diff options
Diffstat (limited to 'lib-src')
| -rw-r--r-- | lib-src/ChangeLog | 28 | ||||
| -rw-r--r-- | lib-src/makefile.w32-in | 2 | ||||
| -rw-r--r-- | lib-src/movemail.c | 45 | ||||
| -rw-r--r-- | lib-src/ntlib.c | 18 | ||||
| -rw-r--r-- | lib-src/ntlib.h | 3 |
5 files changed, 61 insertions, 35 deletions
diff --git a/lib-src/ChangeLog b/lib-src/ChangeLog index caa7f3cfc80..a68629d2393 100644 --- a/lib-src/ChangeLog +++ b/lib-src/ChangeLog @@ -1,3 +1,15 @@ +2010-04-03 Juanma Barranquero <lekktu@gmail.com> + + Add stubs for Windows, required after CVE-2010-0825 change. + * ntlib.c (getgid, getegid, setegid): New stubs. + * ntlib.h (getgid, getegid, setegid): Declare them. + +2010-04-02 Dan Rosenberg <dan.j.rosenberg@gmail.com> (tiny change) + + * movemail.c (main): Check return values of setuid. Avoid + possibility of symlink attack when movemail is setgid mail + (CVE-2010-0825). + 2010-03-19 Tetsurou Okazaki <okazaki@be.to> (tiny change) * Makefile.in (uninstall): Handle the case where archlibdir does @@ -3942,7 +3954,7 @@ (xmalloc, fatal, error): New functions. (delete_socket, handle_signals): New functions. (progname, socket_name): New variables. - [HAVE_SOCKETS] (main): Call handle_signals; set the new variables. + [HAVE_SOCKETS] (main): Call handle_signals; set the new variables. 1996-09-01 Richard Stallman <rms@ethanol.gnu.ai.mit.edu> @@ -4715,9 +4727,9 @@ 1995-01-12 Francesco Potortì (pot@cnuce.cnr.it) * etags.c (FILEPOS, GET_CHARNO, GET_FILEPOS, max, LINENO): Deleted. - (append_to_tagfile, typedefs, typedefs_and_cplusplus, - constantypedefs, update, vgrind_style, no_warnings, - cxref_style, cplusplus, noindentypedefs): Were int, now logical. + (append_to_tagfile, typedefs, typedefs_and_cplusplus) + (constantypedefs, update, vgrind_style, no_warnings) + (cxref_style, cplusplus, noindentypedefs): Were int, now logical. (permit_duplicates): Was a var, now a #define. (filename_lb): Was global, now local to main. (main): Open the tag file when in cxref mode. @@ -4736,8 +4748,8 @@ (TOKEN_SAVED_P, SAVE_TOKEN, RESTORE_TOKEN): Deleted. (C_entries): nameb and savenameb deleted. Use dinamic allocation. (pfcnt): Deleted. Users updated. - (getit, Asm_labels, Pascal_functions, L_getit, get_scheme, - TEX_getit, prolog_getit): Use dinamic allocation for storing + (getit, Asm_labels, Pascal_functions, L_getit, get_scheme) + (TEX_getit, prolog_getit): Use dinamic allocation for storing the tag instead of a fixed size buffer. 1995-01-10 Richard Stallman <rms@mole.gnu.ai.mit.edu> @@ -6662,8 +6674,8 @@ 1990-01-19 David Lawrence (tale@cocoa-puffs) * timer.c, getdate.y (new files) and Makefile: - Sub-process support for run-at-time in timer.el. - Doesn't yet work correctly for USG. + Sub-process support for run-at-time in timer.el. + Doesn't yet work correctly for USG. 1990-01-10 Jim Kingdon (kingdon@pogo) diff --git a/lib-src/makefile.w32-in b/lib-src/makefile.w32-in index b59273ef33d..131cca7fdd7 100644 --- a/lib-src/makefile.w32-in +++ b/lib-src/makefile.w32-in @@ -22,7 +22,7 @@ ALL = make-docfile hexl ctags etags movemail ebrowse sorted-doc digest-doc emacs .PHONY: $(ALL) -VERSION = 23.1.94 +VERSION = 23.1.95 LOCAL_FLAGS = -DWINDOWSNT -DDOS_NT -DSTDC_HEADERS=1 -DNO_LDAV=1 \ -DNO_ARCHIVES=1 -DHAVE_CONFIG_H=1 -I../nt/inc \ diff --git a/lib-src/movemail.c b/lib-src/movemail.c