Merge lp://staging/~zulcss/ubuntu/intrepid/ipsec-tools/src-374185 into lp://staging/ubuntu/intrepid/ipsec-tools
Status: | Needs review |
---|---|
Proposed branch: | lp://staging/~zulcss/ubuntu/intrepid/ipsec-tools/src-374185 |
Merge into: | lp://staging/ubuntu/intrepid/ipsec-tools |
Diff against target: |
235 lines 5 files modified
debian/changelog (+25/-0) src/racoon/crypto_openssl.c (+2/-0) src/racoon/ipsec_doi.c (+41/-23) src/racoon/isakmp_frag.c (+2/-1) src/racoon/nattraversal.c (+11/-4) |
To merge this branch: | bzr merge lp://staging/~zulcss/ubuntu/intrepid/ipsec-tools/src-374185 |
Related bugs: |
Reviewer | Review Type | Date Requested | Status |
---|---|---|---|
Steve Beattie (community) | sru | Approve | |
Review via email: mp+12725@code.staging.launchpad.net |
Unmerged revisions
- 20. By Chuck Short
-
src/racoon/
ipsec_doi. c: Patched to fix segfault when using
ipv6 addresses in sainfo section of racoon.conf. Thanks to
Fredrik Ljunggren. (LP: #374185) - 19. By Marc Deslauriers
-
* SECURITY UPDATE: denial of service via fragmented packets without a
payload.
- src/racoon/isakmp_ frag.c: validate size of payload data.
- http://cvsweb. netbsd. org/bsdweb. cgi/src/ crypto/ dist/ipsec- tools/src/ racoon/ isakmp_ frag.c. diff?r1= 1.4&r2= 1.4.6.1& f=h
- CVE-2009-1574
* SECURITY UPDATE: denial of service via multiple memory leaks.
- src/racoon/crypto_ openssl. c: call X509_free().
- src/racoon/nattraversal. c: add new natt_keepalive_ delete( ) function
that also frees ka->src and ka->dst.
- http://cvsweb. netbsd. org/bsdweb. cgi/src/ crypto/ dist/ipsec- tools/src/ racoon/ crypto_ openssl. c.diff? r1=1.11. 6.4&r2= 1.11.6. 5&f=u
- http://cvsweb. netbsd. org/bsdweb. cgi/src/ crypto/ dist/ipsec- tools/src/ racoon/ nattraversal. c.diff? r1=1.6& r2=1.6. 6.1&f=u
- CVE-2009-1632
Looks okay, modulo similar comments about including the prior security fix and making sure to update bug descriptions rather than merely adding a comment. Thanks!