[openldap/f16] CVE-2012-2668: cipher suite selection by name can be ignored

[jvcelak]

commit b9a43e07c0d52865410f3a264f9aa1f8ffde623e
Author: Jan Vcelak <jvcelak at redhat.com>
Date:   Wed Jun 27 13:55:02 2012 +0200

    CVE-2012-2668: cipher suite selection by name can be ignored
    
    Resolves: #825875

 openldap-cve-nss-cipher-suite-ignored.patch |   27 +++++++++++++++++++++++++++
 openldap.spec                               |    3 +++
 2 files changed, 30 insertions(+), 0 deletions(-)
---
diff --git a/openldap-cve-nss-cipher-suite-ignored.patch b/openldap-cve-nss-cipher-suite-ignored.patch
new file mode 100644
index 0000000..89838f2
--- /dev/null
+++ b/openldap-cve-nss-cipher-suite-ignored.patch
@@ -0,0 +1,27 @@
+MozNSS: cipher suite selection by name may be ignored
+
+Author: Tim Strobell <tim.strobell.ctr at nrl.navy.mil>
+Upstream ITS: #7289
+Upstream commit: 4b6bd2c600a79960409499f43a818aa0ca9fe463
+Resolves: #825875 (CVE-2012-2668)
+
+---
+ libraries/libldap/tls_m.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c
+index 4c18360..d71fec7 100644
+--- a/libraries/libldap/tls_m.c
++++ b/libraries/libldap/tls_m.c
+@@ -624,7 +624,7 @@ nss_parse_ciphers(const char *cipherstr, int cipher_list[ciphernum])
+ 			} else {
+ 				for (i=0; i<ciphernum; i++) {
+ 					if (!strcmp(ciphers_def[i].ossl_name, cipher) &&
+-						cipher_list[1] != -1)
++						cipher_list[i] != -1)
+ 						cipher_list[i] = action;
+ 				}
+ 			}
+-- 
+1.7.10.4
+
diff --git a/openldap.spec b/openldap.spec
index 6bec6c0..3c9c416 100644
--- a/openldap.spec
+++ b/openldap.spec
@@ -47,6 +47,7 @@ Patch21: openldap-nss-segfault-key-not-set.patch
 Patch22: openldap-ld_defconn-rebind.patch
 Patch23: openldap-nss-dont-overwrite-verify-cert-error.patch
 Patch24: openldap-nss-clean-memory-for-token-pin.patch
+Patch25: openldap-cve-nss-cipher-suite-ignored.patch
 
 # patches for the evolution library (see README.evolution)
 Patch200: openldap-evolution-ntlm.patch
@@ -164,6 +165,7 @@ pushd openldap-%{version}
 %patch22 -p1 -b .ld_defconn-rebind
 %patch23 -p1 -b .nss-dont-overwrite-verify-cert-error
 %patch24 -p1 -b .nss-clean-memory-for-token-pin
+%patch25 -p1 -b .cve-nss-cipher-suite-ignored
 
 cp %{_datadir}/libtool/config/config.{sub,guess} build/
 
@@ -692,6 +694,7 @@ exit 0
 * Wed Jun 27 2012 Jan Vcelak <jvcelak at redhat.com> 2.4.26-8
 - fix: TLS error messages overwriting in tlsm_verify_cert() (#810462)
 - fix: reading pin from file can make all TLS connections hang (#829317)
+- CVE-2012-2668: cipher suite selection by name can be ignored (#825875)
 
 * Mon Mar 26 2012 Jan Synáček <jsynacek at redhat.com> 2.4.26-7
 - fix: Re-binding to a failed connection can segfault (#784989)