d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

In _yp_dobind(), if we find ourselves required to contact the local ypbind

Browse Source 
directly in order to obtain binding information, check that the local
ypbind is using a reserved port and return YPERR_YPBIND if it isn't.
We should not trust any ypbind running on a port >= IPPORT_RESERVED;
it may have been started by a malicious user hoping to trick us into
talking to a bogus ypserv.

Note that we do not check the ypserv port returned to us from ypbind.
It is assumed that ypbind has already done a reserved port test (or not,
depending on whether or not it was started with -s); if we trust the
authenticity of the local ypbind, we should also trust its judgement.

Obtained from: OpenBSD
This commit is contained in:
Bill Paul 1996-07-13 20:23:13 +00:00
parent 54009bb4b8
commit 56d18eda29
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=17162
1 changed files with 18 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
lib/libc/yp/yplib.c
View File

@ -369,6 +369,17 @@ _yp_dobind(dom, ypdb)
return (YPERR_YPBIND);
}
/*
* Check the port number -- should be < IPPORT_RESERVED.
* If not, it's possible someone has registered a bogus
* ypbind with the portmapper and is trying to trick us.
*/
if (ntohs(clnt_sin.sin_port) >= IPPORT_RESERVED) {
clnt_destroy(client);
if (new)
free(ysd);
return(YPERR_YPBIND);
}
tv.tv_sec = _yplib_timeout/2;
tv.tv_usec = 0;
r = clnt_call(client, YPBINDPROC_DOMAIN,
@ -400,6 +411,13 @@ _yp_dobind(dom, ypdb)
*(u_short *)&ypbr.ypbind_resp_u.ypbind_bindinfo.ypbind_binding_port;
ysd->dom_server_addr.sin_addr.s_addr =
*(u_long *)&ypbr.ypbind_resp_u.ypbind_bindinfo.ypbind_binding_addr;
/*
* We could do a reserved port check here too, but this
* could pose compatibility problems. The local ypbind is
* supposed to decide whether or not to trust yp servers
* on insecure ports. For now, we trust its judgement.
*/
ysd->dom_server_port =
*(u_short *)&ypbr.ypbind_resp_u.ypbind_bindinfo.ypbind_binding_port;
gotit: