcc8fcaf33010c6a9a5f698d1c08382e1bf SHA256 2b5fcca69dfbb3de86f7c8f5d53c900269c43adf6db316597884cf6b40282801
-MISC ChangeLog 644 RMD160 b08242fdff1b82ae353185116d4157d043a4a8d1 SHA1 dea21e549f9e5ffff75136a5035f5ce21e843150 SHA256 8af3fc75188209a3283a59bb6e10b7bff3e8cfdcb21c85805909df0b662b79f3
+EBUILD xml-security-c-1.5.0.ebuild 743 RMD160 1784e3564d6cbb923eb069f31d4b74c0c6750ffe SHA1 833496eef5484861d758003ea156a23dc44b9159 SHA256 4c1daf0b3bb3808ceef716ec6f5294116e2ab2f2ccb14e909491cf9e23047e69
+MISC ChangeLog 799 RMD160 bbde71eaef243080233e75270587c69a3d1c28e5 SHA1 25fdf1ad5543def5cb5cc1a79f7ee51285f5ad99 SHA256 e241eab79831c95650bda8e7163d04913ea9b490c7c56f37cac8337cbb8b8614
 MISC metadata.xml 290 RMD160 a31bb9468300ba7321320de317d3130291b7b156 SHA1 69a4c0e652258ebc2bc5da5df525bad3923ebc7f SHA256 69e4f84c4ff607b175fad5627e93fbcd02c729b7df2b5f759b256bbc07092527

