commit cc48b652
Author: Steffen (Daode) Nurpmeso <[email protected]>
AuthorDate: 2017-01-27 19:58:39 +0100
Commit: Steffen (Daode) Nurpmeso <[email protected]>
CommitDate: 2017-01-27 20:07:41 +0100
FIX privsep.c, yes, vulnerability (wapiflapi)..
wapiflapi (wapiflapi at yahoo dot fr) reported a vulnerability
when the privsep program is driven directly: it is possible to
pass a random string which includes path separators.
This random string is used to build the path name of a an
O_EXCLusively created file, which then is fchown()ed to the owner
of the mailbox the privsep child is to be used to create a lock
file for. The exclusively created file is then removed, whether
the race has been won or not.
The privsep child will refuse to run unless the executing user
owns the mailbox file, that is, has read (or read/write, dependent
on mode), the target of the link will always be the name of said
mailbox with a ".lock" suffix (Unix dotlock locking).
---
privsep.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/privsep.c b/privsep.c
index 069cb10d..8084c1bc 100644
--- a/privsep.c
+++ b/privsep.c
@@ -58,6 +58,7 @@ main(int argc, char **argv)
strcmp(argv[ 4], "name") ||
strcmp(argv[ 6], "hostname") ||
strcmp(argv[ 8], "randstr") ||
+ strchr(argv[ 9], '/') != NULL /* Seal path injection vector */ ||
strcmp(argv[10], "pollmsecs") ||
fstat(STDIN_FILENO, &stb) == -1 || !S_ISFIFO(stb.st_mode) ||
fstat(STDOUT_FILENO, &stb) == -1 || !S_ISFIFO(stb.st_mode)) {
--steffen
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, SlashDot.org! http://sdm.link/slashdot
__________________________________
[email protected]
