diff -u ngircd-0.10.0/debian/control ngircd-0.10.0/debian/control --- ngircd-0.10.0/debian/control +++ ngircd-0.10.0/debian/control @@ -1,7 +1,8 @@ Source: ngircd Section: net Priority: optional -Maintainer: Mario Iseli +Maintainer: Ubuntu MOTU Developers +XSBC-Original-Maintainer: Mario Iseli Build-Depends: debhelper (>= 4.0.0), autotools-dev, dpatch Standards-Version: 3.7.2 diff -u ngircd-0.10.0/debian/patches/00list ngircd-0.10.0/debian/patches/00list --- ngircd-0.10.0/debian/patches/00list +++ ngircd-0.10.0/debian/patches/00list @@ -1,0 +2 @@ +05-CVE-2007-6062 diff -u ngircd-0.10.0/debian/changelog ngircd-0.10.0/debian/changelog --- ngircd-0.10.0/debian/changelog +++ ngircd-0.10.0/debian/changelog @@ -1,3 +1,13 @@ +ngircd (0.10.0-3ubuntu0.7.10) gutsy-security; urgency=low + + * SECURITY UPDATE: Denial of service via crafted JOIN command. (LP: #173164) + * debian/patches/05-CVE-2007-6062.dpatch: Check that there is at least one + argument to the JOIN command. + * References: + CVE-2007-6062 + + -- William Grant Sat, 01 Dec 2007 12:26:23 +1100 + ngircd (0.10.0-3) unstable; urgency=medium * Corrected the PidFile direction in sample ngircd.conf (Closes: #397331). only in patch2: unchanged: --- ngircd-0.10.0.orig/debian/patches/05-CVE-2007-6062.dpatch +++ ngircd-0.10.0/debian/patches/05-CVE-2007-6062.dpatch @@ -0,0 +1,19 @@ +#! /bin/sh /usr/share/dpatch/dpatch-run +## 05-CVE-2007-6062.dpatch by William Grant +## +## All lines beginning with `## DP:' are a description of the patch. +## DP: Confirm that a JOIN command has at least one argument (CVE-2007-6062). + +@DPATCH@ +diff -urNad ngircd-0.10.0~/src/ngircd/irc-channel.c ngircd-0.10.0/src/ngircd/irc-channel.c +--- ngircd-0.10.0~/src/ngircd/irc-channel.c 2006-03-17 07:14:16.000000000 +1100 ++++ ngircd-0.10.0/src/ngircd/irc-channel.c 2007-12-01 12:11:39.000000000 +1100 +@@ -52,7 +52,7 @@ + assert( Req != NULL ); + + /* Bad number of arguments? */ +- if(( Req->argc > 2 )) return IRC_WriteStrClient( Client, ERR_NEEDMOREPARAMS_MSG, Client_ID( Client ), Req->command ); ++ if(Req->argc < 1 || Req->argc > 2) return IRC_WriteStrClient( Client, ERR_NEEDMOREPARAMS_MSG, Client_ID( Client ), Req->command ); + + /* Who is the sender? */ + if( Client_Type( Client ) == CLIENT_SERVER ) target = Client_Search( Req->prefix );