d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Incorporate two security fixes from later versions of CVS.

Browse Source 
From the NEWS file of cvs 1.11.11:

  * pserver can no longer be configured to run as root via the
    $CVSROOT/CVSROOT/passwd file, so if your passwd file is
    compromised, it no longer leads directly to a root hack.  Attempts
    to root will also be logged via the syslog.

  * Malformed module requests could cause the CVS server to attempt
    to create directories and possibly files at the root of the
    filesystem holding the CVS repository.  Filesystem permissions
    usually prevent the creation of these misplaced directories, but
    nevertheless, the CVS server now rejects the malformed requests.

Obtained from:	ccvs.cvshome.org
This commit is contained in:
Jacques Vidrine 2004-01-21 16:27:56 +00:00
parent 794bef18e7
commit c8ae5f0562
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/vendor/cvs/dist/; revision=124793
2 changed files with 30 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
contrib/cvs/src/modules.c
View File

@ -159,6 +159,17 @@ do_module (db, mname, m_type, msg, callback_proc, where, shorten,
}
#endif
/* Don't process absolute directories. Anything else could be a security
* problem. Before this check was put in place:
*
* $ cvs -d:fork:/cvsroot co /foo
* cvs server: warning: cannot make directory CVS in /: Permission denied
* cvs [server aborted]: cannot make directory /foo: Permission denied
* $
*/
if (isabsolute (mname))
error (1, 0, "Absolute module reference invalid: `%s'", mname);
/* if this is a directory to ignore, add it to that list */
if (mname[0] == '!' && mname[1] != '\0')
{

23
contrib/cvs/src/server.c
View File

@ -5230,10 +5230,11 @@ error ENOMEM Virtual memory exhausted.\n");
#if defined (HAVE_KERBEROS) || defined (AUTH_SERVER_SUPPORT) || defined (HAVE_GSSAPI)
static void switch_to_user PROTO((const char *));
static void switch_to_user PROTO((const char *, const char *));
static void
switch_to_user (username)
switch_to_user (cvs_username, username)
const char *cvs_username; /* Only used for error messages. */
const char *username;
{
struct passwd *pw;
@ -5250,6 +5251,20 @@ error 0 %s: no such user\n", username);
error_exit ();
}
if (pw->pw_uid == 0)
{
#ifdef HAVE_SYSLOG_H
/* FIXME: Can the IP address of the connecting client be retrieved
* and printed here?
*/
syslog (LOG_DAEMON | LOG_ALERT,
"attempt to root from account: %s", cvs_username
);
#endif
printf("error 0: root not allowed\n");
error_exit ();
}
#if HAVE_INITGROUPS
if (initgroups (pw->pw_name, pw->pw_gid) < 0
# ifdef EPERM
@ -5824,7 +5839,7 @@ pserver_authenticate_connection ()
strcpy (Pserver_Repos, repository);
/* Switch to run as this user. */
switch_to_user (host_user);
switch_to_user (username, host_user);
free (host_user);
free (tmp);
free (repository);
@ -6017,7 +6032,7 @@ gserver_authenticate_connection ()
error (1, errno, "fwrite failed");
}
switch_to_user (buf);
switch_to_user ("GSSAPI", buf);
printf ("I LOVE YOU\n");
fflush (stdout);