When hostname len > 8, name replaced with dot notation when -u flag
not specified (default case). Use _PATH_* for utmp/wtmp. Support for >32 PTYs. >Submitted by: Heikki Suonsivu <hsu@cs.hut.fi> Plug already known security hole. (Brought over from 1.1.5): Fixed security problem with telnetd, which allowed telnet -l -hcert.org localhost to change the user's host in utmp. Thanks to Matthew Green <mrgreen@@mame.mu.oz.au> for showing me this one. >Reviewed by: karl, guido >Submitted by: mrgreen@mame.mu.oz.au Obtained from: FreeBSD insecure telnetd
This commit is contained in:
parent
4fd39f708a
commit
4a0834a5a2
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=9592
@ -46,9 +46,9 @@ static char sccsid[] = "@(#)sys_term.c 8.4 (Berkeley) 5/30/95";
|
|||||||
# define PARENT_DOES_UTMP
|
# define PARENT_DOES_UTMP
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
|
int utmp_len = MAXHOSTNAMELEN;
|
||||||
#ifdef NEWINIT
|
#ifdef NEWINIT
|
||||||
#include <initreq.h>
|
#include <initreq.h>
|
||||||
int utmp_len = MAXHOSTNAMELEN; /* sizeof(init_request.host) */
|
|
||||||
#else /* NEWINIT*/
|
#else /* NEWINIT*/
|
||||||
# ifdef UTMPX
|
# ifdef UTMPX
|
||||||
# include <utmpx.h>
|
# include <utmpx.h>
|
||||||
@ -58,10 +58,17 @@ struct utmpx wtmp;
|
|||||||
struct utmp wtmp;
|
struct utmp wtmp;
|
||||||
# endif /* UTMPX */
|
# endif /* UTMPX */
|
||||||
|
|
||||||
int utmp_len = sizeof(wtmp.ut_host);
|
|
||||||
# ifndef PARENT_DOES_UTMP
|
# ifndef PARENT_DOES_UTMP
|
||||||
|
#ifdef _PATH_WTMP
|
||||||
|
char wtmpf[] = _PATH_WTMP;
|
||||||
|
#else
|
||||||
char wtmpf[] = "/usr/adm/wtmp";
|
char wtmpf[] = "/usr/adm/wtmp";
|
||||||
|
#endif
|
||||||
|
#ifdef _PATH_UTMP
|
||||||
|
char utmpf[] = _PATH_UTMP;
|
||||||
|
#else
|
||||||
char utmpf[] = "/etc/utmp";
|
char utmpf[] = "/etc/utmp";
|
||||||
|
#endif
|
||||||
# else /* PARENT_DOES_UTMP */
|
# else /* PARENT_DOES_UTMP */
|
||||||
char wtmpf[] = "/etc/wtmp";
|
char wtmpf[] = "/etc/wtmp";
|
||||||
# endif /* PARENT_DOES_UTMP */
|
# endif /* PARENT_DOES_UTMP */
|
||||||
@ -504,7 +511,7 @@ int *ptynum;
|
|||||||
p2 = &line[14];
|
p2 = &line[14];
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
for (cp = "pqrstuvwxyzPQRST"; *cp; cp++) {
|
for (cp = "pqrsPQRS"; *cp; cp++) {
|
||||||
struct stat stb;
|
struct stat stb;
|
||||||
|
|
||||||
*p1 = *cp;
|
*p1 = *cp;
|
||||||
@ -516,8 +523,8 @@ int *ptynum;
|
|||||||
*/
|
*/
|
||||||
if (stat(line, &stb) < 0)
|
if (stat(line, &stb) < 0)
|
||||||
break;
|
break;
|
||||||
for (i = 0; i < 16; i++) {
|
for (i = 0; i < 32; i++) {
|
||||||
*p2 = "0123456789abcdef"[i];
|
*p2 = "0123456789abcdefghijklmnopqrstuv"[i];
|
||||||
p = open(line, 2);
|
p = open(line, 2);
|
||||||
if (p > 0) {
|
if (p > 0) {
|
||||||
#ifndef __hpux
|
#ifndef __hpux
|
||||||
@ -1544,7 +1551,7 @@ start_login(host, autologin, name)
|
|||||||
{
|
{
|
||||||
register char *cp;
|
register char *cp;
|
||||||
register char **argv;
|
register char **argv;
|
||||||
char **addarg();
|
char **addarg(), *user;
|
||||||
extern char *getenv();
|
extern char *getenv();
|
||||||
#ifdef UTMPX
|
#ifdef UTMPX
|
||||||
register int pid = getpid();
|
register int pid = getpid();
|
||||||
@ -1727,7 +1734,12 @@ start_login(host, autologin, name)
|
|||||||
# endif
|
# endif
|
||||||
} else
|
} else
|
||||||
#endif
|
#endif
|
||||||
if (getenv("USER")) {
|
if (user = getenv("USER")) {
|
||||||
|
if (strchr(user, '-')) {
|
||||||
|
