1 |
jsbronder 14/06/19 20:31:25 |
2 |
|
3 |
Added: CVE-2013-4495.4.1.patch |
4 |
Log: |
5 |
Bump 4.1.7, add fix for CVE-2013-4495 (#491270) |
6 |
|
7 |
(Portage version: 2.2.8-r1/cvs/Linux x86_64, signed Manifest commit with key 4D7043C9) |
8 |
|
9 |
Revision Changes Path |
10 |
1.1 sys-cluster/torque/files/CVE-2013-4495.4.1.patch |
11 |
|
12 |
file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/sys-cluster/torque/files/CVE-2013-4495.4.1.patch?rev=1.1&view=markup |
13 |
plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/sys-cluster/torque/files/CVE-2013-4495.4.1.patch?rev=1.1&content-type=text/plain |
14 |
|
15 |
Index: CVE-2013-4495.4.1.patch |
16 |
=================================================================== |
17 |
From 2aad72c3d2ac612ecbb66828ac6ed5ab51eff5f3 Mon Sep 17 00:00:00 2001 |
18 |
From: David Beer <dbeer@×××××××××××××××××.com> |
19 |
Date: Mon, 11 Nov 2013 11:55:58 -0700 |
20 |
Subject: [PATCH] Fix CVE 2013-4495. Note: this patch has been verified as |
21 |
fixing this security hole but has not received other regression testing. |
22 |
Could not cherry-pick as 2.5 and 4.1 are very different. |
23 |
|
24 |
--- |
25 |
src/server/svr_mail.c | 265 ++++++++++++++++++++++++++++++++------------------ |
26 |
1 file changed, 170 insertions(+), 95 deletions(-) |
27 |
|
28 |
diff --git a/src/server/svr_mail.c b/src/server/svr_mail.c |
29 |
index b269e82..52f2f1f 100644 |
30 |
--- a/src/server/svr_mail.c |
31 |
+++ b/src/server/svr_mail.c |
32 |
@@ -89,6 +89,7 @@ |
33 |
#include <stdio.h> |
34 |
#include <stdlib.h> |
35 |
#include <string.h> |
36 |
+#include <unistd.h> |
37 |
#include "list_link.h" |
38 |
#include "attribute.h" |
39 |
#include "server_limits.h" |
40 |
@@ -136,6 +137,77 @@ void free_mail_info( |
41 |
|
42 |
|
43 |
|
44 |
+void add_body_info( |
45 |
+ |
46 |
+ char *bodyfmtbuf /* I */, |
47 |
+ mail_info *mi /* I */) |
48 |
+ |
49 |
+ { |
50 |
+ char *bodyfmt = NULL; |
51 |
+ bodyfmt = strcpy(bodyfmtbuf, "PBS Job Id: %i\n" |
52 |
+ "Job Name: %j\n"); |
53 |
+ if (mi->exec_host != NULL) |
54 |
+ { |
55 |
+ strcat(bodyfmt, "Exec host: %h\n"); |
56 |
+ } |
57 |
+ |
58 |
+ strcat(bodyfmt, "%m\n"); |
59 |
+ |
60 |
+ if (mi->text != NULL) |
61 |
+ { |
62 |
+ strcat(bodyfmt, "%d\n"); |
63 |
+ } |
64 |
+ } |
65 |
+ |
66 |
+ |
67 |
+/* |
68 |
+ * write_email() |
69 |
+ * |
70 |
+ * In emailing, the mail body is written to a pipe connected to |
71 |
+ * standard input for sendmail. This function supplies the body |
72 |
+ * of the message. |
73 |
+ * |
74 |
+ */ |
75 |
+void write_email( |
76 |
+ |
77 |
+ FILE *outmail_input, |
78 |
+ mail_info *mi) |
79 |
+ |
80 |
+ { |
81 |
+ char *bodyfmt = NULL; |
82 |
+ char *subjectfmt = NULL; |
83 |
+ |
84 |
+ /* Pipe in mail headers: To: and Subject: */ |
85 |
+ fprintf(outmail_input, "To: %s\n", mi->mailto); |
86 |
+ |
87 |
