- rel 6; SECURITY FIX for http://seclists.org/fulldisclosure/2010/Oct/257 from fedora

Changed files:
    glibc-origin.patch -> 1.1
    glibc.spec -> 1.882

diff --git a/glibc-origin.patch b/glibc-origin.patch
new file mode 100644 (file)
index 0000000..215b224
--- /dev/null
+++ b/glibc-origin.patch
@@ -0,0 +1,76 @@
+;2010-10-18  Andreas Schwab  <schwab@redhat.com>
+;
+;      * elf/dl-load.c (is_dst): Remove last parameter.
+;      (_dl_dst_count): Ignore $ORIGIN in privileged programs.
+;      (_dl_dst_substitute): Likewise.
+--- glibc-2.12.1-7-gfc0ed7b/elf/dl-load.c
++++ glibc-2.12.1-3/elf/dl-load.c
+@@ -169,8 +169,7 @@ local_strdup (const char *s)
+ 
+ 
+ static size_t
+-is_dst (const char *start, const char *name, const char *str,
+-      int is_path, int secure)
++is_dst (const char *start, const char *name, const char *str, int is_path)
+ {
+   size_t len;
+   bool is_curly = false;
+@@ -199,11 +198,6 @@ is_dst (const char *start, const char *name, const char *str,
+          && (!is_path || name[len] != ':'))
+     return 0;
+ 
+-  if (__builtin_expect (secure, 0)
+-      && ((name[len] != '\0' && (!is_path || name[len] != ':'))
+-        || (name != start + 1 && (!is_path || name[-2] != ':'))))
+-    return 0;
+-
+   return len;
+ }
+ 
+@@ -218,13 +212,12 @@ _dl_dst_count (const char *name, int is_path)
+     {
+       size_t len;
+ 
+-      /* $ORIGIN is not expanded for SUID/GUID programs (except if it
+-       is $ORIGIN alone) and it must always appear first in path.  */
++      /* $ORIGIN is not expanded for SUID/GUID programs.  */
+       ++name;
+-      if ((len = is_dst (start, name, "ORIGIN", is_path,
+-                       INTUSE(__libc_enable_secure))) != 0
+-        || (len = is_dst (start, name, "PLATFORM", is_path, 0)) != 0
+-        || (len = is_dst (start, name, "LIB", is_path, 0)) != 0)
++      if (((len = is_dst (start, name, "ORIGIN", is_path)) != 0
++         && !INTUSE(__libc_enable_secure))
++        || (len = is_dst (start, name, "PLATFORM", is_path)) != 0
++        || (len = is_dst (start, name, "LIB", is_path)) != 0)
+       ++cnt;
+ 
+       name = strchr (name + len, '$');
+@@ -256,9 +249,12 @@ _dl_dst_substitute (struct link_map *l, const char *name, char *result,
+         size_t len;
+ 
+         ++name;
+-        if ((len = is_dst (start, name, "ORIGIN", is_path,
+-                           INTUSE(__libc_enable_secure))) != 0)
++        if ((len = is_dst (start, name, "ORIGIN", is_path)) != 0)
+           {
++            /* Ignore this path element in SUID/SGID programs.  */
++            if (INTUSE(__libc_enable_secure))
++              repl = (const char *) -1;
++            else
+ #ifndef SHARED
+             if (l == NULL)
+               repl = _dl_get_origin ();
+@@ -266,9 +262,9 @@ _dl_dst_substitute (struct link_map *l, const char *name, char *result,
+ #endif
+               repl = l->l_origin;
+           }
+-        else if ((len = is_dst (start, name, "PLATFORM", is_path, 0)) != 0)
++        else if ((len = is_dst (start, name, "PLATFORM", is_path)) != 0)
+           repl = GLRO(dl_platform);
+-        else if ((len = is_dst (start, name, "LIB", is_path, 0)) != 0)
++        else if ((len = is_dst (start, name, "LIB", is_path)) != 0)
+           repl = DL_DST_LIB;
+ 
+         if (repl != NULL && repl != (const char *) -1)
+

diff --git a/glibc.spec b/glibc.spec
index aad4571e043769cd93af728de598661bd4b30cd3..108d45180886edf59867ac4aaa44037a8776036c 100644 (file)
--- a/glibc.spec
+++ b/glibc.spec
@@ -34,7 +34,7 @@ Summary(tr.UTF-8):    GNU libc
 Summary(uk.UTF-8):     GNU libc версії
 Name:          glibc
 Version:       2.12.1
-Release:       5
+Release:       6
 Epoch:         6
 License:       LGPL v2.1+
 Group:         Libraries
@@ -77,6 +77,7 @@ Patch27:      %{name}-i686.patch
 Patch29:       %{name}-arm-alignment-fix.patch
 Patch30:       %{name}-static-glro-init.patch
 Patch31:       %{name}-newmake.patch
+Patch32:       %{name}-origin.patch
 URL:           http://www.gnu.org/software/libc/
 %{?with_selinux:BuildRequires: audit-libs-devel}
 BuildRequires: autoconf
@@ -924,6 +925,7 @@ mv %{name}-ports-%{ports_version} ports
 %patch29 -p1
 %patch30 -p1
 %patch31 -p1
+%patch32 -p1
 
 # cleanup backups after patching
 find '(' -name '*~' -o -name '*.orig' ')' -print0 | xargs -0 -r -l512 rm -f