procyberian/emacs
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix permissions handling (CVE-2010-0825).

Browse source 
* movemail.c (main): Check return values of setuid.  Avoid
possibility of symlink attack when movemail is setgid mail
(CVE-2010-0825).
This commit is contained in:
Chong Yidong 2010-04-02 11:26:24 -04:00
parent a9ae306fe4
commit 51a91f9da6
2 changed files with 25 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

6
lib-src/ChangeLog
View file

@ -1,3 +1,9 @@
2010-04-02 Dan Rosenberg <dan.j.rosenberg@gmail.com> (tiny change)
* movemail.c (main): Check return values of setuid. Avoid
possibility of symlink attack when movemail is setgid mail
(CVE-2010-0825).
2010-04-02 Dan Nicolaescu <dann@ics.uci.edu> 2010-04-02 Dan Nicolaescu <dann@ics.uci.edu>
Remove extern errno declarations. Remove extern errno declarations.

45
lib-src/movemail.c
View file

@ -194,6 +194,9 @@ main (argc, argv)
# define ARGSTR "p" # define ARGSTR "p"
#endif /* MAIL_USE_POP */ #endif /* MAIL_USE_POP */
uid_t real_gid = getgid();
uid_t priv_gid = getegid();
#ifdef WINDOWSNT #ifdef WINDOWSNT
/* Ensure all file i/o is in binary mode. */ /* Ensure all file i/o is in binary mode. */
_fmode = _O_BINARY; _fmode = _O_BINARY;
@ -244,25 +247,6 @@ main (argc, argv)
if (*outname == 0) if (*outname == 0)
fatal ("Destination file name is empty", 0, 0); fatal ("Destination file name is empty", 0, 0);
/* Check access to output file. */
if (access (outname, F_OK) == 0 && access (outname, W_OK) != 0)
pfatal_with_name (outname);
/* Also check that outname's directory is writable to the real uid. */
{
char *buf = (char *) xmalloc (strlen (outname) + 1);
char *p;
strcpy (buf, outname);
p = buf + strlen (buf);
while (p > buf && !IS_DIRECTORY_SEP (p[-1]))
*--p = 0;
if (p == buf)
*p++ = '.';
if (access (buf, W_OK) != 0)
pfatal_with_name (buf);
free (buf);
}
#ifdef MAIL_USE_POP #ifdef MAIL_USE_POP
if (!strncmp (inname, "po:", 3)) if (!strncmp (inname, "po:", 3))
{ {
@ -274,15 +258,12 @@ main (argc, argv)
exit (status); exit (status);
} }
setuid (getuid ()); if (setuid (getuid ()) < 0)
fatal ("Failed to drop privileges", 0, 0);
#endif /* MAIL_USE_POP */ #endif /* MAIL_USE_POP */
#ifndef DISABLE_DIRECT_ACCESS #ifndef DISABLE_DIRECT_ACCESS
/* Check access to input file. */
if (access (inname, R_OK | W_OK) != 0)
pfatal_with_name (inname);
#ifndef MAIL_USE_MMDF #ifndef MAIL_USE_MMDF
#ifndef MAIL_USE_SYSTEM_LOCK #ifndef MAIL_USE_SYSTEM_LOCK
#ifdef MAIL_USE_MAILLOCK #ifdef MAIL_USE_MAILLOCK
@ -376,7 +357,8 @@ main (argc, argv)
time_t touched_lock, now; time_t touched_lock, now;
#endif #endif
setuid (getuid ()); if (setuid (getuid ()) < 0 || setegid (real_gid) < 0)
fatal ("Failed to drop privileges", 0, 0);
#ifndef MAIL_USE_MMDF #ifndef MAIL_USE_MMDF
#ifdef MAIL_USE_SYSTEM_LOCK #ifdef MAIL_USE_SYSTEM_LOCK
@ -402,6 +384,9 @@ main (argc, argv)
if (outdesc < 0) if (outdesc < 0)
pfatal_with_name (outname); pfatal_with_name (outname);
if (setegid (priv_gid) < 0)
fatal ("Failed to regain privileges", 0, 0);
/* This label exists so we can retry locking /* This label exists so we can retry locking
after a delay, if it got EAGAIN or EBUSY. */ after a delay, if it got EAGAIN or EBUSY. */
retry_lock: retry_lock:
@ -495,6 +480,10 @@ main (argc, argv)
pfatal_and_delete (outname); pfatal_and_delete (outname);
#endif #endif
/* Prevent symlink attacks truncating other users' mailboxes */
if (setegid (real_gid) < 0)
fatal ("Failed to drop privileges", 0, 0);
/* Check to make sure no errors before we zap the inbox. */ /* Check to make sure no errors before we zap the inbox. */
if (close (outdesc) != 0) if (close (outdesc) != 0)
pfatal_and_delete (outname); pfatal_and_delete (outname);
@ -526,6 +515,10 @@ main (argc, argv)
} }
#endif /* not MAIL_USE_SYSTEM_LOCK */ #endif /* not MAIL_USE_SYSTEM_LOCK */
/* End of mailbox truncation */
if (setegid (priv_gid) < 0)
fatal ("Failed to regain privileges", 0, 0);
#ifdef MAIL_USE_MAILLOCK #ifdef MAIL_USE_MAILLOCK
/* This has to occur in the child, i.e., in the process that /* This has to occur in the child, i.e., in the process that
acquired the lock! */ acquired the lock! */