diff options
| author | Gregory Neil Shapiro <gshapiro@FreeBSD.org> | 2002-10-26 21:11:30 +0000 |
|---|---|---|
| committer | Gregory Neil Shapiro <gshapiro@FreeBSD.org> | 2002-10-26 21:11:30 +0000 |
| commit | c3fe03886b71de404236464f7c371e722a13f526 (patch) | |
| tree | f79089be24946fbd3bca0365d2e685b226a1263d | |
| parent | 75fd79c1222bebb752e7bb6ec650b948294032c3 (diff) | |
| download | src-c3fe03886b71de404236464f7c371e722a13f526.tar.gz src-c3fe03886b71de404236464f7c371e722a13f526.zip | |
MFC: Fix smrsh bypass bug.
Approved by: security-officer
Notes
Notes:
svn path=/releng/4.5/; revision=106004
| -rw-r--r-- | UPDATING | 3 | ||||
| -rw-r--r-- | contrib/sendmail/smrsh/smrsh.c | 33 | ||||
| -rw-r--r-- | sys/conf/newvers.sh | 2 |
3 files changed, 37 insertions, 1 deletions
@@ -18,6 +18,9 @@ minimal number of processes, if possible, for that patch. For those updates that don't have an advisory, or to be safe, you can do a full build and install as described in the COMMON ITEMS section. +20021026: p22 + smrsh bypass bug. + 20021023: p21 Correct kadmind buffer overflow. diff --git a/contrib/sendmail/smrsh/smrsh.c b/contrib/sendmail/smrsh/smrsh.c index c95deeac3524..df84cc16d7b5 100644 --- a/contrib/sendmail/smrsh/smrsh.c +++ b/contrib/sendmail/smrsh/smrsh.c @@ -59,6 +59,8 @@ static char id[] = "@(#)$Id: smrsh.c,v 8.31.4.9 2001/04/24 04:11:51 ca Exp $"; #include <unistd.h> #include <stdio.h> #include <sys/file.h> +#include <sys/types.h> +#include <sys/stat.h> #include <string.h> #include <ctype.h> #include <errno.h> @@ -156,6 +158,7 @@ main(argc, argv) char cmdbuf[1000]; char pathbuf[1000]; char specialbuf[32]; + struct stat st; #ifndef DEBUG # ifndef LOG_MAIL @@ -293,6 +296,36 @@ main(argc, argv) #ifdef DEBUG printf("Trying %s\n", cmdbuf); #endif /* DEBUG */ + if (stat(cmdbuf, &st) < 0) + { + /* can't stat it */ + (void) fprintf(stderr, "%s: %s not available for sendmail programs (stat failed)\n", + prg, cmd); + if (p != NULL) + *p = ' '; +#ifndef DEBUG + syslog(LOG_CRIT, "uid %d: attempt to use %s (stat failed)", + (int) getuid(), cmd); +#endif /* ! DEBUG */ + exit(EX_UNAVAILABLE); + } + if (!S_ISREG(st.st_mode) +#ifdef S_ISLNK + && !S_ISLNK(st.st_mode) +#endif /* S_ISLNK */ + ) + { + /* can't stat it */ + (void) fprintf(stderr, "%s: %s not available for sendmail programs (not a file)\n", + prg, cmd); + if (p != NULL) + *p = ' '; +#ifndef DEBUG + syslog(LOG_CRIT, "uid %d: attempt to use %s (not a file)", + (int) getuid(), cmd); +#endif /* ! DEBUG */ + exit(EX_UNAVAILABLE); + } if (access(cmdbuf, X_OK) < 0) { /* oops.... crack attack possiblity */ diff --git a/sys/conf/newvers.sh b/sys/conf/newvers.sh index 6541d68d6565..5646258f675e 100644 --- a/sys/conf/newvers.sh +++ b/sys/conf/newvers.sh @@ -36,7 +36,7 @@ TYPE="FreeBSD" REVISION="4.5" -BRANCH="RELEASE-p21" +BRANCH="RELEASE-p22" RELEASE="${REVISION}-${BRANCH}" VERSION="${TYPE} ${RELEASE}" |