index e0eb4d48b89..ae51df3d39c 100644 --- a/lib-src/movemail.c +++ b/lib-src/movemail.c @@ -197,6 +197,9 @@ main (argc, argv) # define ARGSTR "p" #endif /* MAIL_USE_POP */ + uid_t real_gid = getgid(); + uid_t priv_gid = getegid(); + #ifdef WINDOWSNT /* Ensure all file i/o is in binary mode. */ _fmode = _O_BINARY; @@ -247,25 +250,6 @@ main (argc, argv) if (*outname == 0) fatal ("Destination file name is empty", 0, 0); - /* Check access to output file. */ - if (access (outname, F_OK) == 0 && access (outname, W_OK) != 0) - pfatal_with_name (outname); - - /* Also check that outname's directory is writable to the real uid. */ - { - char *buf = (char *) xmalloc (strlen (outname) + 1); - char *p; - strcpy (buf, outname); - p = buf + strlen (buf); - while (p > buf && !IS_DIRECTORY_SEP (p[-1])) - *--p = 0; - if (p == buf) - *p++ = '.'; - if (access (buf, W_OK) != 0) - pfatal_with_name (buf); - free (buf); - } - #ifdef MAIL_USE_POP if (!strncmp (inname, "po:", 3)) { @@ -277,15 +261,12 @@ main (argc, argv) exit (status); } - setuid (getuid ()); + if (setuid (getuid ()) < 0) + fatal ("Failed to drop privileges", 0, 0); + #endif /* MAIL_USE_POP */ #ifndef DISABLE_DIRECT_ACCESS - - /* Check access to input file. */ - if (access (inname, R_OK | W_OK) != 0) - pfatal_with_name (inname); - #ifndef MAIL_USE_MMDF #ifndef MAIL_USE_SYSTEM_LOCK #ifdef MAIL_USE_MAILLOCK @@ -379,7 +360,8 @@ main (argc, argv) time_t touched_lock, now; #endif - setuid (getuid ()); + if (setuid (getuid ()) < 0 || setegid (real_gid) < 0) + fatal ("Failed to drop privileges", 0, 0); #ifndef MAIL_USE_MMDF #ifdef MAIL_USE_SYSTEM_LOCK @@ -405,6 +387,9 @@ main (argc, argv) if (outdesc < 0) pfatal_with_name (outname); + if (setegid (priv_gid) < 0) + fatal ("Failed to regain privileges", 0, 0); + /* This label exists so we can retry locking after a delay, if it got EAGAIN or EBUSY. */ retry_lock: @@ -498,6 +483,10 @@ main (argc, argv) pfatal_and_delete (outname); #endif + /* Prevent symlink attacks truncating other users' mailboxes */ + if (setegid (real_gid) < 0) + fatal ("Failed to drop privileges", 0, 0); + /* Check to make sure no errors before we zap the inbox. */ if (close (outdesc) != 0) pfatal_and_delete (outname); @@ -529,6 +518,10 @@ main (argc, argv) } #endif /* not MAIL_USE_SYSTEM_LOCK */ + /* End of mailbox truncation */ + if (setegid (priv_gid) < 0) + fatal ("Failed to regain privileges", 0, 0); + #ifdef MAIL_USE_MAILLOCK /* This has to occur in the child, i.e., in the process that acquired the lock! */ diff --git a/lib-src/ntlib.c b/lib-src/ntlib.c index ae10caecd22..c815f32d51d 100644 --- a/lib-src/ntlib.c +++ b/lib-src/ntlib.c @@ -125,12 +125,30 @@ getuid () return 0; } +unsigned +getgid () +{ + return 0; +} + +unsigned +getegid () +{ + return 0; +} + int setuid (unsigned uid) { return 0; } +int +setegid (unsigned gid) +{ + return 0; +} + struct passwd * getpwuid (unsigned uid) { diff --git a/lib-src/ntlib.h b/lib-src/ntlib.h index 70b99d7a779..ab1e7ba2866 100644 --- a/lib-src/ntlib.h +++ b/lib-src/ntlib.h @@ -36,7 +36,10 @@ int getppid(void); char * getlogin (); char * cuserid (char * s); unsigned getuid (); +unsigned getegid (); +unsigned getgid (); int setuid (unsigned uid); +int setegid (unsigned gid); char * getpass (const char * prompt); int fchown (int fd, unsigned uid, unsigned gid); |