fixes #4880
---
main/strongswan/APKBUILD | 6 +++++-
main/strongswan/CVE-2015-8023.patch | 31 +++++++++++++++++++++++++++++++
2 files changed, 36 insertions(+), 1 deletion(-)
create mode 100644 main/strongswan/CVE-2015-8023.patch
diff --git a/main/strongswan/APKBUILD b/main/strongswan/APKBUILD
index 910b01e..1ef60df 100644
--- a/main/strongswan/APKBUILD
+++ b/main/strongswan/APKBUILD
@@ -2,7 +2,7 @@
# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
pkgname=strongswan
pkgver=5.1.3
-pkgrel=0
+pkgrel=1
pkgdesc="IPsec-based VPN solution focused on security and ease of use, supporting IKEv1/IKEv2 and MOBIKE"
url="http://www.strongswan.org/"
arch="all"
@@ -13,6 +13,7 @@ makedepends="$depends_dev"
install=""
subpackages="$pkgname-doc"
source="http://download.strongswan.org/$pkgname-$pkgver.tar.bz2
+ CVE-2015-8023.patch
strongswan.initd"
_builddir="$srcdir/$pkgname-$pkgver"
@@ -90,8 +91,11 @@ package() {
}
md5sums="1d1c108775242743cd8699215b2918c3 strongswan-5.1.3.tar.bz2
+60c0ed05e7d9b456ec6cc2a7b9c8d58c CVE-2015-8023.patch
fb9822512d02f521af8812db22a5175e strongswan.initd"
sha256sums="84e46d5ce801e1b874e2bfba8d21dbd78b432e23b7fb1f4f2d637359e7a183a8 strongswan-5.1.3.tar.bz2
+66ae42b1b1a8f23b840237089dd6d23a208f2d4db19a9ea6384ac4ef66588229 CVE-2015-8023.patch
e4add8941d545930bba43d7d3af302bc436d7c0264a2796480226567e2b12e54 strongswan.initd"
sha512sums="05f4afbf778de54c593692a8117a5fae05c0539cdb7545bc53657deb32d09bec7e0aef07d509dc682af15d57adf569242715447bc1a87785c1f80a21076cb8cb strongswan-5.1.3.tar.bz2
+e1074e516b42fe1a693a80bd3cf4f3c83d004d2e82f25bbd34057fca2547af1d6b3eb7f25211362b5cbad2f71f8d511585bcea43d4a4af8d27738516a0d29765 CVE-2015-8023.patch
2f2936865e494a9454329867acfb71ca323f90dec526a97f7d0c18422deb54205f81f9f592ed6c3b474fe5e954ebcb90eed0311e52fa3a86a982d80ba9a45be8 strongswan.initd"
diff --git a/main/strongswan/CVE-2015-8023.patch b/main/strongswan/CVE-2015-8023.patch
new file mode 100644
index 0000000..22f96ca
--- /dev/null
+++ b/main/strongswan/CVE-2015-8023.patch
@@ -0,0 +1,31 @@
+From 91762f11e223e33b82182150d7c4cf7c2ec3cefa Mon Sep 17 00:00:00 2001
+From: Tobias Brunner <tobias@strongswan.org>
+Date: Thu, 29 Oct 2015 11:18:27 +0100
+Subject: [PATCH] eap-mschapv2: Only succeed authentication if MSK was
+ established
+
+An MSK is only established if the client successfully authenticated
+itself and only then must we accept an MSCHAPV2_SUCCESS message.
+
+Fixes CVE-2015-8023
+---
+ src/libcharon/plugins/eap_mschapv2/eap_mschapv2.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+Index: strongswan-5.1.2/src/libcharon/plugins/eap_mschapv2/eap_mschapv2.c
+===================================================================
+--- strongswan-5.1.2.orig/src/libcharon/plugins/eap_mschapv2/eap_mschapv2.c 2015-11-11 07:57:22.132300446 -0500
++++ strongswan-5.1.2/src/libcharon/plugins/eap_mschapv2/eap_mschapv2.c 2015-11-11 07:57:22.132300446 -0500
+@@ -1141,7 +1141,11 @@
+ }
+ case MSCHAPV2_SUCCESS:
+ {
+- return SUCCESS;
++ if (this->msk.ptr)
++ {
++ return SUCCESS;
++ }
++ break;
+ }
+ case MSCHAPV2_FAILURE:
+ {
--
2.6.2
---
Unsubscribe: alpine-aports+unsubscribe@lists.alpinelinux.org
Help: alpine-aports+help@lists.alpinelinux.org
---