Attachment 312664 Details for Bug 456314 – Proposed upstream patch

[patch] Proposed upstream patch

CVE-2008-2936.patch (text/plain), 2.31 KB, created by Josh Bressers on 2008-07-25 18:33:33 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Josh Bressers

Created: 2008-07-25 18:33:33 UTC

Size: 2.31 KB

patch

obsolete

>*** src/util/safe_open.c.orig	Sun Jun  4 19:04:49 2006
>--- src/util/safe_open.c	Thu Jul 24 14:01:54 2008
>***************
>*** 83,88 ****
>--- 83,89 ----
>  #include <msg.h>
>  #include <vstream.h>
>  #include <vstring.h>
>+ #include <stringops.h>
>  #include <safe_open.h>
>  
>  /* safe_open_exist - open existing file */
>***************
>*** 138,150 ****
>       * for symlinks owned by root. NEVER, NEVER, make exceptions for symlinks
>       * owned by a non-root user. This would open a security hole when
>       * delivering mail to a world-writable mailbox directory.
>       */
>      else if (lstat(path, &lstat_st) < 0) {
>  	vstring_sprintf(why, "file status changed unexpectedly: %m");
>  	errno = EPERM;
>      } else if (S_ISLNK(lstat_st.st_mode)) {
>! 	if (lstat_st.st_uid == 0)
>! 	    return (fp);
>  	vstring_sprintf(why, "file is a symbolic link");
>  	errno = EPERM;
>      } else if (fstat_st->st_dev != lstat_st.st_dev
>--- 139,168 ----
>       * for symlinks owned by root. NEVER, NEVER, make exceptions for symlinks
>       * owned by a non-root user. This would open a security hole when
>       * delivering mail to a world-writable mailbox directory.
>+      * 
>+      * The semantics of link(symlink, target) has changed over time.
>+      * Traditionally, UNIX systems hardlink the target of the symlink.
>+      * However, some systems hardlink the symlink itself. The latter behavior
>+      * was introduced with Solaris 2.0, and with Linux kernel 2.0. Sebastian
>+      * Krahmer of SuSE found that hardlinks to symlinks could be used to
>+      * append mail for root to a sensitive file. For this reason, we not
>+      * only require that a symlink is owned by root, but we now also require
>+      * that its parent directory is writable only by root.
>       */
>      else if (lstat(path, &lstat_st) < 0) {
>  	vstring_sprintf(why, "file status changed unexpectedly: %m");
>  	errno = EPERM;
>      } else if (S_ISLNK(lstat_st.st_mode)) {
>! 	if (lstat_st.st_uid == 0) {
>! 	    struct stat parent_st;
>! 	    const char *parent;
>! 
>! 	    parent = sane_dirname((VSTRING *) 0, path);
>! 	    if (stat(parent, &parent_st) == 0	/* real parent */
>! 		&& parent_st.st_uid == 0
>! 		&& (parent_st.st_mode & (S_IWGRP | S_IWOTH)) == 0)
>! 		return (fp);
>! 	}
>  	vstring_sprintf(why, "file is a symbolic link");
>  	errno = EPERM;
>      } else if (fstat_st->st_dev != lstat_st.st_dev

Actions: View | Diff

Attachments on bug 456314: 312664 | 313762