+ /* mail subject line formating statement */ |
88 |
+ get_svr_attr_str(SRV_ATR_MailSubjectFmt, (char **)&subjectfmt); |
89 |
+ if (subjectfmt == NULL) |
90 |
+ { |
91 |
+ subjectfmt = "PBS JOB %i"; |
92 |
+ } |
93 |
+ |
94 |
+ fprintf(outmail_input, "Subject: "); |
95 |
+ svr_format_job(outmail_input, mi, subjectfmt); |
96 |
+ fprintf(outmail_input, "\n"); |
97 |
+ |
98 |
+ /* Set "Precedence: bulk" to avoid vacation messages, etc */ |
99 |
+ fprintf(outmail_input, "Precedence: bulk\n\n"); |
100 |
+ |
101 |
+ /* mail body formating statement */ |
102 |
+ get_svr_attr_str(SRV_ATR_MailBodyFmt, &bodyfmt); |
103 |
+ if (bodyfmt == NULL) |
104 |
+ { |
105 |
+ char bodyfmtbuf[MAXLINE]; |
106 |
+ add_body_info(bodyfmtbuf, mi); |
107 |
+ bodyfmt = bodyfmtbuf; |
108 |
+ } |
109 |
+ |
110 |
+ /* Now pipe in the email body */ |
111 |
+ svr_format_job(outmail_input, mi, bodyfmt); |
112 |
+ |
113 |
+ } /* write_email() */ |
114 |
+ |
115 |
|
116 |
|
117 |
void *send_the_mail( |
118 |
@@ -143,15 +215,19 @@ void *send_the_mail( |
119 |
void *vp) |
120 |
|
121 |
{ |
122 |
- mail_info *mi = (mail_info *)vp; |
123 |
- |
124 |
- int i; |
125 |
- char *mailfrom = NULL; |
126 |
- char *subjectfmt = NULL; |
127 |
- char *bodyfmt = NULL; |
128 |
- char *cmdbuf = NULL; |
129 |
- char bodyfmtbuf[MAXLINE]; |
130 |
- FILE *outmail; |
131 |
+ mail_info *mi = (mail_info *)vp; |
132 |
+ |
133 |
+ int status = 0; |
134 |
+ int numargs = 0; |
135 |
+ int pipes[2]; |
136 |
+ int counter; |
137 |
+ pid_t pid; |
138 |
+ char *mailptr; |
139 |
+ char *mailfrom = NULL; |
140 |
+ char tmpBuf[LOG_BUF_SIZE]; |
141 |
+ // We call sendmail with cmd_name + 2 arguments + # of mailto addresses + 1 for null |
142 |
+ char *sendmail_args[100]; |
143 |
+ FILE *stream; |
144 |
|
145 |
/* Who is mail from, if SRV_ATR_mailfrom not set use default */ |
146 |
get_svr_attr_str(SRV_ATR_mailfrom, &mailfrom); |
147 |
@@ -173,124 +249,123 @@ void *send_the_mail( |
148 |
mailfrom = PBS_DEFAULT_MAIL; |
149 |
} |
150 |
|
151 |
- /* mail subject line formating statement */ |
152 |
- get_svr_attr_str(SRV_ATR_MailSubjectFmt, &subjectfmt); |
153 |
- if (subjectfmt == NULL) |
154 |
- { |
155 |
- subjectfmt = "PBS JOB %i"; |
156 |
- } |
157 |
+ sendmail_args[numargs++] = (char *)SENDMAIL_CMD; |
158 |
+ sendmail_args[numargs++] = (char *)"-f"; |
159 |
+ sendmail_args[numargs++] = (char *)mailfrom; |
160 |
|
161 |
- /* mail body formating statement */ |
162 |
- get_svr_attr_str(SRV_ATR_MailBodyFmt, &bodyfmt); |
163 |
- if (bodyfmt == NULL) |
164 |
+ /* Add the e-mail addresses to the command line */ |
165 |
+ mailptr = strdup(mi->mailto); |
166 |
+ sendmail_args[numargs++] = mailptr; |
167 |
+ for (counter=0; counter < (int)strlen(mailptr); counter++) |
168 |
{ |
169 |
- bodyfmt = strcpy(bodyfmtbuf, "PBS Job Id: %i\n" |
170 |
- "Job Name: %j\n"); |
171 |
- if (mi->exec_host != NULL) |
172 |