syslog(LOG_ERR, "tried to pass user \"%s\" to login",
|
||||||
|
user);
|
||||||
|
fatal(net, "invalid user");
|
||||||
|
}
|
||||||
argv = addarg(argv, getenv("USER"));
|
argv = addarg(argv, getenv("USER"));
|
||||||
#if defined(LOGIN_ARGS) && defined(NO_LOGIN_P)
|
#if defined(LOGIN_ARGS) && defined(NO_LOGIN_P)
|
||||||
{
|
{
|
||||||
|
@ -46,9 +46,9 @@ static char sccsid[] = "@(#)sys_term.c 8.4 (Berkeley) 5/30/95";
|
|||||||
# define PARENT_DOES_UTMP
|
# define PARENT_DOES_UTMP
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
|
int utmp_len = MAXHOSTNAMELEN;
|
||||||
#ifdef NEWINIT
|
#ifdef NEWINIT
|
||||||
#include <initreq.h>
|
#include <initreq.h>
|
||||||
int utmp_len = MAXHOSTNAMELEN; /* sizeof(init_request.host) */
|
|
||||||
#else /* NEWINIT*/
|
#else /* NEWINIT*/
|
||||||
# ifdef UTMPX
|
# ifdef UTMPX
|
||||||
# include <utmpx.h>
|
# include <utmpx.h>
|
||||||
@ -58,10 +58,17 @@ struct utmpx wtmp;
|
|||||||
struct utmp wtmp;
|
struct utmp wtmp;
|
||||||
# endif /* UTMPX */
|
# endif /* UTMPX */
|
||||||
|
|
||||||
int utmp_len = sizeof(wtmp.ut_host);
|
|
||||||
# ifndef PARENT_DOES_UTMP
|
# ifndef PARENT_DOES_UTMP
|
||||||
|
#ifdef _PATH_WTMP
|
||||||
|
char wtmpf[] = _PATH_WTMP;
|
||||||
|
#else
|
||||||
char wtmpf[] = "/usr/adm/wtmp";
|
char wtmpf[] = "/usr/adm/wtmp";
|
||||||
|
#endif
|
||||||
|
#ifdef _PATH_UTMP
|
||||||
|
char utmpf[] = _PATH_UTMP;
|
||||||
|
#else
|
||||||
char utmpf[] = "/etc/utmp";
|
char utmpf[] = "/etc/utmp";
|
||||||
|
#endif
|
||||||
# else /* PARENT_DOES_UTMP */
|
# else /* PARENT_DOES_UTMP */
|
||||||
char wtmpf[] = "/etc/wtmp";
|
char wtmpf[] = "/etc/wtmp";
|
||||||
# endif /* PARENT_DOES_UTMP */
|
# endif /* PARENT_DOES_UTMP */
|
||||||
@ -504,7 +511,7 @@ int *ptynum;
|
|||||||
p2 = &line[14];
|
p2 = &line[14];
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
for (cp = "pqrstuvwxyzPQRST"; *cp; cp++) {
|
for (cp = "pqrsPQRS"; *cp; cp++) {
|
||||||
struct stat stb;
|
struct stat stb;
|
||||||
|
|
||||||
*p1 = *cp;
|
*p1 = *cp;
|
||||||
@ -516,8 +523,8 @@ int *ptynum;
|
|||||||
*/
|
*/
|
||||||
if (stat(line, &stb) < 0)
|
if (stat(line, &stb) < 0)
|
||||||
break;
|
break;
|
||||||
for (i = 0; i < 16; i++) {
|
for (i = 0; i < 32; i++) {
|
||||||
*p2 = "0123456789abcdef"[i];
|
*p2 = "0123456789abcdefghijklmnopqrstuv"[i];
|
||||||
p = open(line, 2);
|
p = open(line, 2);
|
||||||
if (p > 0) {
|
if (p > 0) {
|
||||||
#ifndef __hpux
|
#ifndef __hpux
|
||||||
@ -1544,7 +1551,7 @@ start_login(host, autologin, name)
|
|||||||
{
|
{
|
||||||
register char *cp;
|
register char *cp;
|
||||||
register char **argv;
|
register char **argv;
|
||||||
char **addarg();
|
char **addarg(), *user;
|
||||||
extern char *getenv();
|
extern char *getenv();
|
||||||
#ifdef UTMPX
|
#ifdef UTMPX
|
||||||
register int pid = getpid();
|
register int pid = getpid();
|
||||||
@ -1727,7 +1734,12 @@ start_login(host, autologin, name)
|
|||||||
# endif
|
# endif
|
||||||
} else
|
} else
|
||||||
#endif
|
#endif
|
||||||
if (getenv("USER")) {
|
if (user = getenv("USER")) {
|
||||||
|
if (strchr(user, '-')) {
|
||||||
|
syslog(LOG_ERR, "tried to pass user \"%s\" to login",
|
||||||
|
user);
|
||||||
|
fatal(net, "invalid user");
|
||||||
|
}
|
||||||
argv = addarg(argv, getenv("USER"));
|
argv = addarg(argv, getenv("USER"));
|
||||||
#if defined(LOGIN_ARGS) && defined(NO_LOGIN_P)
|
#if defined(LOGIN_ARGS) && defined(NO_LOGIN_P)
|
||||||
{
|
{
|
||||||
|
Loading…
Reference in New Issue
Block a user