Your message dated Mon, 19 Jan 2009 04:17:06 +0000 with message-id <e1lolzs-0001gi...@ries.debian.org> and subject line Bug#511521: fixed in boinc 6.2.14-3 has caused the Debian Bug report #511521, regarding boinc: Does not check the RSA_public_decrypt() return value. to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact ow...@bugs.debian.org immediately.) -- 511521: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=511521 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
--- Begin Message ---Package: boinc Severity: serious Tags: security Hi, I've been checking packages to see if they properly check the return value of some of the functions in openssl. In lib/crypt.C there is this code: int decrypt_public(R_RSA_PUBLIC_KEY& key, DATA_BLOCK& in, DATA_BLOCK& out) { RSA* rp = RSA_new(); public_to_openssl(key, rp); RSA_public_decrypt(in.len, in.data, out.data, rp, RSA_PKCS1_PADDING); out.len = RSA_size(rp); return 0; } So it's not checking the return value of RSA_public_decrypt() which returns the the size of the recovered message digest on success and -1 on failure. I have no idea if this code is being used and what the consequences of this might be. Kurt
--- End Message ---
--- Begin Message ---Source: boinc Source-Version: 6.2.14-3 We believe that the bug you reported is fixed in the latest version of boinc, which is due to be installed in the Debian FTP archive: boinc-client_6.2.14-3_i386.deb to pool/main/b/boinc/boinc-client_6.2.14-3_i386.deb boinc-dbg_6.2.14-3_i386.deb to pool/main/b/boinc/boinc-dbg_6.2.14-3_i386.deb boinc-dev_6.2.14-3_i386.deb to pool/main/b/boinc/boinc-dev_6.2.14-3_i386.deb boinc-manager_6.2.14-3_i386.deb to pool/main/b/boinc/boinc-manager_6.2.14-3_i386.deb boinc_6.2.14-3.diff.gz to pool/main/b/boinc/boinc_6.2.14-3.diff.gz boinc_6.2.14-3.dsc to pool/main/b/boinc/boinc_6.2.14-3.dsc A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 511...@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Rene Mayorga <rmayo...@debian.org> (supplier of updated boinc package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmas...@debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Format: 1.8 Date: Tue, 13 Jan 2009 14:05:38 -0600 Source: boinc Binary: boinc-client boinc-manager boinc-dev boinc-dbg Architecture: source i386 Version: 6.2.14-3 Distribution: unstable Urgency: low Maintainer: Debian BOINC Maintainers <pkg-boinc-de...@lists.alioth.debian.org> Changed-By: Rene Mayorga <rmayo...@debian.org> Description: boinc-client - core client for the BOINC distributed computing infrastructure boinc-dbg - debugging symbols for BOINC binaries boinc-dev - development files to build applications for BOINC projects boinc-manager - GUI to control and monitor the BOINC core client Closes: 511521 Changes: boinc (6.2.14-3) unstable; urgency=low . * Add debian/patches/101_check_RSA_returned_values.patch Check the returned values for RSA_public_decrypt and RSA_private_encrypt functions. Change ported by upstream changeset 16883 (http://boinc.berkeley.edu/trac/changeset/16883) Closes: #511521 * debian/patches 001_dont_install_ca-bundle.crt.patch and 002_remove_hardcoded_optimization.patch Refreshed * debian/control - add myself to uploaders Checksums-Sha1: 9c3d6eadb61b3f89c967fd51d266e0b39c6e2317 1650 boinc_6.2.14-3.dsc 3ca3b3f6916cc652c92c3738a53c4e72d6427a4d 110051 boinc_6.2.14-3.diff.gz 9fecd7a1addca6d9391757f05aa360317b3e1b6a 385642 boinc-client_6.2.14-3_i386.deb 7b8b0109d297c24990d91f53b840c2fdc390d42a 1802676 boinc-manager_6.2.14-3_i386.deb 95ce435db4bf85fa4218831d7c69aea6520f4128 369820 boinc-dev_6.2.14-3_i386.deb 38b4f7b41ae48143ec8d8a3a702d8f27b2cd386b 6766612 boinc-dbg_6.2.14-3_i386.deb Checksums-Sha256: a4ca6afe64db0bf3b397646604b264cae1dafcc354d2389795af859856b48619 1650 boinc_6.2.14-3.dsc 5f266582de65200646f63c6827ce10105c5992317e08ef47ceafde18471ab65a 110051 boinc_6.2.14-3.diff.gz 4383eb88ca792e7f8f97e07e1ab4ecc59e370865315ee90060ff9576d7cfbbca 385642 boinc-client_6.2.14-3_i386.deb 3a5b6b04765ff6e8f6fca437639e373152f3658f0ad95d2356b985c1698ccda2 1802676 boinc-manager_6.2.14-3_i386.deb 518ed74e994bb420915933843ab0fceba1d3dc570a98d3ca30221776c8137cdf 369820 boinc-dev_6.2.14-3_i386.deb 5edf8382e44e397ca91586cbd297a6b299633edd0c711509c15180738e07f88c 6766612 boinc-dbg_6.2.14-3_i386.deb Files: 51b11c2cb665911096b79ce47b790178 1650 net optional boinc_6.2.14-3.dsc c66dd21b8d1bf6096e07b2fd3f42c99d 110051 net optional boinc_6.2.14-3.diff.gz a76d734a203916c384fc5e967445af15 385642 net optional boinc-client_6.2.14-3_i386.deb e759cc4369cd55986cc7f22b51ce1333 1802676 x11 optional boinc-manager_6.2.14-3_i386.deb 02fde5eba11f9f7cf49d2dcf916704b4 369820 devel optional boinc-dev_6.2.14-3_i386.deb 8e0a52ddefb3a5af40eee58e6b9f249f 6766612 devel extra boinc-dbg_6.2.14-3_i386.deb -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iEYEARECAAYFAklz+d0ACgkQgEAZ+qIJwwU+2QCeNAfJIKvVZTkBFhAJTr4Jxgev yTUAniRfkBuqFWLwMxmGnzFUV8BzuKBU =X7Ds -----END PGP SIGNATURE-----
--- End Message ---
