Bug#511521: marked as done (boinc: Does not check the RSA_public_decrypt() return value.)
Your message dated Sun, 15 Mar 2009 19:54:19 +
with message-id
and subject line Bug#511521: fixed in boinc 5.4.11-4+etch1
has caused the Debian Bug report #511521,
regarding boinc: Does not check the RSA_public_decrypt() return value.
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)
--
511521: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=511521
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: boinc
Severity: serious
Tags: security
Hi,
I've been checking packages to see if they properly check the return
value of some of the functions in openssl. In lib/crypt.C there
is this code:
int decrypt_public(R_RSA_PUBLIC_KEY& key, DATA_BLOCK& in, DATA_BLOCK& out) {
RSA* rp = RSA_new();
public_to_openssl(key, rp);
RSA_public_decrypt(in.len, in.data, out.data, rp, RSA_PKCS1_PADDING);
out.len = RSA_size(rp);
return 0;
}
So it's not checking the return value of RSA_public_decrypt() which
returns the the size of the recovered message digest on success
and -1 on failure.
I have no idea if this code is being used and what the consequences
of this might be.
Kurt
--- End Message ---
--- Begin Message ---
Source: boinc
Source-Version: 5.4.11-4+etch1
We believe that the bug you reported is fixed in the latest version of
boinc, which is due to be installed in the Debian FTP archive:
boinc-client_5.4.11-4+etch1_i386.deb
to pool/main/b/boinc/boinc-client_5.4.11-4+etch1_i386.deb
boinc-dev_5.4.11-4+etch1_i386.deb
to pool/main/b/boinc/boinc-dev_5.4.11-4+etch1_i386.deb
boinc-manager_5.4.11-4+etch1_i386.deb
to pool/main/b/boinc/boinc-manager_5.4.11-4+etch1_i386.deb
boinc_5.4.11-4+etch1.diff.gz
to pool/main/b/boinc/boinc_5.4.11-4+etch1.diff.gz
boinc_5.4.11-4+etch1.dsc
to pool/main/b/boinc/boinc_5.4.11-4+etch1.dsc
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 511...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
(supplier of updated boinc package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@debian.org)
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Format: 1.7
Date: Fri, 6 Feb 2009 20:15:22 -0600
Source: boinc
Binary: boinc-manager boinc-dev boinc-client
Architecture: source i386
Version: 5.4.11-4+etch1
Distribution: stable-security
Urgency: high
Maintainer: Debian BOINC Maintainers
Changed-By:
Description:
boinc-client - core client for the BOINC distributed computing infrastructure
boinc-dev - development files to build applications for BOINC projects
boinc-manager - GUI to control and monitor the BOINC core client
Closes: 511521
Changes:
boinc (5.4.11-4+etch1) stable-security; urgency=high
.
* Correction for CVE-2009-0126 misuses the OpenSSL api
on decrypt_public function in lib/crypt.cpp, Closes: #511521
* add myslef to uploaders
Files:
2d007ac10e6c4033363f8b0978ecfdfa 1174 net optional boinc_5.4.11-4+etch1.dsc
268c8f6f19d5def378e7d2fbacc2d4eb 5561690 net optional boinc_5.4.11.orig.tar.gz
8bf8d8b4fd9a7bb3963f1af4b3a6f6e0 42159 net optional
boinc_5.4.11-4+etch1.diff.gz
935dd3f2c5c51d66dd77c698253458af 340560 net optional
boinc-client_5.4.11-4+etch1_i386.deb
7bc3304531f57ac1e667fba68fe16cd0 747016 x11 optional
boinc-manager_5.4.11-4+etch1_i386.deb
be5f9b3f94890248963a8fdbc9471251 402674 devel optional
boinc-dev_5.4.11-4+etch1_i386.deb
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.9 (GNU/Linux)
iEYEARECAAYFAkmOtGQACgkQXm3vHE4uyloFsQCgnfpiBgsxzbreQJNsNdAZ0iMc
9QIAnRnrcw2SXbn5CNM/QQn+0P3kgf1J
=44/P
-END PGP SIGNATURE-
--- End Message ---
Bug#511521: marked as done (boinc: Does not check the RSA_public_decrypt() return value.)
Your message dated Mon, 19 Jan 2009 04:17:06 +
with message-id
and subject line Bug#511521: fixed in boinc 6.2.14-3
has caused the Debian Bug report #511521,
regarding boinc: Does not check the RSA_public_decrypt() return value.
