Package: geoip Severity: normal Tags: patch Please find attached patch for 1.3.17-1.1 nmu
Regards, Neil
diff -u geoip-1.3.17/debian/changelog geoip-1.3.17/debian/changelog --- geoip-1.3.17/debian/changelog +++ geoip-1.3.17/debian/changelog @@ -1,3 +1,14 @@ +geoip (1.3.17-1.1) unstable; urgency=high + + * Non-maintainer upload by security team. + * Added patch for CVE-2007-0159: libgeoip1: + "GeoIP_update_database_general()" Remote Directory Traversal Vulnerability + (Closes: #406628) + * Removed automatically copying of config.status and config.sub - this + creates a bloated diff for security updates. + + -- Neil McGovern <[EMAIL PROTECTED]> Sat, 27 Jan 2007 10:23:23 +0000 + geoip (1.3.17-1) unstable; urgency=low * The latest upstream version diff -u geoip-1.3.17/debian/rules geoip-1.3.17/debian/rules --- geoip-1.3.17/debian/rules +++ geoip-1.3.17/debian/rules @@ -61,10 +61,10 @@ # Add here commands to clean up after the build process. -$(MAKE) distclean - -test -r /usr/share/misc/config.sub && \ - cp -f /usr/share/misc/config.sub config.sub - -test -r /usr/share/misc/config.guess && \ - cp -f /usr/share/misc/config.guess config.guess +# -test -r /usr/share/misc/config.sub && \ +# cp -f /usr/share/misc/config.sub config.sub +# -test -r /usr/share/misc/config.guess && \ +# cp -f /usr/share/misc/config.guess config.guess dh_clean only in patch2: unchanged: --- geoip-1.3.17.orig/libGeoIP/GeoIPUpdate.c +++ geoip-1.3.17/libGeoIP/GeoIPUpdate.c @@ -90,6 +90,8 @@ return "Invalid userID"; case GEOIP_PRODUCT_ID_INVALID_ERR: return "Invalid product ID or subscription expired"; + case GEOIP_INVALID_SERVER_RESPONSE: + return "Server returned something unexpected"; default: return "no error"; } @@ -418,6 +420,10 @@ buf[offset] = 0; offset = 0; tmpstr = strstr(buf, "\r\n\r\n") + 4; + if (tmpstr[0] == '.' || strchr(tmpstr, '/') != NULL) { + free(buf); + return GEOIP_INVALID_SERVER_RESPONSE; + } geoipfilename = _GeoIP_full_path_to(tmpstr); free(buf); only in patch2: unchanged: --- geoip-1.3.17.orig/libGeoIP/GeoIPUpdate.h +++ geoip-1.3.17/libGeoIP/GeoIPUpdate.h @@ -43,7 +43,8 @@ GEOIP_SANITY_LOOKUP_FAIL = -22, /* Sanity check ip address lookup failed */ GEOIP_RENAME_ERR = -23, /* Rename error while installing db, check errno */ GEOIP_USER_ID_INVALID_ERR = -24, /* Invalid userID */ - GEOIP_PRODUCT_ID_INVALID_ERR = -25 /* Invalid product ID or subscription expired */ + GEOIP_PRODUCT_ID_INVALID_ERR = -25, /* Invalid product ID or subscription expired */ + GEOIP_INVALID_SERVER_RESPONSE = -26 } GeoIPUpdateCode; const char * GeoIP_get_error_message(int i);