[gentoo-commits] gentoo-x86 commit in net-libs/gnutls/files: CVE-2009-1417.patch CVE-2009-1416.patch CVE-2009-1415.patch

[Daniel Black (dragonheart)]

dragonheart    09/04/30 12:23:44

  Added:                CVE-2009-1417.patch CVE-2009-1416.patch
                        CVE-2009-1415.patch
  Log:
  fix for security bug #267774
  (Portage version: 2.2_rc31/cvs/Linux x86_64)

Revision  Changes    Path
1.1                  net-libs/gnutls/files/CVE-2009-1417.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/net-libs/gnutls/files/CVE-2009-1417.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/net-libs/gnutls/files/CVE-2009-1417.patch?rev=1.1&content-type=text/plain

Index: CVE-2009-1417.patch
===================================================================
Index: gnutls-2.6.5/includes/gnutls/gnutls.h.in
===================================================================
--- gnutls-2.6.5.orig/includes/gnutls/gnutls.h.in
+++ gnutls-2.6.5/includes/gnutls/gnutls.h.in
@@ -251,7 +251,13 @@ extern "C"
      */
     GNUTLS_CERT_SIGNER_NOT_FOUND = 64,
     GNUTLS_CERT_SIGNER_NOT_CA = 128,
-    GNUTLS_CERT_INSECURE_ALGORITHM = 256
+    GNUTLS_CERT_INSECURE_ALGORITHM = 256,
+
+    /* Time verification.
+     */
+    GNUTLS_CERT_NOT_ACTIVATED = 512,
+    GNUTLS_CERT_EXPIRED = 1024
+
   } gnutls_certificate_status_t;
 
   typedef enum
Index: gnutls-2.6.5/includes/gnutls/x509.h
===================================================================
--- gnutls-2.6.5.orig/includes/gnutls/x509.h
+++ gnutls-2.6.5/includes/gnutls/x509.h
@@ -481,7 +481,13 @@ extern "C"
 
     /* Allow certificates to be signed using the broken MD5 algorithm.
      */
-    GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD5 = 32
+    GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD5 = 32,
+
+    /* Disable checking of activation and expiration validity
+     * periods of certificate chains. Don't set this unless you
+     * understand the security implications.
+     */
+    GNUTLS_VERIFY_DISABLE_TIME_CHECKS = 64
   } gnutls_certificate_verify_flags;
 
   int gnutls_x509_crt_check_issuer (gnutls_x509_crt_t cert,
Index: gnutls-2.6.5/lib/x509/verify.c
===================================================================
--- gnutls-2.6.5.orig/lib/x509/verify.c
+++ gnutls-2.6.5/lib/x509/verify.c
@@ -493,6 +493,32 @@ _gnutls_x509_verify_certificate (const g
     }
 #endif
 
+  /* Check activation/expiration times
+   */
+  if (!(flags & GNUTLS_VERIFY_DISABLE_TIME_CHECKS))
+    {
+      time_t t, now = time (0);
+
+      for (i = 0; i < clist_size; i++)
+	{
+	  t = gnutls_x509_crt_get_activation_time (certificate_list[i]);
+	  if (t == (time_t) -1 || now < t)
+	    {
+	      status |= GNUTLS_CERT_NOT_ACTIVATED;
+	      status |= GNUTLS_CERT_INVALID;
+	      return status;
+	    }
+
+	  t = gnutls_x509_crt_get_expiration_time (certificate_list[i]);
+	  if (t == (time_t) -1 || now > t)
+	    {
+	      status |= GNUTLS_CERT_EXPIRED;
+	      status |= GNUTLS_CERT_INVALID;
+	      return status;
+	    }
+	}
+    }
+
   /* Verify the certificate path (chain)
    */
   for (i = clist_size - 1; i > 0; i--)
Index: gnutls-2.6.5/src/common.c
===================================================================
--- gnutls-2.6.5.orig/src/common.c
+++ gnutls-2.6.5/src/common.c
@@ -427,6 +427,10 @@ print_cert_vrfy (gnutls_session_t sessio
     {
       if (status & GNUTLS_CERT_SIGNER_NOT_FOUND)
 	printf ("- Peer's certificate issuer is unknown\n");
+      if (status & GNUTLS_CERT_NOT_ACTIVATED)
+    printf ("- Peer's certificate chain uses not yet valid certificate\n");
+      if (status & GNUTLS_CERT_EXPIRED)
+    printf ("- Peer's certificate chain uses expired certificate\n");
       if (status & GNUTLS_CERT_INVALID)
 	printf ("- Peer's certificate is NOT trusted\n");
       else



1.1                  net-libs/gnutls/files/CVE-2009-1416.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/net-libs/gnutls/files/CVE-2009-1416.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/net-libs/gnutls/files/CVE-2009-1416.patch?rev=1.1&content-type=text/plain

Index: CVE-2009-1416.patch
===================================================================
diff --git a/lib/gnutls_pk.c b/lib/gnutls_pk.c
index 1015c3a..a08349b 100644
--- a/lib/gnutls_pk.c
+++ b/lib/gnutls_pk.c
@@ -529,7 +529,7 @@ _generate_params (int algo, bigint_t * resarr, unsigned int *resarr_len,
   int ret;
   unsigned int i;
 
-  ret = _gnutls_pk_ops.generate (GNUTLS_PK_RSA, bits, &params);
+  ret = _gnutls_pk_ops.generate (algo, bits, &params);
 
   if (ret < 0)
     {



1.1                  net-libs/gnutls/files/CVE-2009-1415.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/net-libs/gnutls/files/CVE-2009-1415.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/net-libs/gnutls/files/CVE-2009-1415.patch?rev=1.1&content-type=text/plain

Index: CVE-2009-1415.patch
===================================================================
--- pk-libgcrypt.c-	2009-04-23 10:59:06.000000000 +0200
+++ pk-libgcrypt.c	2009-04-23 18:32:17.000000000 +0200
@@ -418,7 +418,7 @@
 		      const gnutls_datum_t * signature,
 		      const gnutls_pk_params_st * pk_params)
 {
-  gcry_sexp_t s_sig, s_hash, s_pkey;
+  gcry_sexp_t s_sig = NULL, s_hash = NULL, s_pkey = NULL;
   int rc = -1, ret;
   bigint_t hash;
   bigint_t tmp[2] = { NULL, NULL };
@@ -511,6 +511,7 @@
   gcry_sexp_release (s_sig);
   gcry_sexp_release (s_hash);
   gcry_sexp_release (s_pkey);
+  s_hash = s_pkey = s_sig = NULL;
 
   if (rc != 0)
     {