Add CVE-2014-0160

[tchatow]

This pull request depends on patches to CVEX to add a Debian image and support for ifupdown interface configuration.

[olegbck]

Do you need Debian only for ifupdown to configure network interfaces? Where is that in the code? Why not to use Ubuntu's /etc/netplan? If you really need Debian 7, please also provide a pull request for a new blueprint in https://github.com/ucsb-seclab/CVEX.

[tchatow]

I will submit a corresponding pull request to the other repo. Debian doesn't support netplan since it is Ubuntu specific.

[olegbck]

I can't find any reference to Debian in the description of CVE-2014-0160. Do we really need it? I tried to run it on Ubuntu and the ./configure --prefix=/opt/vuln --with-openssl=../openssl-1.0.1f --with-http_ssl_module --without-http_rewrite_module command gives me this:

checking for OS
 + Linux 5.15.0-102-generic x86_64
checking for C compiler ... not found

./configure: error: C compiler cc is not found

I fixed the GCC installation in debian1.yml:

    - name: Update apt package index
      apt:
        update_cache: yes

    - name: Install a list of packages
      ansible.builtin.apt:
        pkg:
        - linux-kernel-headers
        - build-essential

After that, ./configure still shows me this:

./configure: error: the HTTP gzip module requires the zlib library.
You can either disable the module by using --without-http_gzip_module
option, or install the zlib library into the system, or build the zlib library
statically from the source with nginx by using --with-zlib=<path> option.

Running ./configure --prefix=/opt/vuln --with-openssl=../openssl-1.0.1f --with-http_ssl_module --without-http_rewrite_module --without-http_gzip_module works.

However, make shows this:

cms.pod around line 457: Expected text after =item, not a number
cms.pod around line 461: Expected text after =item, not a number
cms.pod around line 465: Expected text after =item, not a number
cms.pod around line 470: Expected text after =item, not a number
cms.pod around line 474: Expected text after =item, not a number
POD document had syntax errors at /usr/bin/pod2man line 69.
make[2]: *** [Makefile:641: install_docs] Error 255
make[2]: Leaving directory '/opt/openssl-1.0.1f'
make[1]: *** [objs/Makefile:1093: ../openssl-1.0.1f/.openssl/include/openssl/ssl.h] Error 2
make[1]: Leaving directory '/opt/nginx-1.6.0'
make: *** [Makefile:8: build] Error 2

Is the build Debian-specific? I am not sure.