aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorGregory Neil Shapiro <gshapiro@FreeBSD.org>2002-10-26 21:08:43 +0000
committerGregory Neil Shapiro <gshapiro@FreeBSD.org>2002-10-26 21:08:43 +0000
commiteeca4eb030dc222e60b8c907cddcc1a0528caf60 (patch)
tree761d985c960f6c7257d13fb93f6ba19c53c8c023
parentb9a77fa560afd98564b3060238a1d93001a62f72 (diff)
downloadsrc-eeca4eb030dc222e60b8c907cddcc1a0528caf60.tar.gz
src-eeca4eb030dc222e60b8c907cddcc1a0528caf60.zip
MFC: Fix smrsh bypass bug.
Approved by: security-officer
Notes
Notes: svn path=/releng/4.3/; revision=106003
-rw-r--r--UPDATING3
-rw-r--r--contrib/sendmail/smrsh/smrsh.c33
-rw-r--r--sys/conf/newvers.sh2
3 files changed, 37 insertions, 1 deletions
diff --git a/UPDATING b/UPDATING
index 91b67093d563..fb5d9dc091e4 100644
--- a/UPDATING
+++ b/UPDATING
@@ -16,6 +16,9 @@ minimal number of processes, if possible, for that patch. For those
updates that don't have an advisory, or to be safe, you can do a full
build and install as described in the COMMON ITEMS section.
+20021026: p30
+ smrsh bypass bug.
+
20020710: p29 FreeBSD-SA-02:28.resolv
resolver buffer overflow.
diff --git a/contrib/sendmail/smrsh/smrsh.c b/contrib/sendmail/smrsh/smrsh.c
index 9d45a92fc1c2..7c7292183c43 100644
--- a/contrib/sendmail/smrsh/smrsh.c
+++ b/contrib/sendmail/smrsh/smrsh.c
@@ -59,6 +59,8 @@ static char id[] = "@(#)$Id: smrsh.c,v 8.31.4.8 2001/01/22 19:00:26 gshapiro Exp
#include <unistd.h>
#include <stdio.h>
#include <sys/file.h>
+#include <sys/types.h>
+#include <sys/stat.h>
#include <string.h>
#include <ctype.h>
#include <errno.h>
@@ -156,6 +158,7 @@ main(argc, argv)
char cmdbuf[1000];
char pathbuf[1000];
char specialbuf[32];
+ struct stat st;
#ifndef DEBUG
# ifndef LOG_MAIL
@@ -292,6 +295,36 @@ main(argc, argv)
#ifdef DEBUG
printf("Trying %s\n", cmdbuf);
#endif /* DEBUG */
+ if (stat(cmdbuf, &st) < 0)
+ {
+ /* can't stat it */
+ (void) fprintf(stderr, "%s: %s not available for sendmail programs (stat failed)\n",
+ prg, cmd);
+ if (p != NULL)
+ *p = ' ';
+#ifndef DEBUG
+ syslog(LOG_CRIT, "uid %d: attempt to use %s (stat failed)",
+ (int) getuid(), cmd);
+#endif /* ! DEBUG */
+ exit(EX_UNAVAILABLE);
+ }
+ if (!S_ISREG(st.st_mode)
+#ifdef S_ISLNK
+ && !S_ISLNK(st.st_mode)
+#endif /* S_ISLNK */
+ )
+ {
+ /* can't stat it */
+ (void) fprintf(stderr, "%s: %s not available for sendmail programs (not a file)\n",
+ prg, cmd);
+ if (p != NULL)
+ *p = ' ';
+#ifndef DEBUG
+ syslog(LOG_CRIT, "uid %d: attempt to use %s (not a file)",
+ (int) getuid(), cmd);
+#endif /* ! DEBUG */
+ exit(EX_UNAVAILABLE);
+ }
if (access(cmdbuf, X_OK) < 0)
{
/* oops.... crack attack possiblity */
diff --git a/sys/conf/newvers.sh b/sys/conf/newvers.sh
index ec47e5a6ae2c..a7658d5cea83 100644
--- a/sys/conf/newvers.sh
+++ b/sys/conf/newvers.sh
@@ -36,7 +36,7 @@
TYPE="FreeBSD"
REVISION="4.3"
-BRANCH="RELEASE-p29"
+BRANCH="RELEASE-p30"
RELEASE="${REVISION}-${BRANCH}"
VERSION="${TYPE} ${RELEASE}"