Fri Nov 4 00:58:00 2022 UTC ()

security/sudo: add fix for CVE-2022-43995

Add patch from upstream to fix CVE-2022-43995.

Bump PKGREVISION.


(taca)

diff -r1.191 -r1.192 pkgsrc/security/sudo/Makefile
diff -r1.123 -r1.124 pkgsrc/security/sudo/distinfo
diff -r0 -r1.1 pkgsrc/security/sudo/patches/patch-plugins_sudoers_auth_passwd.c

--- pkgsrc/security/sudo/Makefile 2022/10/24 10:29:19 1.191
+++ pkgsrc/security/sudo/Makefile 2022/11/04 00:58:00 1.192

 @@ -1,16 +1,17 @@
-# $NetBSD: Makefile,v 1.191 2022/10/24 10:29:19 adam Exp $
+# $NetBSD: Makefile,v 1.192 2022/11/04 00:58:00 taca Exp $
 DISTNAME=	sudo-1.9.12
 PKGREVISION=	1
 CATEGORIES=	security
 MASTER_SITES=	https://www.sudo.ws/dist/
 MASTER_SITES+=	ftp://ftp.sudo.ws/pub/sudo/
 MASTER_SITES+=	ftp://ftp.uwsg.indiana.edu/pub/security/sudo/
 MASTER_SITES+=	http://ftp.twaren.net/Unix/Security/Sudo/
 MASTER_SITES+=	http://ftp.tux.org/pub/security/sudo/
 MAINTAINER=	pkgsrc-users@NetBSD.org
 HOMEPAGE=	https://www.sudo.ws/
 COMMENT=	Allow others to run commands as root
 LICENSE=	isc AND modified-bsd
 USE_LIBTOOL=		yes

--- pkgsrc/security/sudo/distinfo 2022/10/24 10:29:19 1.123
+++ pkgsrc/security/sudo/distinfo 2022/11/04 00:58:00 1.124

 @@ -1,12 +1,13 @@
-$NetBSD: distinfo,v 1.123 2022/10/24 10:29:19 adam Exp $
+$NetBSD: distinfo,v 1.124 2022/11/04 00:58:00 taca Exp $
 BLAKE2s (sudo-1.9.12.tar.gz) = e832414e92c0608e173f8ccb06a1cb8632c3be51b5905580d426b0984b049c0f
 SHA512 (sudo-1.9.12.tar.gz) = 34ee165baa2e37ba2530901d49bf0dad30159f27aeccd2519d4719bf93be8281edff71220a49ba2e41dacaa3c58031de1464df48d75a8caea7b9568a76f80b67
 Size (sudo-1.9.12.tar.gz) = 4906320 bytes
 SHA1 (patch-Makefile.in) = 1a83c55d27829013e2e23073046c5c39b020fafe
 SHA1 (patch-configure) = da1f0d89f7dc5d56734fc69f190189ccdfc8b043
 SHA1 (patch-examples_Makefile.in) = a20967ecd88eb5e4a8b47e6a3b80bc18be713409
 SHA1 (patch-lib_logsrv_Makefile.in) = 301c317c806edeee8ce7b44a5431cd38defb3a54
 SHA1 (patch-lib_protobuf-c_Makefile.in) = 122e432fb0da36b998778a1b71130f0c3785f575
 SHA1 (patch-plugins_sudoers_Makefile.in) = d2981bb9841f6bb4b1c80f5c2f2727fbf9579501
 SHA1 (patch-plugins_sudoers_auth_passwd.c) = 8fc437881e5eedef106037ff746116f8a36889da
 SHA1 (patch-src_Makefile.in) = 0642684c2d4b3a89259f7d27908f5ec8070969ec

$NetBSD: patch-plugins_sudoers_auth_passwd.c,v 1.1 2022/11/04 00:58:00 taca Exp $

Fix CVE-2022-43995 from upstream commit.

--- plugins/sudoers/auth/passwd.c.orig	2022-06-12 18:46:46.000000000 +0000
+++ plugins/sudoers/auth/passwd.c
@@ -63,7 +63,7 @@ sudo_passwd_init(struct passwd *pw, sudo
 int
 sudo_passwd_verify(struct passwd *pw, char *pass, sudo_auth *auth, struct sudo_conv_callback *callback)
 {
-    char sav, *epass;
+    char des_pass[9], *epass;
     char *pw_epasswd = auth->data;
     size_t pw_len;
     int matched = 0;
@@ -75,12 +75,12 @@ sudo_passwd_verify(struct passwd *pw, ch
 
     /*
      * Truncate to 8 chars if standard DES since not all crypt()'s do this.
-     * If this turns out not to be safe we will have to use OS #ifdef's (sigh).
      */
-    sav = pass[8];
     pw_len = strlen(pw_epasswd);
-    if (pw_len == DESLEN || HAS_AGEINFO(pw_epasswd, pw_len))
-	pass[8] = '\0';
+    if (pw_len == DESLEN || HAS_AGEINFO(pw_epasswd, pw_len)) {
+	strlcpy(des_pass, pass, sizeof(des_pass));
+	pass = des_pass;
+    }
 
     /*
      * Normal UN*X password check.
@@ -88,7 +88,6 @@ sudo_passwd_verify(struct passwd *pw, ch
      * only compare the first DESLEN characters in that case.
      */
     epass = (char *) crypt(pass, pw_epasswd);
-    pass[8] = sav;
     if (epass != NULL) {
 	if (HAS_AGEINFO(pw_epasswd, pw_len) && strlen(epass) == DESLEN)
 	    matched = !strncmp(pw_epasswd, epass, DESLEN);