diff --git a/dev-libs/xml-security-c/files/CVE-2009-0217-fix.patch b/dev-libs/xml-security-c/files/CVE-2009-0217-fix.patch
new file mode 100644 (file)
index 0000000..fd20760
--- /dev/null
+++ b/dev-libs/xml-security-c/files/CVE-2009-0217-fix.patch
@@ -0,0 +1,115 @@
+--- src/dsig/DSIGAlgorithmHandlerDefault.cpp   2009/07/14 18:55:07     794016
++++ src/dsig/DSIGAlgorithmHandlerDefault.cpp   2009/07/14 19:03:52     794017
+@@ -459,6 +459,12 @@
+               }
+ 
+               // Signature already created, so just translate to base 64 and enter string
++
++        // FIX: CVE-2009-0217
++        if (outputLength > 0 && (outputLength < 80 || outputLength < hashLen / 2)) {
++            throw XSECException(XSECException::AlgorithmMapperError,
++                "HMACOutputLength set to unsafe value.");
++        }
+               
+               convertRawToBase64String(b64SB, 
+                                                               hash, 
+@@ -560,7 +566,14 @@
+       case (XSECCryptoKey::KEY_HMAC) :
+ 
+               // Already done - just compare calculated value with read value
+-              sigVfyRet = compareBase64StringToRaw(sig, 
++
++        // FIX: CVE-2009-0217
++        if (outputLength > 0 && (outputLength < 80 || outputLength < hashLen / 2)) {
++            throw XSECException(XSECException::AlgorithmMapperError,
++                "HMACOutputLength set to unsafe value.");
++        }
++
++          sigVfyRet = compareBase64StringToRaw(sig,
+                       hash, 
+                       hashLen,
+                       outputLength);
+--- src/dsig/DSIGSignature.cpp 2009/07/14 18:55:07     794016
++++ src/dsig/DSIGSignature.cpp 2009/07/14 19:03:52     794017
+@@ -1042,6 +1042,13 @@
+ 
+       }
+ 
++      // FIX: CVE-2009-0217
++
++      if (mp_signedInfo->getHMACOutputLength() > 0 && mp_signedInfo->getHMACOutputLength() < 80) {
++          throw XSECException(XSECException::SigVfyError,
++            "DSIGSignature::verify() - HMACOutputLength is unsafe");
++      }
++
+       // Try to find a key
+       if (mp_signingKey == NULL) {
+ 
+--- src/framework/XSECW32Config.hpp    2009/07/14 18:55:07     794016
++++ src/framework/XSECW32Config.hpp    2009/07/14 19:03:52     794017
+@@ -38,7 +38,7 @@
+ 
+ #define XSEC_VERSION_MAJOR   1
+ #define XSEC_VERSION_MEDIUM  5
+-#define XSEC_VERSION_MINOR   0
++#define XSEC_VERSION_MINOR   1
+ 
+ /*
+  * Because we don't have a configure script, we need to rely on version
+--- configure.ac       2009/07/14 18:55:07     794016
++++ configure.ac       2009/07/14 19:03:52     794017
+@@ -19,12 +19,12 @@
+ 
+ # Process this file with autoconf to produce a configure script
+ 
+-AC_INIT([[XML-Security-C]], [1.5.0], [security-dev@xml.apache.org], [xml-security-c])
++AC_INIT([[XML-Security-C]], [1.5.1], [security-dev@xml.apache.org], [xml-security-c])
+ AC_CONFIG_AUX_DIR([config])
+ 
+ # kick off automake
+ 
+-AM_INIT_AUTOMAKE(xml-security-c, 1.5.0)
++AM_INIT_AUTOMAKE(xml-security-c, 1.5.1)
+ sinclude(m4/acx_pthread.m4)
+ AM_PROG_LIBTOOL
+ 
+--- src/framework/version.rc   2009/07/14 18:55:07     794016
++++ src/framework/version.rc   2009/07/14 19:03:52     794017
+@@ -54,8 +54,8 @@
+ //
+ 
+ VS_VERSION_INFO VERSIONINFO
+- FILEVERSION 1,5,0,0
+- PRODUCTVERSION 1,5,0,0
++ FILEVERSION 1,5,1,0
++ PRODUCTVERSION 1,5,1,0
+  FILEFLAGSMASK 0x3fL
+ #ifdef _DEBUG
+  FILEFLAGS 0x1L
+@@ -73,7 +73,7 @@
+             VALUE "Comments", "\0"
+             VALUE "CompanyName", "The Apache Software Foundation\0"
+             VALUE "FileDescription", "XML Security C++ Library\0"
+-            VALUE "FileVersion", "1, 5, 0, 0\0"
++            VALUE "FileVersion", "1, 5, 1, 0\0"
+ #ifdef _DEBUG
+             VALUE "InternalName", "xsec_1_5D\0"
+ #else
+@@ -88,7 +88,7 @@
+ #endif
+             VALUE "PrivateBuild", "\0"
+             VALUE "ProductName", "XML-Security-C - C++ XML Security Library\0"
+-            VALUE "ProductVersion", "1, 5, 0, 0\0"
++            VALUE "ProductVersion", "1, 5, 1, 0\0"
+             VALUE "SpecialBuild", "\0"
+         END
+     END
+--- xml-security-c.spec        2009/07/14 18:55:07     794016
++++ xml-security-c.spec        2009/07/14 19:03:52     794017
+@@ -1,5 +1,5 @@
+ Name:           xml-security-c
+-Version:        1.5.0
++Version:        1.5.1
+ Release:        1
+ Summary:        C++ XML security library
+ 

diff --git a/dev-libs/xml-security-c/xml-security-c-1.5.0.ebuild b/dev-libs/xml-security-c/xml-security-c-1.5.0.ebuild
index 8dc89d7d9c60aa7de55821a7c6961eff95b4936c..9bd9cb4a27c7f6e28a651c2adabe18f55feccebd 100644 (file)
--- a/dev-libs/xml-security-c/xml-security-c-1.5.0.ebuild
+++ b/dev-libs/xml-security-c/xml-security-c-1.5.0.ebuild
@@ -2,6 +2,8 @@
 # Distributed under the terms of the GNU General Public License v2
 # $Header: $
 
+inherit autotools eutils
+
 DESCRIPTION="Apache C++ XML security libraries."
 HOMEPAGE="http://santuario.apache.org/"
 SRC_URI="http://xml.apache.org/security/dist/c-library/${P}.tar.gz"
@@ -17,6 +19,13 @@ RDEPEND="=dev-libs/xerces-c-2*
 DEPEND="${RDEPEND}
        dev-util/pkgconfig"
 
+src_unpack() {
+       unpack ${A}
+       cd "${S}"
+       epatch "${FILESDIR}"/CVE-2009-0217-fix.patch
+       eautoreconf
+}
+
 src_compile () {
        econf $(use_with xalan)
        emake || die "emake failed"