aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorGregory Neil Shapiro <gshapiro@FreeBSD.org>2002-10-26 21:11:30 +0000
committerGregory Neil Shapiro <gshapiro@FreeBSD.org>2002-10-26 21:11:30 +0000
commitb83144c2b06ad8455f451f2179ca7f94fe32a306 (patch)
treeb81f11b4ec6a3afcaf6b050d7c1217ab1b5c6bd9
parent935529b7a01214974c8a937dea46562450a02a60 (diff)
downloadsrc-b83144c2b06ad8455f451f2179ca7f94fe32a306.tar.gz
src-b83144c2b06ad8455f451f2179ca7f94fe32a306.zip
MFC: Fix smrsh bypass bug.
Approved by: security-officer
Notes
Notes: svn path=/releng/4.4/; revision=106004
-rw-r--r--UPDATING3
-rw-r--r--contrib/sendmail/smrsh/smrsh.c33
-rw-r--r--sys/conf/newvers.sh2
3 files changed, 37 insertions, 1 deletions
diff --git a/UPDATING b/UPDATING
index 413165b18547..ca99d5689a09 100644
--- a/UPDATING
+++ b/UPDATING
@@ -17,6 +17,9 @@ minimal number of processes, if possible, for that patch. For those
updates that don't have an advisory, or to be safe, you can do a full
build and install as described in the COMMON ITEMS section.
+20021026: p29
+ smrsh bypass bug.
+
20021023: p28
Correct kadmind buffer overflow.
diff --git a/contrib/sendmail/smrsh/smrsh.c b/contrib/sendmail/smrsh/smrsh.c
index c95deeac3524..df84cc16d7b5 100644
--- a/contrib/sendmail/smrsh/smrsh.c
+++ b/contrib/sendmail/smrsh/smrsh.c
@@ -59,6 +59,8 @@ static char id[] = "@(#)$Id: smrsh.c,v 8.31.4.9 2001/04/24 04:11:51 ca Exp $";
#include <unistd.h>
#include <stdio.h>
#include <sys/file.h>
+#include <sys/types.h>
+#include <sys/stat.h>
#include <string.h>
#include <ctype.h>
#include <errno.h>
@@ -156,6 +158,7 @@ main(argc, argv)
char cmdbuf[1000];
char pathbuf[1000];
char specialbuf[32];
+ struct stat st;
#ifndef DEBUG
# ifndef LOG_MAIL
@@ -293,6 +296,36 @@ main(argc, argv)
#ifdef DEBUG
printf("Trying %s\n", cmdbuf);
#endif /* DEBUG */
+ if (stat(cmdbuf, &st) < 0)
+ {
+ /* can't stat it */
+ (void) fprintf(stderr, "%s: %s not available for sendmail programs (stat failed)\n",
+ prg, cmd);
+ if (p != NULL)
+ *p = ' ';
+#ifndef DEBUG
+ syslog(LOG_CRIT, "uid %d: attempt to use %s (stat failed)",
+ (int) getuid(), cmd);
+#endif /* ! DEBUG */
+ exit(EX_UNAVAILABLE);
+ }
+ if (!S_ISREG(st.st_mode)
+#ifdef S_ISLNK
+ && !S_ISLNK(st.st_mode)
+#endif /* S_ISLNK */
+ )
+ {
+ /* can't stat it */
+ (void) fprintf(stderr, "%s: %s not available for sendmail programs (not a file)\n",
+ prg, cmd);
+ if (p != NULL)
+ *p = ' ';
+#ifndef DEBUG
+ syslog(LOG_CRIT, "uid %d: attempt to use %s (not a file)",
+ (int) getuid(), cmd);
+#endif /* ! DEBUG */
+ exit(EX_UNAVAILABLE);
+ }
if (access(cmdbuf, X_OK) < 0)
{
/* oops.... crack attack possiblity */
diff --git a/sys/conf/newvers.sh b/sys/conf/newvers.sh
index 2d70051dea8c..a2d42fa94f23 100644
--- a/sys/conf/newvers.sh
+++ b/sys/conf/newvers.sh
@@ -36,7 +36,7 @@
TYPE="FreeBSD"
REVISION="4.4"
-BRANCH="RELEASE-p28"
+BRANCH="RELEASE-p29"
RELEASE="${REVISION}-${BRANCH}"
VERSION="${TYPE} ${RELEASE}"