tcpdump: security bump to version 4.7.3
authorGustavo Zacarias <gustavo@zacarias.com.ar>
Wed, 11 Mar 2015 13:43:48 +0000 (10:43 -0300)
committerPeter Korsgaard <peter@korsgaard.com>
Wed, 11 Mar 2015 16:08:44 +0000 (17:08 +0100)
Fixes:

CVE-2015-0261 - issues with IPv6 mobility printer.
CVE-2015-2153 - issue with tcp printer.
CVE-2015-2154 - issue with ethernet printer.
CVE-2015-2155 - issue with force printer.

CVE-2014-9140 fix is upstream so patch dropped.
System libpcap upstream as well so dropped.

CVE-2014-8767, CVE-2014-8768 and CVE-2014-8769 don't seem to be upstream
so keep.

And add hash file.

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
package/tcpdump/0001-Use-system-libpcap-when-configured-with-with-system-.patch [deleted file]
package/tcpdump/0005-fix-CVE-2014-9140.patch [deleted file]
package/tcpdump/tcpdump.hash [new file with mode: 0644]
package/tcpdump/tcpdump.mk

diff --git a/package/tcpdump/0001-Use-system-libpcap-when-configured-with-with-system-.patch b/package/tcpdump/0001-Use-system-libpcap-when-configured-with-with-system-.patch
deleted file mode 100644 (file)
index 7f8b715..0000000
+++ /dev/null
@@ -1,78 +0,0 @@
-From 4289e62c7966e5abeb95307717cef30a51fcdccf Mon Sep 17 00:00:00 2001
-From: Baruch Siach <baruch@tkos.co.il>
-Date: Wed, 29 Oct 2014 13:21:05 +0200
-Subject: [PATCH] Use system libpcap when configured with --with-system-pcap
-
-Don't force the local libpcap build when the system provides one. When
---with-system-pcap is given to configure, don't try to locate a local libpcap
-build. This help build systems like Buildroot that store build trees in the
-same directory, but still prefer dynamically linking against system wide
-libpcap.so to save space.
-
-Signed-off-by: Baruch Siach <baruch@tkos.co.il>
----
-Status: sent upstream (https://github.com/the-tcpdump-group/tcpdump/pull/408)
-
- aclocal.m4 | 46 +++++++++++++++++++++++++---------------------
- 1 file changed, 25 insertions(+), 21 deletions(-)
-
-diff --git a/aclocal.m4 b/aclocal.m4
-index 80614cf21050..cd0a94414bbf 100644
---- a/aclocal.m4
-+++ b/aclocal.m4
-@@ -438,27 +438,31 @@ AC_DEFUN(AC_LBL_LIBPCAP,
-                   LIBS="$LIBS $pfopen"
-           fi
-     fi
--    AC_MSG_CHECKING(for local pcap library)
--    libpcap=FAIL
--    lastdir=FAIL
--    places=`ls $srcdir/.. | sed -e 's,/$,,' -e "s,^,$srcdir/../," | \
--      egrep '/libpcap-[[0-9]]+\.[[0-9]]+(\.[[0-9]]*)?([[ab]][[0-9]]*|-PRE-GIT)?$'`
--    places2=`ls .. | sed -e 's,/$,,' -e "s,^,../," | \
--      egrep '/libpcap-[[0-9]]+\.[[0-9]]+(\.[[0-9]]*)?([[ab]][[0-9]]*|-PRE-GIT)?$'`
--    for dir in $places $srcdir/../libpcap ../libpcap $srcdir/libpcap $places2 ; do
--          basedir=`echo $dir | sed -e 's/[[ab]][[0-9]]*$//' | \
--              sed -e 's/-PRE-GIT$//' `
--          if test $lastdir = $basedir ; then
--                  dnl skip alphas when an actual release is present
--                  continue;
--          fi
--          lastdir=$dir
--          if test -r $dir/libpcap.a ; then
--                  libpcap=$dir/libpcap.a
--                  d=$dir
--                  dnl continue and select the last one that exists
--          fi
--    done
-+      libpcap=FAIL
-+      AC_MSG_CHECKING(for local pcap library)
-+      AC_ARG_WITH([system-libpcap],
-+              [AS_HELP_STRING([--with-system-libpcap], [don't use local pcap library])])
-+      if test "x$with_system_libpcap" != xyes ; then
-+              lastdir=FAIL
-+      places=`ls $srcdir/.. | sed -e 's,/$,,' -e "s,^,$srcdir/../," | \
-+              egrep '/libpcap-[[0-9]]+\.[[0-9]]+(\.[[0-9]]*)?([[ab]][[0-9]]*|-PRE-GIT)?$'`
-+      places2=`ls .. | sed -e 's,/$,,' -e "s,^,../," | \
