diff options
| author | gshapiro <gshapiro@FreeBSD.org> | 2002-10-13 00:56:58 +0000 |
|---|---|---|
| committer | gshapiro <gshapiro@FreeBSD.org> | 2002-10-13 00:56:58 +0000 |
| commit | 010f2e91710c50e9cb49dc93d4c857ddfec610e4 (patch) | |
| tree | 172a4353adbdf2a4caad2b09a3fde5ba4a1ba5d3 | |
| parent | 4d58825054ae0800ccc62f72d1c8bf4a6ae89035 (diff) | |
| download | FreeBSD-src-010f2e91710c50e9cb49dc93d4c857ddfec610e4.zip FreeBSD-src-010f2e91710c50e9cb49dc93d4c857ddfec610e4.tar.gz | |
MFS: Fix smrsh bypass bug.
| -rw-r--r-- | contrib/sendmail/smrsh/smrsh.c | 35 |
1 files changed, 35 insertions, 0 deletions
diff --git a/contrib/sendmail/smrsh/smrsh.c b/contrib/sendmail/smrsh/smrsh.c index 2798f3b..74365e3 100644 --- a/contrib/sendmail/smrsh/smrsh.c +++ b/contrib/sendmail/smrsh/smrsh.c @@ -59,6 +59,8 @@ SM_IDSTR(id, "@(#)$Id: smrsh.c,v 8.58 2002/05/25 02:41:31 ca Exp $") #include <sm/limits.h> #include <sm/string.h> #include <sys/file.h> +#include <sys/types.h> +#include <sys/stat.h> #include <string.h> #include <ctype.h> #include <errno.h> @@ -147,6 +149,7 @@ main(argc, argv) char *newenv[2]; char pathbuf[1000]; char specialbuf[32]; + struct stat st; #ifndef DEBUG # ifndef LOG_MAIL @@ -304,6 +307,38 @@ main(argc, argv) (void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "Trying %s\n", cmdbuf); #endif /* DEBUG */ + if (stat(cmdbuf, &st) < 0) + { + /* can't stat it */ + (void) sm_io_fprintf(smioerr, SM_TIME_DEFAULT, + "%s: %s not available for sendmail programs (stat failed)\n", + prg, cmd); + if (p != NULL) + *p = ' '; +#ifndef DEBUG + syslog(LOG_CRIT, "uid %d: attempt to use %s (stat failed)", + (int) getuid(), cmd); +#endif /* ! DEBUG */ + exit(EX_UNAVAILABLE); + } + if (!S_ISREG(st.st_mode) +#ifdef S_ISLNK + && !S_ISLNK(st.st_mode) +#endif /* S_ISLNK */ + ) + { + /* can't stat it */ + (void) sm_io_fprintf(smioerr, SM_TIME_DEFAULT, + "%s: %s not available for sendmail programs (not a file)\n", + prg, cmd); + if (p != NULL) + *p = ' '; +#ifndef DEBUG + syslog(LOG_CRIT, "uid %d: attempt to use %s (not a file)", + (int) getuid(), cmd); +#endif /* ! DEBUG */ + exit(EX_UNAVAILABLE); + } if (access(cmdbuf, X_OK) < 0) { /* oops.... crack attack possiblity */ |