+ if (mailptr[counter] == ',') |
173 |
{ |
174 |
- strcat(bodyfmt, "Exec host: %h\n"); |
175 |
- } |
176 |
- |
177 |
- strcat(bodyfmt, "%m\n"); |
178 |
- |
179 |
- if (mi->text != NULL) |
180 |
- { |
181 |
- strcat(bodyfmt, "%d\n"); |
182 |
+ mailptr[counter] = '\0'; |
183 |
+ sendmail_args[numargs++] = mailptr + counter + 1; |
184 |
+ if (numargs >= 99) |
185 |
+ break; |
186 |
} |
187 |
} |
188 |
|
189 |
- /* setup sendmail command line with -f from_whom */ |
190 |
- i = strlen(SENDMAIL_CMD) + strlen(mailfrom) + strlen(mi->mailto) + 6; |
191 |
- |
192 |
- if ((cmdbuf = calloc(1, i + 1)) == NULL) |
193 |
+ sendmail_args[numargs] = NULL; |
194 |
+ |
195 |
+ /* Create a pipe to talk to the sendmail process we are about to fork */ |
196 |
+ if (pipe(pipes) == -1) |
197 |
{ |
198 |
- char tmpBuf[LOG_BUF_SIZE]; |
199 |
- |
200 |
- snprintf(tmpBuf,sizeof(tmpBuf), |
201 |
- "Unable to popen() command '%s' for writing: '%s' (error %d)\n", |
202 |
- SENDMAIL_CMD, |
203 |
- strerror(errno), |
204 |
- errno); |
205 |
+ snprintf(tmpBuf, sizeof(tmpBuf), "Unable to pipes for sending e-mail\n"); |
206 |
log_event(PBSEVENT_ERROR | PBSEVENT_ADMIN | PBSEVENT_JOB, |
207 |
PBS_EVENTCLASS_JOB, |
208 |
mi->jobid, |
209 |
tmpBuf); |
210 |
- |
211 |
- free_mail_info(mi); |
212 |
|
213 |
+ free_mail_info(mi); |
214 |
+ free(mailptr); |
215 |
return(NULL); |
216 |
} |
217 |
|
218 |
- sprintf(cmdbuf, "%s -f %s %s", |
219 |
- SENDMAIL_CMD, |
220 |
- mailfrom, |
221 |
- mi->mailto); |
222 |
- |
223 |
- outmail = popen(cmdbuf, "w"); |
224 |
- |
225 |
- if (outmail == NULL) |
226 |
+ if ((pid=fork()) == -1) |
227 |
{ |
228 |
- char tmpBuf[LOG_BUF_SIZE]; |
229 |
- |
230 |
- snprintf(tmpBuf,sizeof(tmpBuf), |
231 |
- "Unable to popen() command '%s' for writing: '%s' (error %d)\n", |
232 |
- cmdbuf, |
233 |
- strerror(errno), |
234 |
- errno); |
235 |
+ snprintf(tmpBuf, sizeof(tmpBuf), "Unable to fork for sending e-mail\n"); |
236 |
log_event(PBSEVENT_ERROR | PBSEVENT_ADMIN | PBSEVENT_JOB, |
237 |
PBS_EVENTCLASS_JOB, |
238 |
mi->jobid, |
239 |
tmpBuf); |
240 |
|
241 |
free_mail_info(mi); |
242 |
- free(cmdbuf); |
243 |
- |
244 |
+ free(mailptr); |
245 |
+ close(pipes[0]); |
246 |
+ close(pipes[1]); |
247 |
return(NULL); |
248 |
} |
249 |
+ else if (pid == 0) |
250 |
+ { |
251 |
+ /* CHILD */ |
252 |
|
253 |
- /* Pipe in mail headers: To: and Subject: */ |
254 |
- fprintf(outmail, "To: %s\n", mi->mailto); |
255 |
+ /* Make stdin the read end of the pipe */ |
256 |
+ dup2(pipes[0], 0); |
257 |
|
258 |
- fprintf(outmail, "Subject: "); |
259 |
- svr_format_job(outmail, mi, subjectfmt); |
260 |
- fprintf(outmail, "\n"); |
261 |
+ /* Close the rest of the open file descriptors */ |
262 |
+ int numfds = sysconf(_SC_OPEN_MAX); |
263 |
+ while (--numfds > 0) |
264 |
+ close(numfds); |
265 |
|
266 |
- /* Set "Precedence: bulk" to avoid vacation messages, etc */ |
