d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Filter out some more magic environment variables used by libraries linked

Browse Source 
with telnetd. This should really be done with a positive filter - i.e.
only allow through a configured list of variables.

Also do some buffer-safety cleanups while I'm here - I don't think these
are exploitable.
This commit is contained in:
kris 2000-10-31 05:29:54 +00:00
parent 11f32dfee0
commit d710bffe20
3 changed files with 11 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
libexec/telnetd/sys_term.c
View File

@ -1799,6 +1799,13 @@ scrub_env()
strncmp(*cpp, "_RLD_", 5) && strncmp(*cpp, "_RLD_", 5) &&
strncmp(*cpp, "LIBPATH=", 8) && strncmp(*cpp, "LIBPATH=", 8) &&
#endif #endif
strncmp(*cpp, "LOCALDOMAIN=", 12) &&
strncmp(*cpp, "RES_OPTIONS=", 12) &&
strncmp(*cpp, "TERMINFO=", 9) &&
strncmp(*cpp, "TERMINFO_DIRS=", 14) &&
strncmp(*cpp, "TERMPATH=", 9) &&
strncmp(*cpp, "TERMCAP=/", 9) &&
strncmp(*cpp, "ENV=", 4) &&
strncmp(*cpp, "IFS=", 4)) strncmp(*cpp, "IFS=", 4))
*cpp2++ = *cpp; *cpp2++ = *cpp;
} }

4
libexec/telnetd/telnetd.c
View File

@ -811,7 +811,7 @@ doit(who)
fatal(net, "Out of ptys"); fatal(net, "Out of ptys");
if ((pty = open(lp, 2)) >= 0) { if ((pty = open(lp, 2)) >= 0) {
strcpy(line,lp); strlcpy(line,lp,sizeof(line));
line[5] = 't'; line[5] = 't';
break; break;
} }
@ -1115,7 +1115,7 @@ telnet(f, p, host)
IM = Getstr("im", &cp); IM = Getstr("im", &cp);
IF = Getstr("if", &cp); IF = Getstr("if", &cp);
if (HN && *HN) if (HN && *HN)
(void) strcpy(host_name, HN); (void) strlcpy(host_name, HN, sizeof(host_name));
if (IF && (if_fd = open(IF, O_RDONLY, 000)) != -1) if (IF && (if_fd = open(IF, O_RDONLY, 000)) != -1)
IM = 0; IM = 0;
if (IM == 0) if (IM == 0)

4
libexec/telnetd/utility.c
View File

@ -330,7 +330,7 @@ fatal(f, msg)
{ {
char buf[BUFSIZ]; char buf[BUFSIZ];
(void) sprintf(buf, "telnetd: %s.\r\n", msg); (void) snprintf(buf, sizeof(buf), "telnetd: %s.\r\n", msg);
(void) write(f, buf, (int)strlen(buf)); (void) write(f, buf, (int)strlen(buf));
sleep(1); /*XXX*/ sleep(1); /*XXX*/
exit(1); exit(1);
@ -343,7 +343,7 @@ fatalperror(f, msg)
{ {
char buf[BUFSIZ], *strerror(); char buf[BUFSIZ], *strerror();
(void) sprintf(buf, "%s: %s", msg, strerror(errno)); (void) snprintf(buf, sizeof(buf), "%s: %s", msg, strerror(errno));
fatal(f, buf); fatal(f, buf);
} }