113 lines
3.3 KiB
Diff
113 lines
3.3 KiB
Diff
From 4ee1f31cf80019c5907876576d6dfd49368d660f Mon Sep 17 00:00:00 2001
|
|
From: Gerhard Rieger <gerhard@dest-unreach.org>
|
|
Date: Fri, 6 Dec 2024 11:42:09 +0100
|
|
Subject: [PATCH] Version 1.8.0.2 - CVE-2024-54661: Arbitrary file overwrite in
|
|
readline.sh
|
|
|
|
Conflict:only the modified content of readline.sh and test.sh is rounded.
|
|
Reference:https://repo.or.cz/socat.git/patch/4ee1f31cf80019c5907876576d6dfd49368d660f
|
|
---
|
|
readline.sh | 10 +++++++--
|
|
test.sh | 63 +++++++++++++++++++++++++++++++++++++++++++++++++++++
|
|
2 files changed, 71 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/readline.sh b/readline.sh
|
|
index b6f8438..1045303 100755
|
|
--- a/readline.sh
|
|
+++ b/readline.sh
|
|
@@ -22,9 +22,15 @@ if [ "$withhistfile" ]; then
|
|
else
|
|
HISTOPT=
|
|
fi
|
|
-mkdir -p /tmp/$USER || exit 1
|
|
#
|
|
#
|
|
|
|
-exec socat -d readline"$HISTOPT",noecho='[Pp]assword:' exec:"$PROGRAM",sigint,pty,setsid,ctty,raw,echo=0,stderr 2>/tmp/$USER/stderr2
|
|
+if test -w .; then
|
|
+ STDERR=./socat-readline.${1##*/}.log
|
|
+ rm -f $STDERR
|
|
+else
|
|
+ STDERR=/dev/null
|
|
+fi
|
|
+
|
|
+exec socat -d readline"$HISTOPT",noecho='[Pp]assword:' exec:"$PROGRAM",sigint,pty,setsid,ctty,raw,echo=0,stderr 2>$STDERR
|
|
|
|
diff --git a/test.sh b/test.sh
|
|
index 46bebf8..5204ac7 100755
|
|
--- a/test.sh
|
|
+++ b/test.sh
|
|
@@ -19154,6 +19154,69 @@ esac
|
|
N=$((N+1))
|
|
|
|
|
|
+# Test the readline.sh file overwrite vulnerability
|
|
+NAME=READLINE_SH_OVERWRITE
|
|
+case "$TESTS" in
|
|
+*%$N%*|*%functions%*|*%bugs%*|*%readline%*|*%security%*|*%$NAME%*)
|
|
+TEST="$NAME: Test the readline.sh file overwrite vulnerability"
|
|
+# Create a symlink /tmp/$USER/stderr2 pointing to a temporary file,
|
|
+# run readline.sh
|
|
+# When the temporary file is kept the test succeeded
|
|
+if ! eval $NUMCOND; then :
|
|
+elif ! cond=$(checkconds \
|
|
+ "" \
|
|
+ "" \
|
|
+ "readline.sh" \
|
|
+ "" \
|
|
+ "" \
|
|
+ "" \
|
|
+ "" ); then
|
|
+ $PRINTF "test $F_n $TEST... ${YELLOW}$cond${NORMAL}\n" $N
|
|
+ numCANT=$((numCANT+1))
|
|
+ listCANT="$listCANT $N"
|
|
+ namesCANT="$namesCANT $NAME"
|
|
+else
|
|
+ tf="$td/test$N.file"
|
|
+ te="$td/test$N.stderr"
|
|
+ tdiff="$td/test$N.diff"
|
|
+ da="test$N $(date) $RANDOM"
|
|
+ echo "$da" >"$tf"
|
|
+ ln -sf "$tf" /tmp/$USER/stderr2
|
|
+ CMD0="readline.sh cat"
|
|
+ printf "test $F_n $TEST... " $N
|
|
+ $CMD0 </dev/null >/dev/null 2>"${te}0"
|
|
+ rc0=$?
|
|
+# if [ "$rc0" -ne 0 ]; then
|
|
+# $PRINTF "$CANT (rc0=$rc0)\n"
|
|
+# echo "$CMD0"
|
|
+# cat "${te}0" >&2
|
|
+# numCANT=$((numCANT+1))
|
|
+# listCANT="$listCANT $N"
|
|
+# namesCANT="$namesCANT $NAME"
|
|
+# elif ! echo "$da" |diff - "$tf" >$tdiff; then
|
|
+ if ! echo "$da" |diff - "$tf" >$tdiff; then
|
|
+ $PRINTF "$FAILED (diff)\n"
|
|
+ echo "$CMD0 &"
|
|
+ cat "${te}0" >&2
|
|
+ echo "// diff:" >&2
|
|
+ cat "$tdiff" >&2
|
|
+ numFAIL=$((numFAIL+1))
|
|
+ listFAIL="$listFAIL $N"
|
|
+ namesFAIL="$namesFAIL $NAME"
|
|
+ else
|
|
+ $PRINTF "$OK\n"
|
|
+ if [ "$VERBOSE" ]; then echo "$CMD0 &"; fi
|
|
+ if [ "$DEBUG" ]; then cat "${te}0" >&2; fi
|
|
+ if [ "$VERBOSE" ]; then echo "$CMD1"; fi
|
|
+ if [ "$DEBUG" ]; then cat "${te}1" >&2; fi
|
|
+ numOK=$((numOK+1))
|
|
+ listOK="$listOK $N"
|
|
+ fi
|
|
+fi # NUMCOND
|
|
+ ;;
|
|
+esac
|
|
+N=$((N+1))
|
|
+
|
|
# end of common tests
|
|
|
|
##################################################################################
|
|
--
|
|
2.33.0
|
|
|