diff options
Diffstat (limited to 'print')
-rw-r--r-- | print/hplip/files/patch-CVE-2008-2940 | 74 | ||||
-rw-r--r-- | print/hplip/files/patch-CVE-2008-2941 | 210 | ||||
-rw-r--r-- | print/hplip3/files/patch-CVE-2008-2940 | 74 | ||||
-rw-r--r-- | print/hplip3/files/patch-CVE-2008-2941 | 210 |
4 files changed, 568 insertions, 0 deletions
diff --git a/print/hplip/files/patch-CVE-2008-2940 b/print/hplip/files/patch-CVE-2008-2940 new file mode 100644 index 000000000000..dbe14fa417e8 --- /dev/null +++ b/print/hplip/files/patch-CVE-2008-2940 @@ -0,0 +1,74 @@ +Patch for CVE-2008-2940 + +Please note that alerts are now system-wide and they live in +/etc/hp/alerts.conf + +See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2940 +Obtained from: https://bugzilla.redhat.com/attachment.cgi?id=312878 +Obtained from: https://bugzilla.redhat.com/attachment.cgi?id=312880 + +diff -up hplip-1.6.7/hpssd.py.validate-uri hplip-1.6.7/hpssd.py +--- hpssd.py.validate-uri 2008-07-29 12:48:28.000000000 +0100 ++++ hpssd.py 2008-07-29 13:41:29.000000000 +0100 +@@ -1021,6 +1021,9 @@ class hpssd_handler(dispatcher): + event_type = self.fields.get('event-type', 'event') + event_code = self.fields.get('event-code', 0) + device_uri = self.fields.get('device-uri', '').replace('hpfax:', 'hp:') ++ result_code = self.__checkdevice(device_uri) ++ if result_code != ERROR_SUCCESS: ++ return + log.debug("Device URI: %s" % device_uri) + + try: +diff -up hplip-1.6.7/base/g.py.static-alerts-table hplip-1.6.7/base/g.py +--- base/g.py.orig 2008-01-18 02:10:29.000000000 +0300 ++++ base/g.py 2008-11-23 22:39:11.000000000 +0300 +@@ -134,6 +134,7 @@ + # Config file: directories and ports + prop.sys_config_file = '/etc/hp/hplip.conf' + prop.user_dir = os.path.expanduser('~/.hplip') ++prop.alerts_config_file = '/etc/hp/alerts.conf' + + os.umask(0037) + try: +@@ -154,6 +155,7 @@ + + sys_cfg = Config(prop.sys_config_file, True) + user_cfg = Config(prop.user_config_file) ++alerts_cfg = Config(prop.alerts_config_file) + + + # Language settings +diff -up hplip-1.6.7/hpssd.py.static-alerts-table hplip-1.6.7/hpssd.py +--- hpssd.py.static-alerts-table 2008-07-29 14:57:04.000000000 +0100 ++++ hpssd.py 2008-07-29 15:22:15.000000000 +0100 +@@ -71,6 +71,12 @@ from prnt import cups + + # Per user alert settings + alerts = {} ++for user, cfg in alerts_cfg.iteritems (): ++ entry = {} ++ entry['email-alerts'] = utils.to_bool (cfg.get('email-alerts', 0)) ++ entry['email-from-address'] = cfg.get('email-from-address', '') ++ entry['email-to-addresses'] = cfg.get('email-to-addresses', '') ++ alerts[user] = entry + + # Fax temp files + fax_file = {} +@@ -803,15 +809,10 @@ class hpssd_handler(dispatcher): + self.out_buffer = buildResultMessage('InjectValueResult', None, result_code) + + +- # TODO: Need to load alerts at start-up + def handle_setalerts(self): + result_code = ERROR_SUCCESS +- username = self.fields.get('username', '') + +- alerts[username] = {'email-alerts' : utils.to_bool(self.fields.get('email-alerts', '0')), +- 'email-from-address' : self.fields.get('email-from-address', ''), +- 'email-to-addresses' : self.fields.get('email-to-addresses', ''), +- } ++ # Do nothing. We use the alerts table in /etc/hp/alerts.conf. + + self.out_buffer = buildResultMessage('SetAlertsResult', None, result_code) + diff --git a/print/hplip/files/patch-CVE-2008-2941 b/print/hplip/files/patch-CVE-2008-2941 new file mode 100644 index 000000000000..f4bb8ee06caa --- /dev/null +++ b/print/hplip/files/patch-CVE-2008-2941 @@ -0,0 +1,210 @@ +Patch for CVE-2008-2941 + +Fixes parser fragility: original code expects only strings or numbers as +the input values, but not both. And hpssd client has the full control +on the input data, so when number is tried to be transformed as string +(by calling lower() method, for example) the unhandled exception +terminates the daemon. + +Based on: https://bugzilla.redhat.com/attachment.cgi?id=312881 + +--- hpssd.py.orig 2008-11-23 22:41:08.000000000 +0300 ++++ hpssd.py 2008-11-23 22:57:51.000000000 +0300 +@@ -203,7 +203,7 @@ + log.debug(self.out_buffer) + return True + +- msg_type = self.fields.get('msg', 'unknown').lower() ++ msg_type = str(self.fields.get('msg', 'unknown')).lower() + log.debug("Handling: %s %s %s" % ("*"*20, msg_type, "*"*20)) + log.debug(repr(self.in_buffer)) + +@@ -260,9 +260,9 @@ + + + def handle_getvalue(self): +- device_uri = self.fields.get('device-uri', '').replace('hpfax:', 'hp:') ++ device_uri = str(self.fields.get('device-uri', '')).replace('hpfax:', 'hp:') + value = '' +- key = self.fields.get('key', '') ++ key = str(self.fields.get('key', '')) + result_code = self.__checkdevice(device_uri) + + if result_code == ERROR_SUCCESS: +@@ -274,9 +274,9 @@ + self.out_buffer = buildResultMessage('GetValueResult', value, result_code) + + def handle_setvalue(self): +- device_uri = self.fields.get('device-uri', '').replace('hpfax:', 'hp:') +- key = self.fields.get('key', '') +- value = self.fields.get('value', '') ++ device_uri = str(self.fields.get('device-uri', '')).replace('hpfax:', 'hp:') ++ key = str(self.fields.get('key', '')) ++ value = str(self.fields.get('value', '')) + result_code = self.__checkdevice(device_uri) + + if result_code == ERROR_SUCCESS: +@@ -285,7 +285,7 @@ + self.out_buffer = buildResultMessage('SetValueResult', None, ERROR_SUCCESS) + + def handle_queryhistory(self): +- device_uri = self.fields.get('device-uri', '').replace('hpfax:', 'hp:') ++ device_uri = str(self.fields.get('device-uri', '')).replace('hpfax:', 'hp:') + payload = '' + result_code = self.__checkdevice(device_uri) + +@@ -305,8 +305,8 @@ + + # EVENT + def handle_registerguievent(self): +- username = self.fields.get('username', '') +- typ = self.fields.get('type', 'unknown') ++ username = str(self.fields.get('username', '')) ++ typ = str(self.fields.get('type', 'unknown')) + self.typ = typ + self.username = username + self.send_events = True +@@ -314,13 +314,13 @@ + + # EVENT + def handle_unregisterguievent(self): +- username = self.fields.get('username', '') ++ username = str(self.fields.get('username', '')) + self.send_events = False + + + def handle_test_email(self): + result_code = ERROR_SUCCESS +- username = self.fields.get('username', prop.username) ++ username = str(self.fields.get('username', prop.username)) + message = device.queryString('email_test_message') + subject = device.queryString('email_test_subject') + result_code = self.sendEmail(username, subject, message, True) +@@ -343,11 +343,14 @@ + + # sent by hpfax: to indicate the start of a complete fax rendering job + def handle_hpfaxbegin(self): +- username = self.fields.get('username', prop.username) +- job_id = self.fields.get('job-id', 0) +- printer_name = self.fields.get('printer', '') +- device_uri = self.fields.get('device-uri', '').replace('hp:', 'hpfax:') +- title = self.fields.get('title', '') ++ username = str(self.fields.get('username', prop.username)) ++ try: ++ job_id = int(self.fields.get('job-id', 0)) ++ except ValueError: ++ job_id = 0 ++ printer_name = str(self.fields.get('printer', '')) ++ device_uri = str(self.fields.get('device-uri', '')).replace('hp:', 'hpfax:') ++ title = str(self.fields.get('title', '')) + + log.debug("Creating data store for %s:%d" % (username, job_id)) + fax_file[(username, job_id)] = tempfile.NamedTemporaryFile(prefix="hpfax") +@@ -360,8 +363,11 @@ + + # sent by hpfax: to transfer completed fax rendering data + def handle_hpfaxdata(self): +- username = self.fields.get('username', prop.username) +- job_id = self.fields.get('job-id', 0) ++ username = str(self.fields.get('username', prop.username)) ++ try: ++ job_id = int(self.fields.get('job-id', 0)) ++ except ValueError: ++ job_id = 0 + + if self.payload and (username, job_id) in fax_file and \ + not fax_file_ready[(username, job_id)]: +@@ -373,12 +379,18 @@ + + # sent by hpfax: to indicate the end of a complete fax rendering job + def handle_hpfaxend(self): +- username = self.fields.get('username', '') +- job_id = self.fields.get('job-id', 0) +- printer_name = self.fields.get('printer', '') +- device_uri = self.fields.get('device-uri', '').replace('hp:', 'hpfax:') +- title = self.fields.get('title', '') +- job_size = self.fields.get('job-size', 0) ++ username = str(self.fields.get('username', '')) ++ try: ++ job_id = int(self.fields.get('job-id', 0)) ++ except ValueError: ++ job_id = 0 ++ printer_name = str(self.fields.get('printer', '')) ++ device_uri = str(self.fields.get('device-uri', '')).replace('hp:', 'hpfax:') ++ title = str(self.fields.get('title', '')) ++ try: ++ job_size = int(self.fields.get('job-size', 0)) ++ except ValueError: ++ job_size = 0 + + fax_file[(username, job_id)].seek(0) + fax_file_ready[(username, job_id)] = True +@@ -389,7 +401,7 @@ + + # sent by hp-sendfax to see if any faxes have been printed and need to be picked up + def handle_faxcheck(self): +- username = self.fields.get('username', '') ++ username = str(self.fields.get('username', '')) + result_code = ERROR_NO_DATA_AVAILABLE + other_fields = {} + +@@ -413,8 +425,11 @@ + # after being run with --job param, both after a hpfaxend message + def handle_faxgetdata(self): + result_code = ERROR_SUCCESS +- username = self.fields.get('username', '') +- job_id = self.fields.get('job-id', 0) ++ username = str(self.fields.get('username', '')) ++ try: ++ job_id = int(self.fields.get('job-id', 0)) ++ except ValueError: ++ job_id = 0 + + try: + fax_file[(username, job_id)] +@@ -442,15 +457,18 @@ + # EVENT + def handle_event(self): + gui_port, gui_host = None, None +- event_type = self.fields.get('event-type', 'event') ++ event_type = str(self.fields.get('event-type', 'event')) + +- event_code = self.fields.get('event-code', STATUS_PRINTER_IDLE) ++ try: ++ event_code = int(self.fields.get('event-code', STATUS_PRINTER_IDLE)) ++ except ValueError: ++ event_code = STATUS_PRINTER_IDLE + + # If event-code > 10001, its a PJL error code, so convert it + if event_code > EVENT_MAX_EVENT: + event_code = status.MapPJLErrorCode(event_code) + +- device_uri = self.fields.get('device-uri', '').replace('hpfax:', 'hp:') ++ device_uri = str(self.fields.get('device-uri', '')).replace('hpfax:', 'hp:') + result_code = self.__checkdevice(device_uri) + if result_code != ERROR_SUCCESS: + return +@@ -461,7 +479,10 @@ + + log.debug("Short/Long: %s/%s" % (error_string_short, error_string_long)) + +- job_id = self.fields.get('job-id', 0) ++ try: ++ job_id = int(self.fields.get('job-id', 0)) ++ except ValueError: ++ job_id = 0 + + try: + username = self.fields['username'] +@@ -480,7 +501,10 @@ + + no_fwd = utils.to_bool(self.fields.get('no-fwd', '0')) + log.debug("Username (jobid): %s (%d)" % (username, job_id)) +- retry_timeout = self.fields.get('retry-timeout', 0) ++ try: ++ retry_timeout = int(self.fields.get('retry-timeout', 0)) ++ except ValueError: ++ retry_timeout = 0 + user_alerts = alerts.get(username, {}) + + dup_event = False diff --git a/print/hplip3/files/patch-CVE-2008-2940 b/print/hplip3/files/patch-CVE-2008-2940 new file mode 100644 index 000000000000..dbe14fa417e8 --- /dev/null +++ b/print/hplip3/files/patch-CVE-2008-2940 @@ -0,0 +1,74 @@ +Patch for CVE-2008-2940 + +Please note that alerts are now system-wide and they live in +/etc/hp/alerts.conf + +See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2940 +Obtained from: https://bugzilla.redhat.com/attachment.cgi?id=312878 +Obtained from: https://bugzilla.redhat.com/attachment.cgi?id=312880 + +diff -up hplip-1.6.7/hpssd.py.validate-uri hplip-1.6.7/hpssd.py +--- hpssd.py.validate-uri 2008-07-29 12:48:28.000000000 +0100 ++++ hpssd.py 2008-07-29 13:41:29.000000000 +0100 +@@ -1021,6 +1021,9 @@ class hpssd_handler(dispatcher): + event_type = self.fields.get('event-type', 'event') + event_code = self.fields.get('event-code', 0) + device_uri = self.fields.get('device-uri', '').replace('hpfax:', 'hp:') ++ result_code = self.__checkdevice(device_uri) ++ if result_code != ERROR_SUCCESS: ++ return + log.debug("Device URI: %s" % device_uri) + + try: +diff -up hplip-1.6.7/base/g.py.static-alerts-table hplip-1.6.7/base/g.py +--- base/g.py.orig 2008-01-18 02:10:29.000000000 +0300 ++++ base/g.py 2008-11-23 22:39:11.000000000 +0300 +@@ -134,6 +134,7 @@ + # Config file: directories and ports + prop.sys_config_file = '/etc/hp/hplip.conf' + prop.user_dir = os.path.expanduser('~/.hplip') ++prop.alerts_config_file = '/etc/hp/alerts.conf' + + os.umask(0037) + try: +@@ -154,6 +155,7 @@ + + sys_cfg = Config(prop.sys_config_file, True) + user_cfg = Config(prop.user_config_file) ++alerts_cfg = Config(prop.alerts_config_file) + + + # Language settings +diff -up hplip-1.6.7/hpssd.py.static-alerts-table hplip-1.6.7/hpssd.py +--- hpssd.py.static-alerts-table 2008-07-29 14:57:04.000000000 +0100 ++++ hpssd.py 2008-07-29 15:22:15.000000000 +0100 +@@ -71,6 +71,12 @@ from prnt import cups + + # Per user alert settings + alerts = {} ++for user, cfg in alerts_cfg.iteritems (): ++ entry = {} ++ entry['email-alerts'] = utils.to_bool (cfg.get('email-alerts', 0)) ++ entry['email-from-address'] = cfg.get('email-from-address', '') ++ entry['email-to-addresses'] = cfg.get('email-to-addresses', '') ++ alerts[user] = entry + + # Fax temp files + fax_file = {} +@@ -803,15 +809,10 @@ class hpssd_handler(dispatcher): + self.out_buffer = buildResultMessage('InjectValueResult', None, result_code) + + +- # TODO: Need to load alerts at start-up + def handle_setalerts(self): + result_code = ERROR_SUCCESS +- username = self.fields.get('username', '') + +- alerts[username] = {'email-alerts' : utils.to_bool(self.fields.get('email-alerts', '0')), +- 'email-from-address' : self.fields.get('email-from-address', ''), +- 'email-to-addresses' : self.fields.get('email-to-addresses', ''), +- } ++ # Do nothing. We use the alerts table in /etc/hp/alerts.conf. + + self.out_buffer = buildResultMessage('SetAlertsResult', None, result_code) + diff --git a/print/hplip3/files/patch-CVE-2008-2941 b/print/hplip3/files/patch-CVE-2008-2941 new file mode 100644 index 000000000000..f4bb8ee06caa --- /dev/null +++ b/print/hplip3/files/patch-CVE-2008-2941 @@ -0,0 +1,210 @@ +Patch for CVE-2008-2941 + +Fixes parser fragility: original code expects only strings or numbers as +the input values, but not both. And hpssd client has the full control +on the input data, so when number is tried to be