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)
--
511521: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=511521
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: boinc
Severity: serious
Tags: security
Hi,
I've been checking packages to see if they properly check the return
value of some of the functions in openssl. In lib/crypt.C there
is this code:
int decrypt_public(R_RSA_PUBLIC_KEY& key, DATA_BLOCK& in, DATA_BLOCK& out) {
RSA* rp = RSA_new();
public_to_openssl(key, rp);
RSA_public_decrypt(in.len, in.data, out.data, rp, RSA_PKCS1_PADDING);
out.len = RSA_size(rp);
return 0;
}
So it's not checking the return value of RSA_public_decrypt() which
returns the the size of the recovered message digest on success
and -1 on failure.
I have no idea if this code is being used and what the consequences
of this might be.
Kurt
--- End Message ---
--- Begin Message ---
Source: boinc
Source-Version: 6.2.14-3
We believe that the bug you reported is fixed in the latest version of
boinc, which is due to be installed in the Debian FTP archive:
boinc-client_6.2.14-3_i386.deb
to pool/main/b/boinc/boinc-client_6.2.14-3_i386.deb
boinc-dbg_6.2.14-3_i386.deb
to pool/main/b/boinc/boinc-dbg_6.2.14-3_i386.deb
boinc-dev_6.2.14-3_i386.deb
to pool/main/b/boinc/boinc-dev_6.2.14-3_i386.deb
boinc-manager_6.2.14-3_i386.deb
to pool/main/b/boinc/boinc-manager_6.2.14-3_i386.deb
boinc_6.2.14-3.diff.gz
to pool/main/b/boinc/boinc_6.2.14-3.diff.gz
boinc_6.2.14-3.dsc
to pool/main/b/boinc/boinc_6.2.14-3.dsc
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 511...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Rene Mayorga (supplier of updated boinc package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@debian.org)
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Format: 1.8
Date: Tue, 13 Jan 2009 14:05:38 -0600
Source: boinc
Binary: boinc-client boinc-manager boinc-dev boinc-dbg
Architecture: source i386
Version: 6.2.14-3
Distribution: unstable
Urgency: low
Maintainer: Debian BOINC Maintainers
Changed-By: Rene Mayorga
Description:
boinc-client - core client for the BOINC distributed computing infrastructure
boinc-dbg - debugging symbols for BOINC binaries
boinc-dev - development files to build applications for BOINC projects
boinc-manager - GUI to control and monitor the BOINC core client
Closes: 511521
Changes:
boinc (6.2.14-3) unstable; urgency=low
.
* Add debian/patches/101_check_RSA_returned_values.patch
Check the returned values for RSA_public_decrypt and
RSA_private_encrypt functions. Change ported by upstream changeset 16883
(http://boinc.berkeley.edu/trac/changeset/16883) Closes: #511521
* debian/patches
001_dont_install_ca-bundle.crt.patch and
002_remove_hardcoded_optimization.patch Refreshed
* debian/control - add myself to uploaders
Checksums-Sha1:
9c3d6eadb61b3f89c967fd51d266e0b39c6e2317 1650 boinc_6.2.14-3.dsc
3ca3b3f6916cc652c92c3738a53c4e72d6427a4d 110051 boinc_6.2.14-3.diff.gz
9fecd7a1addca6d9391757f05aa360317b3e1b6a 385642 boinc-client_6.2.14-3_i386.deb
7b8b0109d297c24990d91f53b840c2fdc390d42a 1802676
boinc-manager_6.2.14-3_i386.deb
95ce435db4bf85fa4218831d7c69aea6520f4128 369820 boinc-dev_6.2.14-3_i386.deb
38b4f7b41ae48143ec8d8a3a702d8f27b2cd386b 6766612 boinc-dbg_6.2.14-3_i386.deb
Checksums-Sha256:
a4ca6afe64db0bf3b397646604b264cae1dafcc354d2389795af859856b48619 1650
boinc_6.2.14-3.dsc
5f266582de65200646f63c6827ce10105c5992317e08ef47ceafde18471ab65a 110051
boinc_6.2.14-3.diff.gz
4383eb88ca792e7f8f97e07e1ab4ecc59e370865315ee90060ff9576d7cfbbca 385642
boinc-client_6.2.14-3_i386.deb
3a5b6b04765ff6e8f6fca437639e373152f3658f0ad95d2356b985c1698ccda2 1802676
boinc-manager_6.2.14-3_i386.deb
518ed74e994bb420915933843ab0fceba1d3dc570a98d3ca30221776c8137cdf 369820
boinc-dev_6.2.14-3_i386.deb
5edf8382e44e397ca91586cbd297a6b299633edd0c711509c15180738e07f88c 6766612
boinc-dbg_6.2.14-3_i386.deb
Files:
51b11c2cb665911096b79ce47b790178
