1280043 - Update bzip2 in tree to 1.0.6

Status: RESOLVED FIXED

(Firefox Build System :: General, defect)

Description

[Daniel Veditz [:dveditz]]

Our in-tree bzip2 library is at the ancient 1.0.4 -- we need to update to the most recent version (from 6 years ago) 1.0.6 which fixes an integer overflow CVE-2010-0405 and a couple of older DOS bugs.

Comment 1

[Daniel Veditz [:dveditz]]

gps: do you know who owns updating this library? last time we updated it it was handled as a "build config" bug.

Comment 2

[Gregory Szorc [:gps]]

Anybody can likely update bzip2 - hopefully it is just a drop-in replacement given the minor version bump.

What's the priority of this? Can it ride the trains or do you want this shipping ASAP?

Comment 3

[Mike Hommey [:glandium]]

Note that libbz2 is only used by the updater, and only after the mar signature has been validated. From a (really) quick glance at the code, it seems like the bz2 stream is what is signed, so it should be impossible to tamper with it to trigger any libbz2 bugs.

Robert, could you confirm the above?

Comment 4

[Robert Strong (they/them - no direct email)]

That is correct as long as the mar file is signed and the updater is built with MOZ_VERIFY_MAR_SIGNATURE. Firefox Linux, Mac, and Windows all satisfy these conditions. Not 100% positive about other products but it appears that Thunderbird has it enabled only for Windows and SeaMonkey doesn't have it enabled for any platforms.

Comment 5

[Robert Strong (they/them - no direct email)]

Also looks like Windows Thunderbird 64 bit does not have MOZ_VERIFY_MAR_SIGNATURE

Comment 6

[Daniel Veditz [:dveditz]]

[Tracking Requested - why for this release]:

It looks like Firefox is OK in practice which is why this is rated "moderate" rather than higher, but we need this on the ESR-45 branch for Thunderbird. It'd be nice to not ride all the trains since this ought to be simple to drop in and we're still a full old-cycle-size from the next merge date

Comment 7

[Gregory Szorc [:gps]]

I'll get this landed.

Comment 8

[Gregory Szorc [:gps]]

Attachment: Upgrade bzip2 to 1.0.6

http://www.bzip.org/1.0.6/bzip2-1.0.6.tar.gz was uncompressed to
modules/libbz2/src unmodified. Only modified files were committed.
Other files from the archive not previously under version control
were not added.

It's worth noting that bzip.org is not available over https://
and they only publish a MD5 of the source archive. So there is
no good way to verify the sources from the vendor. Out of paranoia,
I obtained the source archive from Debian
(https://packages.debian.org/jessie/bzip2) and verified they matched
the vendor-obtained sources.

Comment 9

[Gregory Szorc [:gps]]

https://hg.mozilla.org/integration/fx-team/rev/0546e2201cab

Comment 10

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/0546e2201cab

Comment 11

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Hello GPS, is this something that needs to be included in ESR45.3? This came up on my list of bugs affecting ESR45. Please let me know. Thanks!

Comment 12

[Gregory Szorc [:gps]]

(In reply to Ritu Kothari (:ritu) from comment #11)
> Hello GPS, is this something that needs to be included in ESR45.3? This came
> up on my list of bugs affecting ESR45. Please let me know. Thanks!

That was the wish of dveditz. I'll get the uplift request started.

Comment 13

[Gregory Szorc [:gps]]

Comment on attachment 8765077 [details] [diff] [review]
Upgrade bzip2 to 1.0.6

Approval Request Comment
[Feature/regressing bug #]: None
[User impact if declined]: Increased exposure to potential security threat
[Describe test coverage new/current, TreeHerder]:
[Risks and why]: Should be low
[String/UUID change made/needed]: None

[Approval Request Comment]
If this is not a sec:{high,crit} bug, please state case for ESR consideration:
Fix Landed on Version: 50

This patch is a rubber stamp upgrade of bzip2 to the latest released version, which doesn't have disclosed security vulnerabilities. bzip2 is a pretty popular package and this released version is from 2010. Presumably there weren't any critical bugs worth fixing since or they would have released a new version. The new version we're updating to has no API changes, so it should be a drop-in replacement in Gecko. This should be a safe update.

Comment 14

[Gregory Szorc [:gps]]

Comment on attachment 8765077 [details] [diff] [review]
Upgrade bzip2 to 1.0.6

Didn't mean to flag release.

Comment 15

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Comment on attachment 8765077 [details] [diff] [review]
Upgrade bzip2 to 1.0.6

This seems like a fairly safe and low impact change, Beta48+, Aurora49+, ESR45+

Comment 16

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/b869cd449f96

Comment 17

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/releases/mozilla-beta/rev/a3cadedba916

Comment 18

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/releases/mozilla-esr45/rev/9972630a7568

Comment 19

[Al Billings [:abillings - ex-MoCo]]

Minusing for advisories after discussions with Dveditz.

Comment 20

[Tyson Smith [:tsmith]]

Is this a dup of bug 480372?

Comment 21

[Gregory Szorc [:gps]]

(In reply to Tyson Smith [:tsmith] from comment #20)
> Is this a dup of bug 480372?

Yes. I won't mark as a dupe because I don't know what our policy of duping against security bugs is.