summaryrefslogtreecommitdiff
path: root/gnu/libexec
diff options
context:
space:
mode:
authoritojun <itojun@NetBSD.org>2001-09-12 07:51:03 +0000
committeritojun <itojun@NetBSD.org>2001-09-12 07:51:03 +0000
commit1f8d9cbdd1868052f256cfd6845f9aff6e41b690 (patch)
treeeb794971875d706242bd38765f819b14093cfdf0 /gnu/libexec
parent044635794cb757ea485e72c5a518efbc0a6319f6 (diff)
pull patch from openbsd Errata 033:
A security hole exists in uucp(1), uux(1) and uuxqt(1) that may allow an attacker on the local machine to run arbitrary commands with root privileges. Fix: Pay more attention to commandline parsing of long options. Patch from jbj@redhat.com via millert@.
Diffstat (limited to 'gnu/libexec')
-rw-r--r--gnu/libexec/uucp/uuxqt/uuxqt.c40
1 files changed, 39 insertions, 1 deletions
diff --git a/gnu/libexec/uucp/uuxqt/uuxqt.c b/gnu/libexec/uucp/uuxqt/uuxqt.c
index a4d6595089e..0814a6789ce 100644
--- a/gnu/libexec/uucp/uuxqt/uuxqt.c
+++ b/gnu/libexec/uucp/uuxqt/uuxqt.c
@@ -26,7 +26,7 @@
#include "uucp.h"
#if USE_RCS_ID
-const char uuxqt_rcsid[] = "$Id: uuxqt.c,v 1.3 1995/08/24 05:23:43 jtc Exp $";
+const char uuxqt_rcsid[] = "$Id: uuxqt.c,v 1.4 2001/09/12 07:51:03 itojun Exp $";
#endif
#include <errno.h>
@@ -928,6 +928,44 @@ uqdo_xqt_file (puuconf, zfile, zbase, qsys, zlocalname, zcmd, pfprocessed)
don't permit multiple arguments. */
for (i = 1; azQargs[i] != NULL; i++)
{
+ if (azQargs[i][0] == '-' && azQargs[i][1] == '-')
+ {
+ char *zopts = azQargs[i] + 2;
+
+ /* The -g, -n, and -s options take an argument. */
+ if (!strncmp(zopts, "grade", 5) && zopts[5] != '=')
+ {
+ if (azQargs[i+1] != NULL)
+ ++i;
+ }
+ if (!(strncmp(zopts, "notify", 6)
+ && strncmp(zopts, "status", 6)) && zopts[6] != '=')
+ {
+ if (azQargs[i+1] != NULL)
+ ++i;
+ }
+
+ /* The -I, -u and -x options are not permitted. */
+ if (!strncmp(zopts, "config", 6))
+ {
+ if (zopts[6] != '=' && azQargs[i+1] != NULL)
+ ++i;
+ azQargs[i] = zbufcpy ("--nouucico");
+ }
+ if (!strncmp(zopts, "user", 4))
+ {
+ if (zopts[4] != '=' && azQargs[i+1] != NULL)
+ ++i;
+ azQargs[i] = zbufcpy ("--nouucico");
+ }
+ if (!strncmp(zopts, "debug", 5))
+ {
+ if (zopts[5] != '=' && azQargs[i+1] != NULL)
+ ++i;
+ azQargs[i] = zbufcpy ("--nouucico");
+ }
+ }
+ else
if (azQargs[i][0] == '-')
{
char *zopts;