transformed as string +(by calling lower() method, for example) the unhandled exception +terminates the daemon. + +Based on: https://bugzilla.redhat.com/attachment.cgi?id=312881 + +--- hpssd.py.orig 2008-11-23 22:41:08.000000000 +0300 ++++ hpssd.py 2008-11-23 22:57:51.000000000 +0300 +@@ -203,7 +203,7 @@ + log.debug(self.out_buffer) + return True + +- msg_type = self.fields.get('msg', 'unknown').lower() ++ msg_type = str(self.fields.get('msg', 'unknown')).lower() + log.debug("Handling: %s %s %s" % ("*"*20, msg_type, "*"*20)) + log.debug(repr(self.in_buffer)) + +@@ -260,9 +260,9 @@ + + + def handle_getvalue(self): +- device_uri = self.fields.get('device-uri', '').replace('hpfax:', 'hp:') ++ device_uri = str(self.fields.get('device-uri', '')).replace('hpfax:', 'hp:') + value = '' +- key = self.fields.get('key', '') ++ key = str(self.fields.get('key', '')) + result_code = self.__checkdevice(device_uri) + + if result_code == ERROR_SUCCESS: +@@ -274,9 +274,9 @@ + self.out_buffer = buildResultMessage('GetValueResult', value, result_code) + + def handle_setvalue(self): +- device_uri = self.fields.get('device-uri', '').replace('hpfax:', 'hp:') +- key = self.fields.get('key', '') +- value = self.fields.get('value', '') ++ device_uri = str(self.fields.get('device-uri', '')).replace('hpfax:', 'hp:') ++ key = str(self.fields.get('key', '')) ++ value = str(self.fields.get('value', '')) + result_code = self.__checkdevice(device_uri) + + if result_code == ERROR_SUCCESS: +@@ -285,7 +285,7 @@ + self.out_buffer = buildResultMessage('SetValueResult', None, ERROR_SUCCESS) + + def handle_queryhistory(self): +- device_uri = self.fields.get('device-uri', '').replace('hpfax:', 'hp:') ++ device_uri = str(self.fields.get('device-uri', '')).replace('hpfax:', 'hp:') + payload = '' + result_code = self.__checkdevice(device_uri) + +@@ -305,8 +305,8 @@ + + # EVENT + def handle_registerguievent(self): +- username = self.fields.get('username', '') +- typ = self.fields.get('type', 'unknown') ++ username = str(self.fields.get('username', '')) ++ typ = str(self.fields.get('type', 'unknown')) + self.typ = typ + self.username = username + self.send_events = True +@@ -314,13 +314,13 @@ + + # EVENT + def handle_unregisterguievent(self): +- username = self.fields.get('username', '') ++ username = str(self.fields.get('username', '')) + self.send_events = False + + + def handle_test_email(self): + result_code = ERROR_SUCCESS +- username = self.fields.get('username', prop.username) ++ username = str(self.fields.get('username', prop.username)) + message = device.queryString('email_test_message') + subject = device.queryString('email_test_subject') + result_code = self.sendEmail(username, subject, message, True) +@@ -343,11 +343,14 @@ + + # sent by hpfax: to indicate the start of a complete fax rendering job + def handle_hpfaxbegin(self): +- username = self.fields.get('username', prop.username) +- job_id = self.fields.get('job-id', 0) +- printer_name = self.fields.get('printer', '') +- device_uri = self.fields.get('device-uri', '').replace('hp:', 'hpfax:') +- title = self.fields.get('title', '') ++ username = str(self.fields.get('username', prop.username)) ++ try: ++ job_id = int(self.fields.get('job-id', 0)) ++ except ValueError: ++ job_id = 0 ++ printer_name = str(self.fields.get('printer', '')) ++ device_uri = str(self.fields.get('device-uri', '')).replace('hp:', 'hpfax:') ++ title = str(self.fields.get('title', '')) + + log.debug("Creating data store for %s:%d" % (username, job_id)) + fax_file[(username, job_id)] = tempfile.NamedTemporaryFile(prefix="hpfax") +@@ -360,8 +363,11 @@ + + # sent by hpfax: to transfer completed fax rendering data + def handle_hpfaxdata(self): +- username = self.fields.get('username', prop.username) +- job_id = self.fields.get('job-id', 0) ++ username = str(self.fields.get('username', prop.username)) ++ try: ++ job_id = int(self.fields.get('job-id', 0)) ++ except ValueError: ++ job_id = 0 + + if self.payload and (username, job_id) in fax_file and \ + not fax_file_ready[(username, job_id)]: +@@ -373,12 +379,18 @@ + + # sent by hpfax: to indicate the end of a complete fax rendering job + def handle_hpfaxend(self): +- username = self.fields.get('username', '') +- job_id = self.fields.get('job-id', 0) +- printer_name = self.fields.get('printer', '') +- device_uri = self.fields.get('device-uri', '').replace('hp:', 'hpfax:') +- title = self.fields.get('title', '') +- job_size = self.fields.get('job-size', 0) ++ username = str(self.fields.get('username', '')) ++ try: ++ job_id = int(self.fields.get('job-id', 0)) ++ except ValueError: ++ job_id = 0 ++ printer_name = str(self.fields.get('printer', '')) ++ device_uri = str(self.fields.get('device-uri', '')).replace('hp:', 'hpfax:') ++ title = str(self.fields.get('title', '')) ++ try: ++ job_size = int(self.fields.get('job-size', 0)) ++ except ValueError: ++ job_size = 0 + + fax_file[(username, job_id)].seek(0) + fax_file_ready[(username, job_id)] = True +@@ -389,7 +401,7 @@ + + # sent by hp-sendfax to see if any faxes have been printed and need to be picked up + def handle_faxcheck(self): +- username = self.fields.get('username', '') ++ username = str(self.fields.get('username', '')) + result_code = ERROR_NO_DATA_AVAILABLE + other_fields = {} + +@@ -413,8 +425,11 @@ + # after being run with --job param, both after a hpfaxend message + def handle_faxgetdata(self): + result_code = ERROR_SUCCESS +- username = self.fields.get('username', '') +- job_id = self.fields.get('job-id', 0) ++ username = str(self.fields.get('username', '')) ++ try: ++ job_id = int(self.fields.get('job-id', 0)) ++ except ValueError: ++ job_id = 0 + + try: + fax_file[(username, job_id)] +@@ -442,15 +457,18 @@ + # EVENT + def handle_event(self): + gui_port, gui_host = None, None +- event_type = self.fields.get('event-type', 'event') ++ event_type = str(self.fields.get('event-type', 'event')) + +- event_code = self.fields.get('event-code', STATUS_PRINTER_IDLE) ++ try: ++ event_code = int(self.fields.get('event-code', STATUS_PRINTER_IDLE)) ++ except ValueError: ++ event_code = STATUS_PRINTER_IDLE + + # If event-code > 10001, its a PJL error code, so convert it + if event_code > EVENT_MAX_EVENT: + event_code = status.MapPJLErrorCode(event_code) + +- device_uri = self.fields.get('device-uri', '').replace('hpfax:', 'hp:') ++ device_uri = str(self.fields.get('device-uri', '')).replace('hpfax:', 'hp:') + result_code = self.__checkdevice(device_uri) + if result_code != ERROR_SUCCESS: + return +@@ -461,7 +479,10 @@ + + log.debug("Short/Long: %s/%s" % (error_string_short, error_string_long)) + +- job_id = self.fields.get('job-id', 0) ++ try: ++ job_id = int(self.fields.get('job-id', 0)) ++ except ValueError: ++ job_id = 0 + + try: + username = self.fields['username'] +@@ -480,7 +501,10 @@ + + no_fwd = utils.to_bool(self.fields.get('no-fwd', '0')) + log.debug("Username (jobid): %s (%d)" % (username, job_id)) +- retry_timeout = self.fields.get('retry-timeout', 0) ++ try: ++ retry_timeout = int(self.fields.get('retry-timeout', 0)) ++ except ValueError: ++ retry_timeout = 0 + user_alerts = alerts.get(username, {}) + + dup_event = False |