Make log read/write by thttpd user only, bug #458896, CVE-2013-0348

(Portage version: 2.1.11.50/cvs/Linux x86_64, signed Manifest commit with key 0xF52D4BBA)

3 files changed, 138 insertions, 1 deletions

diff --git a/www-servers/thttpd/ChangeLog b/www-servers/thttpd/ChangeLog
index 0d4a24d38e36..4659e51a2eac 100644
--- a/www-servers/thttpd/ChangeLog
+++ b/www-servers/thttpd/ChangeLog
@@ -1,6 +1,12 @@
 # ChangeLog for www-servers/thttpd
 # Copyright 1999-2013 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/www-servers/thttpd/ChangeLog,v 1.57 2013/02/25 21:27:58 zmedico Exp $
+# $Header: /var/cvsroot/gentoo-x86/www-servers/thttpd/ChangeLog,v 1.58 2013/02/26 20:04:32 blueness Exp $
+
+*thttpd-2.26.4-r2 (26 Feb 2013)
+
+  26 Feb 2013; Anthony G. Basile <blueness@gentoo.org>
+  +files/thttpd-fix-world-readable-log.patch, +thttpd-2.26.4-r2.ebuild:
+  Make log read/write by thttpd user only, bug #458896, CVE-2013-0348
 
   25 Feb 2013; Zac Medico <zmedico@gentoo.org> thttpd-2.26.4-r1.ebuild:
   Add ~arm-linux keyword.
diff --git a/www-servers/thttpd/files/thttpd-fix-world-readable-log.patch b/www-servers/thttpd/files/thttpd-fix-world-readable-log.patch
new file mode 100644
index 000000000000..5c011bac52b5
--- /dev/null
+++ b/www-servers/thttpd/files/thttpd-fix-world-readable-log.patch
@@ -0,0 +1,59 @@
+From d2e186dbd58d274a0dea9b59357edc8498b5388d Mon Sep 17 00:00:00 2001
+From: "Anthony G. Basile" <blueness@gentoo.org>
+Date: Tue, 26 Feb 2013 14:28:26 -0500
+Subject: [PATCH] src/thttpd.c: Fix world readable log, CVE-2013-0348.
+
+Make sure that the logfile is created or reopened as read/write
+by thttpd user only.
+
+X-gentoo-Bug: 458896
+X-gentoo-Bug-URL: https://bugs.gentoo.org/show_bug.cgi?id=458896
+Reported-by:  Agostino Sarubbo <ago@gentoo.org>
+Signed-off-by: Anthony G. Basile <basile@opensource.dyc.edu>
+---
+ src/thttpd.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/src/thttpd.c b/src/thttpd.c
+index 019b8c0..f33a7a7 100644
+--- a/src/thttpd.c
++++ b/src/thttpd.c
+@@ -326,6 +326,7 @@ static void
+ re_open_logfile( void )
+     {
+     FILE* logfp;
++    int retchmod;
+ 
+     if ( no_log || hs == (httpd_server*) 0 )
+ 	return;
+@@ -335,7 +336,8 @@ re_open_logfile( void )
+ 	{
+ 	syslog( LOG_NOTICE, "re-opening logfile" );
+ 	logfp = fopen( logfile, "a" );
+-	if ( logfp == (FILE*) 0 )
++	retchmod = chmod( logfile, S_IRUSR|S_IWUSR );
++	if ( logfp == (FILE*) 0 || retchmod != 0 )
+ 	    {
+ 	    syslog( LOG_CRIT, "re-opening %.80s - %m", logfile );
+ 	    return;
+@@ -355,6 +357,7 @@ main( int argc, char** argv )
+     gid_t gid = 32767;
+     char cwd[MAXPATHLEN+1];
+     FILE* logfp;
++    int retchmod;
+     int num_ready;
+     int cnum;
+     connecttab* c;
+@@ -424,7 +427,8 @@ main( int argc, char** argv )
+ 	else
+ 	    {
+ 	    logfp = fopen( logfile, "a" );
+-	    if ( logfp == (FILE*) 0 )
++	    retchmod = chmod( logfile, S_IRUSR|S_IWUSR );
++	    if ( logfp == (FILE*) 0 || retchmod != 0 )
+ 		{
+ 		syslog( LOG_CRIT, "%.80s - %m", logfile );
+ 		perror( logfile );
+-- 
+1.7.12.4
+
diff --git a/www-servers/thttpd/thttpd-2.26.4-r2.ebuild b/www-servers/thttpd/thttpd-2.26.4-r2.ebuild
new file mode 100644
index 000000000000..44304462ee3b
--- /dev/null
+++ b/www-servers/thttpd/thttpd-2.26.4-r2.ebuild
@@ -0,0 +1,72 @@
+# Copyright 1999-2013 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/www-servers/thttpd/thttpd-2.26.4-r2.ebuild,v 1.1 2013/02/26 20:04:32 blueness Exp $
+
+EAPI="4"
+
+inherit eutils flag-o-matic toolchain-funcs
+
+MY_P="s${P}"
+
+DESCRIPTION="Fork of thttpd, a small, fast, multiplexing webserver."
+HOMEPAGE="http://opensource.dyc.edu/sthttpd"
+SRC_URI="http://opensource.dyc.edu/pub/sthttpd/${MY_P}.tar.gz"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~hppa ~mips ~ppc ~ppc64 ~sparc ~x86 ~amd64-linux ~arm-linux ~x86-linux"
+IUSE=""
+
+RDEPEND=""
+DEPEND=""
+
+WEBROOT="/var/www/localhost"
+
+THTTPD_USER=thttpd
+THTTPD_GROUP=thttpd
+THTTPD_DOCROOT="${EPREFIX}${WEBROOT}/htdocs"
+
+DOCS=( README TODO )
+
+pkg_setup() {
+	ebegin "Creating thttpd user and group"
+	enewgroup ${THTTPD_GROUP}
+	enewuser ${THTTPD_USER} -1 -1 -1 ${THTTPD_GROUP}
+}
+
+src_prepare () {
+	epatch "${FILESDIR}"/thttpd-fix-world-readable-log.patch
+}
+
+src_configure() {
+	econf WEBDIR=${THTTPD_DOCROOT}
+}
+
+src_install () {
+	default
+
+	newinitd "${FILESDIR}"/thttpd.init.1 thttpd
+	newconfd "${FILESDIR}"/thttpd.confd.1 thttpd
+
+	insinto /etc/logrotate.d
+	newins "${FILESDIR}/thttpd.logrotate" thttpd
+
+	insinto /etc/thttpd
+	doins "${FILESDIR}"/thttpd.conf.sample
+
+	#move htdocs to docdir, bug #429632
+	docompress -x /usr/share/doc/"${PF}"/htdocs.dist
+	mv "${ED}"${WEBROOT}/htdocs \
+		"${ED}"/usr/share/doc/"${PF}"/htdocs.dist
+	mkdir "${ED}"${WEBROOT}/htdocs
+
+	keepdir ${WEBROOT}/htdocs
+
+	chown root:${THTTPD_GROUP} "${ED}/usr/sbin/makeweb" \
+		|| die "Failed chown makeweb"
+	chmod 2751 "${ED}/usr/sbin/makeweb" \
+		|| die "Failed chmod makeweb"
+	chmod 755 "${ED}/usr/share/doc/${PF}/htdocs.dist/cgi-bin/printenv" \
+		|| die "Failed chmod printenv"
+}