From 6d6844d3db7a60700aba1a03b565183435faab20 Mon Sep 17 00:00:00 2001 From: cperciva Date: Fri, 23 Dec 2011 15:00:37 +0000 Subject: Fix a problem whereby a corrupt DNS record can cause named to crash. [11:06] Add an API for alerting internal libc routines to the presence of "unsafe" paths post-chroot, and use it in ftpd. [11:07] Fix a buffer overflow in telnetd. [11:08] Make pam_ssh ignore unpassphrased keys unless the "nullok" option is specified. [11:09] Add sanity checking of service names in pam_start. [11:10] Approved by: so (cperciva) Approved by: re (bz) Security: FreeBSD-SA-11:06.bind Security: FreeBSD-SA-11:07.chroot Security: FreeBSD-SA-11:08.telnetd Security: FreeBSD-SA-11:09.pam_ssh Security: FreeBSD-SA-11:10.pam --- libexec/ftpd/ftpd.c | 1 + libexec/ftpd/popen.c | 3 +++ 2 files changed, 4 insertions(+) (limited to 'libexec') diff --git a/libexec/ftpd/ftpd.c b/libexec/ftpd/ftpd.c index 5894f3c..00570d6 100644 --- a/libexec/ftpd/ftpd.c +++ b/libexec/ftpd/ftpd.c @@ -1562,6 +1562,7 @@ skip: reply(550, "Can't change root."); goto bad; } + __FreeBSD_libc_enter_restricted_mode(); } else /* real user w/o chroot */ homedir = pw->pw_dir; /* diff --git a/libexec/ftpd/popen.c b/libexec/ftpd/popen.c index 8a739dc..9f80507 100644 --- a/libexec/ftpd/popen.c +++ b/libexec/ftpd/popen.c @@ -143,6 +143,9 @@ ftpd_popen(char *program, char *type) } (void)close(pdes[1]); } + /* Drop privileges before proceeding */ + if (getuid() != geteuid() && setuid(geteuid()) < 0) + _exit(1); if (strcmp(gargv[0], _PATH_LS) == 0) { /* Reset getopt for ls_main() */ optreset = optind = optopt = 1; -- cgit v1.1