89 lines
2.5 KiB
Diff
89 lines
2.5 KiB
Diff
FIXES
|
|
=====
|
|
|
|
* a future release of MIT krb5 will contain a fix for this
|
|
vulnerability
|
|
|
|
prior to that release you may:
|
|
|
|
* disable telnetd
|
|
|
|
or
|
|
|
|
* apply the following (preliminary) patch:
|
|
|
|
*** src/appl/telnet/telnetd/state.c (revision 19480)
|
|
--- src/appl/telnet/telnetd/state.c (local)
|
|
***************
|
|
*** 1665,1671 ****
|
|
strcmp(varp, "RESOLV_HOST_CONF") && /* linux */
|
|
strcmp(varp, "NLSPATH") && /* locale stuff */
|
|
strncmp(varp, "LC_", strlen("LC_")) && /* locale stuff */
|
|
! strcmp(varp, "IFS")) {
|
|
return 1;
|
|
} else {
|
|
syslog(LOG_INFO, "Rejected the attempt to modify the environment variable \"%s\"", varp);
|
|
--- 1665,1672 ----
|
|
strcmp(varp, "RESOLV_HOST_CONF") && /* linux */
|
|
strcmp(varp, "NLSPATH") && /* locale stuff */
|
|
strncmp(varp, "LC_", strlen("LC_")) && /* locale stuff */
|
|
! strcmp(varp, "IFS") &&
|
|
! !strchr(varp, '-')) {
|
|
return 1;
|
|
} else {
|
|
syslog(LOG_INFO, "Rejected the attempt to modify the environment variable \"%s\"", varp);
|
|
*** src/appl/telnet/telnetd/sys_term.c (revision 19480)
|
|
--- src/appl/telnet/telnetd/sys_term.c (local)
|
|
***************
|
|
*** 1287,1292 ****
|
|
--- 1287,1302 ----
|
|
#endif
|
|
#if defined (AUTHENTICATION)
|
|
if (auth_level >= 0 && autologin == AUTH_VALID) {
|
|
+ if (name[0] == '-') {
|
|
+ /* Authenticated and authorized to log in to an
|
|
+ account starting with '-'? Even if that
|
|
+ unlikely case comes to pass, the current login
|
|
+ program will not parse the resulting command
|
|
+ line properly. */
|
|
+ syslog(LOG_ERR, "user name cannot start with '-'");
|
|
+ fatal(net, "user name cannot start with '-'");
|
|
+ exit(1);
|
|
+ }
|
|
# if !defined(NO_LOGIN_F)
|
|
#if defined(LOGIN_CAP_F)
|
|
argv = addarg(argv, "-F");
|
|
***************
|
|
*** 1377,1387 ****
|
|
} else
|
|
#endif
|
|
if (getenv("USER")) {
|
|
! argv = addarg(argv, getenv("USER"));
|
|
#if defined(LOGIN_ARGS) && defined(NO_LOGIN_P)
|
|
{
|
|
register char **cpp;
|
|
for (cpp = environ; *cpp; cpp++)
|
|
argv = addarg(argv, *cpp);
|
|
}
|
|
#endif
|
|
--- 1387,1405 ----
|
|
} else
|
|
#endif
|
|
if (getenv("USER")) {
|
|
! char *user = getenv("USER");
|
|
! if (user[0] == '-') {
|
|
! /* "telnet -l-x ..." */
|
|
! syslog(LOG_ERR, "user name cannot start with '-'");
|
|
! fatal(net, "user name cannot start with '-'");
|
|
! exit(1);
|
|
! }
|
|
! argv = addarg(argv, user);
|
|
#if defined(LOGIN_ARGS) && defined(NO_LOGIN_P)
|
|
{
|
|
register char **cpp;
|
|
for (cpp = environ; *cpp; cpp++)
|
|
+ if ((*cpp)[0] != '-')
|
|
argv = addarg(argv, *cpp);
|
|
}
|
|
#endif
|