Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
X-Mailer: MIME-tools 5.420 (Entity 5.420)
From: tlyu@mit.edu
Subject: SVN Commit
RT-Send-CC:
X-RT-Original-Encoding: iso-8859-1
Content-Length: 788

pull up r19396 from trunk

 r19396@cathode-dark-space:  tlyu | 2007-04-03 17:27:25 -0400
 ticket: new
 subject: MITKRB5-SA-2007-001: telnetd allows login as arbitrary user
 tags: pullup
 target_version: 1.6.1
 
 Fix MITKRB5-SA-2007-001:
 
 	* src/appl/telnet/telnetd/sys_term.c (start_login): Add "--"
 	argument preceding username, in addition to the original patch.
 	Explicitly check for leading hyphen in username.
 
 	* src/appl/telnet/telnetd/state.c (envvarok): Check for leading
 	hyphen in environment variables.  On advice from Shawn Emery, not
 	using strchr() as in the original patch.
 
 


Commit By: tlyu



Revision: 19398
Changed Files:
_U  branches/krb5-1-6/
U   branches/krb5-1-6/src/appl/telnet/telnetd/state.c
U   branches/krb5-1-6/src/appl/telnet/telnetd/sys_term.c