summaryrefslogtreecommitdiff
path: root/lib/libpthread
diff options
context:
space:
mode:
authorchristos <christos@NetBSD.org>2014-12-16 19:30:24 +0000
committerchristos <christos@NetBSD.org>2014-12-16 19:30:24 +0000
commitb3ead97fcc4f83d232e3b3e669a4728a8d2ebc62 (patch)
tree2c22120d3ec63d53b497412358940663ebbdce66 /lib/libpthread
parent0290ef3248a7279c1f92f9e747589a1cbfd62b7e (diff)
Fix various security related issues:
0001. Do not recognize paths, mail folders, and pipes in mail addresses by default. That avoids a direct command injection with syntactically valid email addresses starting with |. Such addresses can be specified both on the command line, the mail headers (with -t) or in address lines copied over from previous while replying. This was assigned CVE-2014-7844 for some versions of BSD mailx. It is documented behavior for Heirloom mailx, and was mentioned in an old technical report about BSD mailx (which does not usually make its way into operating system installations). The patch switches off this processing and updates the documentation. Added expandaddr option to explicitly enable this behavior. 0002. When invoking sendmail, prevent option processing for email address arguments. This prevents changing e.g. the Postfix configuration file in unexpected ways. This behavior was documented for BSD mailx (sort of), but not for Heirloom mailx. We did not assign a CVE to this because it is more of a missing feature, and code invoking mailx needs adjustment in the caller as well. Fixed. 0003. Make wordexp support mandatory. (No functional change.) Fixed (replaced explicit shell pipe implementation). 0004. Prevent command execution in the expand function, which is IMHO unexpected. (Not really required with patch 1, and there is still information disclosure/DoS potential if this expansion occurs.) This is a historic vulnerability already fixed in the Debian package, retroactively assigned CVE-2004-2771: Fixed (as part of the pipe replacement with wordexp).
Diffstat (limited to 'lib/libpthread')
0 files changed, 0 insertions, 0 deletions