CVE-2011-4405

Debian Bug report logs - #651204
CVE-2011-4405

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <muehlenhoff@univention.de>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: CVE-2011-4405

Date: Tue, 06 Dec 2011 18:47:36 +0100

Package: system-config-printer
Severity: grave
Tags: security

There has been an Ubuntu Security Update for system-config-printer:
http://www.ubuntu.com/usn/USN-1265-1/

I'm not sure if that's actually Ubuntu-specific, could you double-check?

Cheers,
        Moritz

Message #10 received at 651204@bugs.debian.org (full text, mbox, reply):

From: Josselin Mouette <joss@debian.org>

To: Moritz Muehlenhoff <muehlenhoff@univention.de>, 651204@bugs.debian.org

Subject: Re: Bug#651204: CVE-2011-4405

Date: Tue, 06 Dec 2011 19:04:37 +0100

Le mardi 06 décembre 2011 à 18:47 +0100, Moritz Muehlenhoff a écrit : 
> Package: system-config-printer
> Severity: grave
> Tags: security
> 
> There has been an Ubuntu Security Update for system-config-printer:
> http://www.ubuntu.com/usn/USN-1265-1/
> 
> I'm not sure if that's actually Ubuntu-specific, could you double-check?

At first sight it looks like the version in squeeze is vulnerable too,
but Ubuntu marked the same version as “not affected”. Maybe this code
path is never called, but it doesn’t look so.

-- 
 .''`.      Josselin Mouette
: :' :
`. `'
  `-

Message #13 received at 651204-submitter@bugs.debian.org (full text, mbox, reply):

From: Guido Günther <agx@sigxcpu.org>

To: 651204-submitter@bugs.debian.org

Subject: 1.3.7-1 in experimental

Date: Wed, 14 Dec 2011 09:19:52 +0100

Hi,
I've uploaded a patched version to experimental.
Cheers,
 -- Guido

Message #18 received at 651204@bugs.debian.org (full text, mbox, reply):

From: "Thijs Kinkhorst" <thijs@debian.org>

To: 651204@bugs.debian.org

Cc: control@bugs.debian.org

Subject: CVE-2011-4405 fixed in wheezy, not in squeeze

Date: Wed, 30 May 2012 11:47:05 +0200

bts found 651204 1.2.3-3
bts fixed 651204 1.3.7-1
thanks


Hi,

Wheezy and sid contain a patch for this issue. Squeeze seems still
affected. Are you able to provide an updated package for squeeze?


cheers,
Thijs

Message #29 received at 651204@bugs.debian.org (full text, mbox, reply):

From: "Didier 'OdyX' Raboud" <odyx@debian.org>

To: 651204@bugs.debian.org

Cc: "Thijs Kinkhorst" <thijs@debian.org>

Subject: Re: CVE-2011-4405 fixed in wheezy, not in squeeze

Date: Tue, 24 Jul 2012 10:09:27 +0200

[Message part 1 (text/plain, inline)]

tags 651204 +patch
thanks

Le mercredi, 30 mai 2012 11.47:05, Thijs Kinkhorst a écrit :
> Hi,
> 
> Wheezy and sid contain a patch for this issue. Squeeze seems still
> affected. Are you able to provide an updated package for squeeze?

Would the attached patch do the job for Squeeze?

OdyX

[0008-Fix-MITM-via-unencrypted-metadata-download.patch (text/x-patch, attachment)]

[signature.asc (application/pgp-signature, inline)]

Message #34 received at 651204@bugs.debian.org (full text, mbox, reply):

From: Guido Günther <agx@sigxcpu.org>

To: Didier 'OdyX' Raboud <odyx@debian.org>, 651204@bugs.debian.org

Cc: Thijs Kinkhorst <thijs@debian.org>

Subject: Re: Bug#651204: CVE-2011-4405 fixed in wheezy, not in squeeze

Date: Tue, 24 Jul 2012 12:43:29 +0200

On Tue, Jul 24, 2012 at 10:09:27AM +0200, Didier 'OdyX' Raboud wrote:
> tags 651204 +patch
> thanks
> 
> Le mercredi, 30 mai 2012 11.47:05, Thijs Kinkhorst a écrit :
> > Hi,
> > 
> > Wheezy and sid contain a patch for this issue. Squeeze seems still
> > affected. Are you able to provide an updated package for squeeze?
> 
> Would the attached patch do the job for Squeeze?

It looks good to me. I didn't get around to implement something similar
since ages since I didn't have a test system to run this on. Could you
test this on a Squeeze box? If so I'd be happy about an NMU.
Cheers,
 -- Guido

> 
> OdyX

> From: Till Kamppeter <till.kamppeter@gmail.com>
> Date: Tue, 13 Dec 2011 20:54:26 +0100
> Subject: Fix MITM via unencrypted metadata download
> 
> Adapted to Squeeze by Didier Raboud <odyx@debian.org> on Tue Jul 24 10:09:16 CEST 2012.
> 
> Closes: #651204
> ---
>  cupshelpers/openprinting.py |   35 +++++++++++++++++++++++------------
>  1 files changed, 23 insertions(+), 12 deletions(-)
> 
> --- a/cupshelpers/openprinting.py
> +++ b/cupshelpers/openprinting.py
> @@ -19,7 +19,7 @@
>  ## along with this program; if not, write to the Free Software
>  ## Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
>  
> -import urllib, httplib, platform, threading, tempfile, traceback
> +import pycurl,urllib, httplib, platform, threading, tempfile, traceback
>  import os, sys
>  from xml.etree.ElementTree import XML
>  from . import Device
> @@ -42,10 +42,18 @@
>          self.parameters = parameters
>          self.callback = callback
>          self.user_data = user_data
> +        self.result = ""
>  
>          self.setDaemon (True)
>  
>      def run (self):
> +
> +        # Callback function for pycURL collecting the data coming from
> +        # the web server
> +        def collect_data(result):
> +            self.result += result;
> +            return len(result)
> +
>          # CGI script to be executed
>          query_command = "/query.cgi"
>          # Headers for the post request
> @@ -55,26 +63,26 @@
>                    (urllib.urlencode (self.parameters),
>                     self.parent.language[0],
>                     self.parent.language[0]))
> -        self.url = "http://%s%s?%s" % (self.parent.base_url, query_command, params)
> +        self.url = "https://%s%s?%s" % (self.parent.base_url, query_command, params)
>          # Send request
> -        result = None
> +        self.result = ""
>          status = 1
>          try:
> -            conn = httplib.HTTPConnection(self.parent.base_url)
> -            conn.request("POST", query_command, params, headers)
> -            resp = conn.getresponse()
> -            status = resp.status
> -            if status == 200:
> -                result = resp.read()
> -            conn.close()
> +            curl = pycurl.Curl()
> +            curl.setopt(pycurl.SSL_VERIFYPEER, 1)
> +            curl.setopt(pycurl.SSL_VERIFYHOST, 2)
> +            curl.setopt(pycurl.WRITEFUNCTION, collect_data)
> +            curl.setopt(pycurl.URL, self.url)
> +            status = curl.perform()
> +            if status == None: status = 0
> +            if (status != 0):
> +                self.result = sys.exc_info ()
>          except:
> -            result = sys.exc_info ()
> -
> -        if status == 200:
> -            status = 0
> +            self.result = sys.exc_info ()
> +            if status == None: status = 0
>  
>          if self.callback != None:
> -            self.callback (status, self.user_data, result)
> +            self.callback (status, self.user_data, self.result)
>  
>  class OpenPrinting:
>      def __init__(self, language=None):

Send a report that this bug log contains spam.