-+              egrep '/libpcap-[[0-9]]+\.[[0-9]]+(\.[[0-9]]*)?([[ab]][[0-9]]*|-PRE-GIT)?$'`
-+      for dir in $places $srcdir/../libpcap ../libpcap $srcdir/libpcap $places2 ; do
-+              basedir=`echo $dir | sed -e 's/[[ab]][[0-9]]*$//' | \
-+                      sed -e 's/-PRE-GIT$//' `
-+              if test $lastdir = $basedir ; then
-+                      dnl skip alphas when an actual release is present
-+                      continue;
-+              fi
-+              lastdir=$dir
-+              if test -r $dir/libpcap.a ; then
-+                      libpcap=$dir/libpcap.a
-+                      d=$dir
-+                      dnl continue and select the last one that exists
-+              fi
-+              done
-+      fi
-     if test $libpcap = FAIL ; then
-           AC_MSG_RESULT(not found)
--- 
-2.1.1
-
diff --git a/package/tcpdump/0005-fix-CVE-2014-9140.patch b/package/tcpdump/0005-fix-CVE-2014-9140.patch
deleted file mode 100644 (file)
index 86365d0..0000000
+++ /dev/null
@@ -1,59 +0,0 @@
-From 0f95d441e4b5d7512cc5c326c8668a120e048eda Mon Sep 17 00:00:00 2001
-From: Guy Harris <guy@alum.mit.edu>
-Date: Wed, 22 Oct 2014 12:31:21 -0700
-Subject: [PATCH] Do bounds checking when unescaping PPP.
-
-Clean up a const issue while we're at it.
-
-Upstream commit 0f95d441e4b5d.
-
-Signed-off-by: Baruch Siach <baruch@tkos.co.il>
----
- print-ppp.c | 16 ++++++++--------
- 1 file changed, 8 insertions(+), 8 deletions(-)
-
-diff --git a/print-ppp.c b/print-ppp.c
-index 8e098f05a953..9a983e6179cd 100644
---- a/print-ppp.c
-+++ b/print-ppp.c
-@@ -1351,14 +1351,15 @@ static void
- ppp_hdlc(netdissect_options *ndo,
-          const u_char *p, int length)
- {
--      u_char *b, *s, *t, c;
-+      u_char *b, *t, c;
-+      const u_char *s;
-       int i, proto;
-       const void *se;
-         if (length <= 0)
-                 return;
--      b = (uint8_t *)malloc(length);
-+      b = (u_char *)malloc(length);
-       if (b == NULL)
-               return;
-@@ -1367,14 +1368,13 @@ ppp_hdlc(netdissect_options *ndo,
-        * Do this so that we dont overwrite the original packet
-        * contents.
-        */
--      for (s = (u_char *)p, t = b, i = length; i > 0; i--) {
-+      for (s = p, t = b, i = length; i > 0 && ND_TTEST(*s); i--) {
-               c = *s++;
-               if (c == 0x7d) {
--                      if (i > 1) {
--                              i--;
--                              c = *s++ ^ 0x20;
--                      } else
--                              continue;
-+                      if (i <= 1 || !ND_TTEST(*s))
-+                              break;
-+                      i--;
-+                      c = *s++ ^ 0x20;
-               }
-               *t++ = c;
-       }
--- 
-2.1.3
-
diff --git a/package/tcpdump/tcpdump.hash b/package/tcpdump/tcpdump.hash
new file mode 100644 (file)
index 0000000..36e1c3b
--- /dev/null
@@ -0,0 +1,2 @@
+# Locally calculated after checking pgp signature
+sha256 1f87fb652ce996d41e7a06c601bc6ea29b13fee922945b23770c29490f1d8ace        tcpdump-4.7.3.tar.gz
index 69eb717c94bb3e8bff5cbe4136aebb600caee851..71b844ab35024c64ac7a59e5d9e73c1fc89ca5b2 100644 (file)
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-TCPDUMP_VERSION = 4.6.2
+TCPDUMP_VERSION = 4.7.3
 TCPDUMP_SITE = http://www.tcpdump.org/release
 TCPDUMP_LICENSE = BSD-3c
 TCPDUMP_LICENSE_FILES = LICENSE
@@ -17,8 +17,6 @@ TCPDUMP_CONF_OPTS = \
        --with-system-libpcap \
        $(if $(BR2_PACKAGE_TCPDUMP_SMB),--enable-smb,--disable-smb)
 TCPDUMP_DEPENDENCIES = zlib libpcap
-# Patching aclocal.m4
-TCPDUMP_AUTORECONF = YES
 
 ifeq ($(BR2_STATIC_LIBS),y)
 TCPDUMP_CONF_OPTS += LIBS="$(shell $(STAGING_DIR)/usr/bin/pcap-config --static --additional-libs)"