+exim4 (4.92-8+deb10u4) buster-security; urgency=high
+
+ * Fix authentication bypass in SPA authenticator due to out-of-bound buffer
+ read. https://bugs.exim.org/show_bug.cgi?id=2571 CVE-2020-12783
+
+ -- Andreas Metzler <ametzler@debian.org> Wed, 13 May 2020 18:01:31 +0200
+
exim4 (4.92-8+deb10u3) buster-security; urgency=high
* 78_02-Fix-buffer-overflow-in-string_vformat.-Bug-2449.patch:
--- /dev/null
+From 6a7edbf6608d10ef0c707c426511e667849518d7 Mon Sep 17 00:00:00 2001
+From: Jeremy Harris <jgh146exb@wizmail.org>
+Date: Tue, 5 May 2020 21:15:34 +0100
+Subject: [PATCH 1/2] Fix SPA authenticator, checking client-supplied data
+ before using it. Bug 2571
+
+(cherry picked from commit 57aa14b216432be381b6295c312065b2fd034f86)
+---
+ doc/ChangeLog | 5 +++++
+ src/auths/spa.c | 22 ++++++++++++++++------
+ 2 files changed, 21 insertions(+), 6 deletions(-)
+
+--- a/doc/ChangeLog
++++ b/doc/ChangeLog
+@@ -62,6 +62,11 @@ JH/28 Fix the timeout on smtp response t
+ [from GIT master]
+
+
++JH/41 Bug 2571: Fix SPA authenticator. Running as a server, an offset supplied
++ by the client was not checked as pointing within response data before
++ being used. A malicious client could thus cause an out-of-bounds read and
++ possibly gain authentication. Fix by adding the check.
++
+
+ Exim version 4.92
+ -----------------
+--- a/src/auths/spa.c
++++ b/src/auths/spa.c
+@@ -139,7 +139,7 @@ SPAAuthChallenge challenge;
+ SPAAuthResponse response;
+ SPAAuthResponse *responseptr = &response;
+ uschar msgbuf[2048];
+-uschar *clearpass;
++uschar *clearpass, *s;
+
+ /* send a 334, MS Exchange style, and grab the client's request,
+ unless we already have it via an initial response. */
+@@ -197,6 +197,13 @@ that causes failure if the size of msgbu
+ char *p = ((char*)responseptr) + IVAL(&responseptr->uUser.offset,0);
+ int len = SVAL(&responseptr->uUser.len,0)/2;
+
++ if (p + len*2 >= CS (responseptr+1))
++ {
++ DEBUG(D_auth)
++ debug_printf("auth_spa_server(): bad uUser spec in response\n");
++ return FAIL;
++ }
++
+ if (len + 1 >= sizeof(msgbuf)) return FAIL;
+ for (i = 0; i < len; ++i)
+ {
+@@ -245,14 +252,17 @@ spa_smb_nt_encrypt (clearpass, challenge
+
+ /* compare NT hash (LM may not be available) */
+
+-if (memcmp(ntRespData,
+- ((unsigned char*)responseptr)+IVAL(&responseptr->ntResponse.offset,0),
+- 24) == 0)
+- /* success. we have a winner. */
++s = (US responseptr) + IVAL(&responseptr->ntResponse.offset,0);
++if (s + 24 >= US (responseptr+1))
+ {
+- return auth_check_serv_cond(ablock);
++ DEBUG(D_auth)
++ debug_printf("auth_spa_server(): bad ntRespData spec in response\n");
++ return FAIL;
+ }
+
++if (memcmp(ntRespData, s, 24) == 0)
++ return auth_check_serv_cond(ablock); /* success. we have a winner. */
++
+ /* Expand server_condition as an authorization check (PH) */
+
+ return FAIL;
--- /dev/null
+From 5a41d2c2cd2b28a0d1aea21edeaea02bd6db4984 Mon Sep 17 00:00:00 2001
+From: Jeremy Harris <jgh146exb@wizmail.org>
+Date: Wed, 6 May 2020 22:31:25 +0100
+Subject: [PATCH 2/2] Rework SPA fix to avoid overflows. Bug 2571
+
+Amends: 6a7edbf660
+(cherry picked from commit a04174dc2a84ae1008c23b6a7109e7fa3fb7b8b0)
+---
+ src/auths/spa.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/src/auths/spa.c b/src/auths/spa.c
+index ed9aff23b..4e3aef808 100644
+--- a/src/auths/spa.c
++++ b/src/auths/spa.c
+@@ -140,6 +140,7 @@ SPAAuthResponse response;
+ SPAAuthResponse *responseptr = &response;
+ uschar msgbuf[2048];
+ uschar *clearpass, *s;
++unsigned off;
+
+ /* send a 334, MS Exchange style, and grab the client's request,
+ unless we already have it via an initial response. */
+@@ -194,10 +195,13 @@ that causes failure if the size of msgbuf is exceeded. ****/
+
+ {
+ int i;
+- char *p = ((char*)responseptr) + IVAL(&responseptr->uUser.offset,0);
++ char * p;
+ int len = SVAL(&responseptr->uUser.len,0)/2;
+
+- if (p + len*2 >= CS (responseptr+1))
++ if ( (off = IVAL(&responseptr->uUser.offset,0)) >= sizeof(SPAAuthResponse)
++ || len >= sizeof(responseptr->buffer)/2
++ || (p = (CS responseptr) + off) + len*2 >= CS (responseptr+1)
++ )
+ {
+ DEBUG(D_auth)
+ debug_printf("auth_spa_server(): bad uUser spec in response\n");
+@@ -252,13 +256,14 @@ spa_smb_nt_encrypt (clearpass, challenge.challengeData, ntRespData);
+
+ /* compare NT hash (LM may not be available) */
+
+-s = (US responseptr) + IVAL(&responseptr->ntResponse.offset,0);
+-if (s + 24 >= US (responseptr+1))
++off = IVAL(&responseptr->ntResponse.offset,0);
++if (off >= sizeof(SPAAuthResponse) - 24)
+ {
+ DEBUG(D_auth)
+ debug_printf("auth_spa_server(): bad ntRespData spec in response\n");
+ return FAIL;
+ }
++s = (US responseptr) + off;
+
+ if (memcmp(ntRespData, s, 24) == 0)
+ return auth_check_serv_cond(ablock); /* success. we have a winner. */
+--
+2.26.2
+
77_Avoid-re-expansion-in-sort-CVE-2019-13917-OVE-201907.patch
78_01-string.c-do-not-interpret-before-0-CVE-2019-15846.patch
78_02-Fix-buffer-overflow-in-string_vformat.-Bug-2449.patch
+79_01-Fix-SPA-authenticator-checking-client-supplied-data-.patch
+79_02-Rework-SPA-fix-to-avoid-overflows.-Bug-2571.patch
90_localscan_dlopen.dpatch
HCoop / hcoop / debian / exim4.git / commitdiff