summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorGustavo Zacarias <gustavo@zacarias.com.ar>2012-10-12 02:15:09 (GMT)
committer Peter Korsgaard <jacmet@sunsite.dk>2012-10-20 19:04:56 (GMT)
commit7aed4faa9b0e6b21dba82ad5d3be5db796517580 (patch)
tree6589d533624a36ac6a30dc486553eab7942325e8
parentb1570168d86db59a0c9101ca757fc77b909ce3da (diff)
downloadbuildroot-7aed4faa9b0e6b21dba82ad5d3be5db796517580.tar.gz
buildroot-7aed4faa9b0e6b21dba82ad5d3be5db796517580.tar.bz2
hostapd: add fix for CVE-2012-4445
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
-rw-r--r--package/hostapd/hostapd-cve-2012-4445.patch49
1 files changed, 49 insertions, 0 deletions
diff --git a/package/hostapd/hostapd-cve-2012-4445.patch b/package/hostapd/hostapd-cve-2012-4445.patch
new file mode 100644
index 0000000..034a458
--- /dev/null
+++ b/package/hostapd/hostapd-cve-2012-4445.patch
@@ -0,0 +1,49 @@
+From 567bacefd73782508bfe72d3624df495f0df4cd1 Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <j@w1.fi>
+Date: Sun, 7 Oct 2012 20:06:29 +0300
+Subject: [PATCH] EAP-TLS server: Fix TLS Message Length validation
+
+EAP-TLS/PEAP/TTLS/FAST server implementation did not validate TLS
+Message Length value properly and could end up trying to store more
+information into the message buffer than the allocated size if the first
+fragment is longer than the indicated size. This could result in hostapd
+process terminating in wpabuf length validation. Fix this by rejecting
+messages that have invalid TLS Message Length value.
+
+This would affect cases that use the internal EAP authentication server
+in hostapd either directly with IEEE 802.1X or when using hostapd as a
+RADIUS authentication server and when receiving an incorrectly
+constructed EAP-TLS message. Cases where hostapd uses an external
+authentication are not affected.
+
+Thanks to Timo Warns for finding and reporting this issue.
+
+Signed-hostap: Jouni Malinen <j@w1.fi>
+intended-for: hostap-1
+(cherry picked from commit 586c446e0ff42ae00315b014924ec669023bd8de)
+---
+ src/eap_server/eap_server_tls_common.c | 8 ++++++++
+ 1 files changed, 8 insertions(+), 0 deletions(-)
+
+diff --git a/src/eap_server/eap_server_tls_common.c b/src/eap_server/eap_server_tls_common.c
+index e149ee3..2cbe700 100644
+--- a/src/eap_server/eap_server_tls_common.c
++++ b/src/eap_server/eap_server_tls_common.c
+@@ -224,6 +224,14 @@ static int eap_server_tls_process_fragment(struct eap_ssl_data *data,
+ return -1;
+ }
+
++ if (len > message_length) {
++ wpa_printf(MSG_INFO, "SSL: Too much data (%d bytes) in "
++ "first fragment of frame (TLS Message "
++ "Length %d bytes)",
++ (int) len, (int) message_length);
++ return -1;
++ }
++
+ data->tls_in = wpabuf_alloc(message_length);
+ if (data->tls_in == NULL) {
+ wpa_printf(MSG_DEBUG, "SSL: No memory for message");
+--
+1.7.4-rc1
+