Skip Menu |
 

From: tlyu@mit.edu
Subject: SVN Commit
Fix MITKRB5-SA-2007-001:

* src/appl/telnet/telnetd/sys_term.c (start_login): Add "--"
argument preceding username, in addition to the original patch.
Explicitly check for leading hyphen in username.

* src/appl/telnet/telnetd/state.c (envvarok): Check for leading
hyphen in environment variables. On advice from Shawn Emery, not
using strchr() as in the original patch.


Commit By: tlyu



Revision: 19396
Changed Files:
_U trunk/
U trunk/src/appl/telnet/telnetd/state.c
U trunk/src/appl/telnet/telnetd/sys_term.c
From: tlyu@mit.edu
Subject: SVN Commit
pull up r19396 from trunk

r19396@cathode-dark-space: tlyu | 2007-04-03 17:27:25 -0400
ticket: new
subject: MITKRB5-SA-2007-001: telnetd allows login as arbitrary user
tags: pullup
target_version: 1.6.1

Fix MITKRB5-SA-2007-001:

* src/appl/telnet/telnetd/sys_term.c (start_login): Add "--"
argument preceding username, in addition to the original patch.
Explicitly check for leading hyphen in username.

* src/appl/telnet/telnetd/state.c (envvarok): Check for leading
hyphen in environment variables. On advice from Shawn Emery, not
using strchr() as in the original patch.




Commit By: tlyu



Revision: 19398
Changed Files:
_U branches/krb5-1-6/
U branches/krb5-1-6/src/appl/telnet/telnetd/state.c
U branches/krb5-1-6/src/appl/telnet/telnetd/sys_term.c