diff options
| author | Todd C. Miller <millert@cvs.openbsd.org> | 2002-10-09 03:58:49 +0000 |
|---|---|---|
| committer | Todd C. Miller <millert@cvs.openbsd.org> | 2002-10-09 03:58:49 +0000 |
| commit | ac472275098477cb370d1107f9d69e99cdf79175 (patch) | |
| tree | 981e21c11bb7c3b1b672aca9f7f528dfacdcf28c /gnu/usr.sbin/sendmail/smrsh | |
| parent | 287d5c0ae8d639fe6a50dc5910f9ed406a1fe6ce (diff) | |
Patch from sendmail.org to fix potential smrsh bypass described
in http://www.sendmail.org/smrsh.adv.txt
Diffstat (limited to 'gnu/usr.sbin/sendmail/smrsh')
| -rw-r--r-- | gnu/usr.sbin/sendmail/smrsh/smrsh.c | 35 |
1 files changed, 35 insertions, 0 deletions
diff --git a/gnu/usr.sbin/sendmail/smrsh/smrsh.c b/gnu/usr.sbin/sendmail/smrsh/smrsh.c index b5e8e6eb079..36d80d6b254 100644 --- a/gnu/usr.sbin/sendmail/smrsh/smrsh.c +++ b/gnu/usr.sbin/sendmail/smrsh/smrsh.c @@ -57,6 +57,8 @@ SM_IDSTR(id, "@(#)$Sendmail: smrsh.c,v 8.58 2002/05/25 02:41:31 ca Exp $") #include <sm/limits.h> #include <sm/string.h> #include <sys/file.h> +#include <sys/types.h> +#include <sys/stat.h> #include <string.h> #include <ctype.h> #include <errno.h> @@ -145,6 +147,7 @@ main(argc, argv) char *newenv[2]; char pathbuf[1000]; char specialbuf[32]; + struct stat st; #ifndef DEBUG # ifndef LOG_MAIL @@ -302,6 +305,38 @@ main(argc, argv) (void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "Trying %s\n", cmdbuf); #endif /* DEBUG */ + if (stat(cmdbuf, &st) < 0) + { + /* can't stat it */ + (void) sm_io_fprintf(smioerr, SM_TIME_DEFAULT, + "%s: %s not available for sendmail programs (stat failed)\n", + prg, cmd); + if (p != NULL) + *p = ' '; +#ifndef DEBUG + syslog(LOG_CRIT, "uid %d: attempt to use %s (stat failed)", + (int) getuid(), cmd); +#endif /* ! DEBUG */ + exit(EX_UNAVAILABLE); + } + if (!S_ISREG(st.st_mode) +#ifdef S_ISLNK + && !S_ISLNK(st.st_mode) +#endif /* S_ISLNK */ + ) + { + /* can't stat it */ + (void) sm_io_fprintf(smioerr, SM_TIME_DEFAULT, + "%s: %s not available for sendmail programs (not a file)\n", + prg, cmd); + if (p != NULL) + *p = ' '; +#ifndef DEBUG + syslog(LOG_CRIT, "uid %d: attempt to use %s (not a file)", + (int) getuid(), cmd); +#endif /* ! DEBUG */ + exit(EX_UNAVAILABLE); + } if (access(cmdbuf, X_OK) < 0) { /* oops.... crack attack possiblity */ |