Hi, attached is a patch fixing this issue. It will be also archived on: http://people.debian.org/~nion/nmu-diff/mt-daapd-0.9~r1696-1.2_0.9~r1696-1.3.patch
Kind regards Nico -- Nico Golde - http://www.ngolde.de - [EMAIL PROTECTED] - GPG: 0x73647CFF For security reasons, all text in this mail is double-rot13 encrypted.
diff -u mt-daapd-0.9~r1696/debian/patches/00list mt-daapd-0.9~r1696/debian/patches/00list --- mt-daapd-0.9~r1696/debian/patches/00list +++ mt-daapd-0.9~r1696/debian/patches/00list @@ -1,0 +2 @@ +02_CVE-2008-1771 diff -u mt-daapd-0.9~r1696/debian/changelog mt-daapd-0.9~r1696/debian/changelog --- mt-daapd-0.9~r1696/debian/changelog +++ mt-daapd-0.9~r1696/debian/changelog @@ -1,3 +1,12 @@ +mt-daapd (0.9~r1696-1.3) unstable; urgency=high + + * Non-maintainer upload by the Security Team. + * Fix integer overflow leading to heap-based buffer overflow causing a + remote Denial of Service and possibly allows to execute arbitrary code + (CVE-2008-1771; Closes: #476241). + + -- Nico Golde <[EMAIL PROTECTED]> Thu, 17 Apr 2008 19:03:48 +0200 + mt-daapd (0.9~r1696-1.2) unstable; urgency=low * Non-maintainer upload. --- mt-daapd-0.9~r1696.orig/debian/patches/02_CVE-2008-1771.dpatch +++ mt-daapd-0.9~r1696/debian/patches/02_CVE-2008-1771.dpatch @@ -0,0 +1,24 @@ +#! /bin/sh /usr/share/dpatch/dpatch-run +## 02_CVE-2008-1771.dpatch by Nico Golde <[EMAIL PROTECTED]> +## +## All lines beginning with `## DP:' are a description of the patch. +## DP: No description. + [EMAIL PROTECTED]@ +diff -urNad mt-daapd-0.9~r1696~/src/webserver.c mt-daapd-0.9~r1696/src/webserver.c +--- mt-daapd-0.9~r1696~/src/webserver.c 2007-10-22 05:40:29.000000000 +0200 ++++ mt-daapd-0.9~r1696/src/webserver.c 2008-04-17 19:01:56.000000000 +0200 +@@ -719,7 +719,12 @@ + return FALSE; + } + +- length=atoi(content_length); ++ length=strtol(content_length, NULL, 10); ++ if(EINVAL == errno || UINT_MAX - 1 <= length){ ++ ws_dprintf(L_WS_WARN, "Thread %d: Suspicious Content-Length value, ignoring request\n", pwsc->threadno); ++ return FALSE; ++ } ++ + ws_dprintf(L_WS_DBG,"Thread %d: Post var length: %d\n", + pwsc->threadno,length); +
pgp1G3b235lo7.pgp
Description: PGP signature