Security: Fix a double-fclose vulnerability in the dataconn function (CVE-2007-6263, #199206)

(Portage version: 2.1.3.19)

4 files changed, 37 insertions, 4 deletions

diff --git a/net-ftp/netkit-ftpd/ChangeLog b/net-ftp/netkit-ftpd/ChangeLog
index 5133c26f65cb..a564bfe43997 100644
--- a/net-ftp/netkit-ftpd/ChangeLog
+++ b/net-ftp/netkit-ftpd/ChangeLog
@@ -1,6 +1,14 @@
 # ChangeLog for net-ftp/netkit-ftpd
-# Copyright 1999-2007 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/net-ftp/netkit-ftpd/ChangeLog,v 1.8 2007/12/30 20:38:31 ulm Exp $
+# Copyright 1999-2008 Gentoo Foundation; Distributed under the GPL v2
+# $Header: /var/cvsroot/gentoo-x86/net-ftp/netkit-ftpd/ChangeLog,v 1.9 2008/01/10 23:51:08 rbu Exp $
+
+*netkit-ftpd-0.17-r7 (10 Jan 2008)
+
+  10 Jan 2008; Robert Buchholz <rbu@gentoo.org>
+  +files/netkit-ftpd-0.17-fclose-CVE-2007-6263.patch,
+  -netkit-ftpd-0.17-r6.ebuild, +netkit-ftpd-0.17-r7.ebuild:
+  Security: Fix a double-fclose vulnerability in the dataconn function
+  (CVE-2007-6263, #199206)
 
 *netkit-ftpd-0.17-r6 (30 Dec 2007)
 
diff --git a/net-ftp/netkit-ftpd/files/digest-netkit-ftpd-0.17-r6 b/net-ftp/netkit-ftpd/files/digest-netkit-ftpd-0.17-r7
index 9c0de1ba222e..9c0de1ba222e 100644
--- a/net-ftp/netkit-ftpd/files/digest-netkit-ftpd-0.17-r6
+++ b/net-ftp/netkit-ftpd/files/digest-netkit-ftpd-0.17-r7
diff --git a/net-ftp/netkit-ftpd/files/netkit-ftpd-0.17-fclose-CVE-2007-6263.patch b/net-ftp/netkit-ftpd/files/netkit-ftpd-0.17-fclose-CVE-2007-6263.patch
new file mode 100644
index 000000000000..5da61aee7343
--- /dev/null
+++ b/net-ftp/netkit-ftpd/files/netkit-ftpd-0.17-fclose-CVE-2007-6263.patch
@@ -0,0 +1,24 @@
+diff -u linux-ftpd-ssl-0.17.18+0.3/ftpd/ftpd.c linux-ftpd-ssl-0.17.18+0.3/ftpd/ftpd.c
+--- linux-ftpd-ssl-0.17.18+0.3/ftpd/ftpd.c
++++ linux-ftpd-ssl-0.17.18+0.3/ftpd/ftpd.c
+@@ -1729,7 +1729,7 @@
+ static FILE * dataconn(const char *name, off_t size, const char *mode, int stou)
+ {
+ 	char sizebuf[32];
+-	FILE *file;
++	FILE *file = NULL;
+ 	int retry = 0, tos;
+ 
+ 	file_size = size;
+@@ -1822,7 +1822,10 @@
+ 				    ERR_error_string(ERR_get_error(),NULL));
+ 			perror_reply(425, errbuf);
+ 			/* abort time methinks ... */
+-			fclose(file);
++			if(file != NULL){
++				fclose(file);
++				file = NULL;
++			}
+ 			return NULL;
+ 		    } else {
+ 			if (ssl_debug_flag) {
diff --git a/net-ftp/netkit-ftpd/netkit-ftpd-0.17-r6.ebuild b/net-ftp/netkit-ftpd/netkit-ftpd-0.17-r7.ebuild
index 068bc031ddba..3d754854d2d2 100644
--- a/net-ftp/netkit-ftpd/netkit-ftpd-0.17-r6.ebuild
+++ b/net-ftp/netkit-ftpd/netkit-ftpd-0.17-r7.ebuild
@@ -1,6 +1,6 @@
-# Copyright 1999-2007 Gentoo Foundation
+# Copyright 1999-2008 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/net-ftp/netkit-ftpd/netkit-ftpd-0.17-r6.ebuild,v 1.1 2007/12/30 20:38:31 ulm Exp $
+# $Header: /var/cvsroot/gentoo-x86/net-ftp/netkit-ftpd/netkit-ftpd-0.17-r7.ebuild,v 1.1 2008/01/10 23:51:08 rbu Exp $
 
 inherit eutils ssl-cert
 
@@ -30,6 +30,7 @@ src_unpack() {
 	epatch "${FILESDIR}"/${P}-shadowfix.patch
 	epatch "${FILESDIR}"/${P}-gcc41.patch
 	epatch "${FILESDIR}"/${P}-setguid.patch
+	epatch "${FILESDIR}"/${P}-fclose-CVE-2007-6263.patch #199206
 }
 
 src_compile() {