267 |
- fprintf(outmail, "Precedence: bulk\n\n"); |
268 |
+ execv(SENDMAIL_CMD, sendmail_args); |
269 |
+ /* This never returns, but if the execv fails the child should exit */ |
270 |
+ exit(1); |
271 |
+ } |
272 |
+ else |
273 |
+ { |
274 |
+ /* This is the parent */ |
275 |
|
276 |
- /* Now pipe in the email body */ |
277 |
- svr_format_job(outmail, mi, bodyfmt); |
278 |
+ /* Close the read end of the pipe */ |
279 |
+ close(pipes[0]); |
280 |
|
281 |
- errno = 0; |
282 |
- if ((i = pclose(outmail)) != 0) |
283 |
- { |
284 |
- char tmpBuf[LOG_BUF_SIZE]; |
285 |
+ /* Write the body to the pipe */ |
286 |
+ stream = fdopen(pipes[1], "w"); |
287 |
+ write_email(stream, mi); |
288 |
|
289 |
- snprintf(tmpBuf,sizeof(tmpBuf), |
290 |
- "Email '%c' to %s failed: Child process '%s' %s %d (errno %d:%s)\n", |
291 |
- mi->mail_point, |
292 |
- mi->mailto, |
293 |
- cmdbuf, |
294 |
- ((WIFEXITED(i)) ? ("returned") : ((WIFSIGNALED(i)) ? ("killed by signal") : ("croaked"))), |
295 |
- ((WIFEXITED(i)) ? (WEXITSTATUS(i)) : ((WIFSIGNALED(i)) ? (WTERMSIG(i)) : (i))), |
296 |
- errno, |
297 |
- strerror(errno)); |
298 |
- log_event(PBSEVENT_ERROR | PBSEVENT_ADMIN | PBSEVENT_JOB, |
299 |
- PBS_EVENTCLASS_JOB, |
300 |
- mi->jobid, |
301 |
- tmpBuf); |
302 |
- } |
303 |
- else if (LOGLEVEL >= 4) |
304 |
- { |
305 |
- log_event(PBSEVENT_ERROR | PBSEVENT_ADMIN | PBSEVENT_JOB, |
306 |
- PBS_EVENTCLASS_JOB, |
307 |
- mi->jobid, |
308 |
- "Email sent successfully\n"); |
309 |
- } |
310 |
+ fflush(stream); |
311 |
+ |
312 |
+ /* Close and wait for the command to finish */ |
313 |
+ if (fclose(stream) != 0) |
314 |
+ { |
315 |
+ snprintf(tmpBuf,sizeof(tmpBuf), |
316 |
+ "Piping mail body to sendmail closed: errno %d:%s\n", |
317 |
+ errno, strerror(errno)); |
318 |
+ |
319 |
+ log_event(PBSEVENT_ERROR | PBSEVENT_ADMIN | PBSEVENT_JOB, |
320 |
+ PBS_EVENTCLASS_JOB, |
321 |
+ mi->jobid, |
322 |
+ tmpBuf); |
323 |
+ } |
324 |
+ |
325 |
+ // we aren't going to block in order to find out whether or not sendmail worked |
326 |
+ if ((waitpid(pid, &status, WNOHANG) != 0) && |
327 |
+ (status != 0)) |
328 |
+ { |
329 |
+ snprintf(tmpBuf,sizeof(tmpBuf), |
330 |
+ "Sendmail command returned %d. Mail may not have been sent\n", |
331 |
+ status); |
332 |
+ |
333 |
+ log_event(PBSEVENT_ERROR | PBSEVENT_ADMIN | PBSEVENT_JOB, |
334 |
+ PBS_EVENTCLASS_JOB, |
335 |
+ mi->jobid, |
336 |
+ tmpBuf); |
337 |
+ } |
338 |
|
339 |
- free_mail_info(mi); |
340 |
- free(cmdbuf); |
341 |
+ // don't leave zombies |
342 |
+ while (waitpid(-1, &status, WNOHANG) != 0) |
343 |
+ { |
344 |
+ // zombie reaped, NO-OP |
345 |
+ } |
346 |
+ |
347 |
+ free_mail_info(mi); |
348 |
+ free(mailptr); |
349 |
+ return(NULL); |
350 |
+ } |
351 |
|
352 |
+ /* NOT REACHED */ |
353 |
+ |
354 |
return(NULL); |
355 |
} /* END send_the_mail() */ |
356 |
|
357 |
-- |
358 |
1.8.3.2 |