From 0fdf43fd606835684dc22785bfe67824c749f7f7 Mon Sep 17 00:00:00 2001 From: Yves-Alexis Perez Date: Wed, 18 Nov 2015 15:27:40 +0100 Subject: CVE-2015-8023_eap_mschapv2_state dropped --- .../patches/CVE-2015-8023_eap_mschapv2_state.patch | 35 ---------------------- debian/patches/series | 1 - 2 files changed, 36 deletions(-) delete mode 100644 debian/patches/CVE-2015-8023_eap_mschapv2_state.patch (limited to 'debian/patches') diff --git a/debian/patches/CVE-2015-8023_eap_mschapv2_state.patch b/debian/patches/CVE-2015-8023_eap_mschapv2_state.patch deleted file mode 100644 index 0ee759ce4..000000000 --- a/debian/patches/CVE-2015-8023_eap_mschapv2_state.patch +++ /dev/null @@ -1,35 +0,0 @@ -From 91762f11e223e33b82182150d7c4cf7c2ec3cefa Mon Sep 17 00:00:00 2001 -From: Tobias Brunner -Date: Thu, 29 Oct 2015 11:18:27 +0100 -Subject: [PATCH] eap-mschapv2: Only succeed authentication if MSK was - established - -An MSK is only established if the client successfully authenticated -itself and only then must we accept an MSCHAPV2_SUCCESS message. - -Fixes CVE-2015-8023 ---- - src/libcharon/plugins/eap_mschapv2/eap_mschapv2.c | 6 +++++- - 1 file changed, 5 insertions(+), 1 deletion(-) - -diff --git a/src/libcharon/plugins/eap_mschapv2/eap_mschapv2.c b/src/libcharon/plugins/eap_mschapv2/eap_mschapv2.c -index f7f39f9841d2..931e3c41dde4 100644 ---- a/src/libcharon/plugins/eap_mschapv2/eap_mschapv2.c -+++ b/src/libcharon/plugins/eap_mschapv2/eap_mschapv2.c -@@ -1145,7 +1145,11 @@ METHOD(eap_method_t, process_server, status_t, - } - case MSCHAPV2_SUCCESS: - { -- return SUCCESS; -+ if (this->msk.ptr) -+ { -+ return SUCCESS; -+ } -+ break; - } - case MSCHAPV2_FAILURE: - { --- -1.9.1 - - diff --git a/debian/patches/series b/debian/patches/series index 68c6f4c33..6d7cc1dfa 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -1,4 +1,3 @@ 01_fix-manpages.patch 03_systemd-service.patch 04_disable-libtls-tests.patch -CVE-2015-8023_eap_mschapv2_state.patch -- cgit v1.2.3