Ticket History #5508: MITKRB5-SA-2007-001: telnetd allows login as arbitrary user

# Tue Apr 03 17:27:31 2007 tlyu (Taylor Yu) - Ticket created

From:	tlyu@mit.edu
Subject:	SVN Commit

Download (untitled) / with headers
text/plain 528B

Fix MITKRB5-SA-2007-001:

* src/appl/telnet/telnetd/sys_term.c (start_login): Add "--"
argument preceding username, in addition to the original patch.
Explicitly check for leading hyphen in username.

* src/appl/telnet/telnetd/state.c (envvarok): Check for leading
hyphen in environment variables. On advice from Shawn Emery, not
using strchr() as in the original patch.

Commit By: tlyu

Revision: 19396
Changed Files:
_U trunk/
U trunk/src/appl/telnet/telnetd/state.c
U trunk/src/appl/telnet/telnetd/sys_term.c

# Tue Apr 03 17:27:33 2007 tlyu (Taylor Yu) - Requestor tlyu (Taylor Yu) added

# Tue Apr 03 17:27:33 2007 tlyu (Taylor Yu) - Status changed from 'new' to 'resolved'

# Tue Apr 03 17:27:34 2007 tlyu (Taylor Yu) - Tags pullup added

# Tue Apr 03 17:27:35 2007 tlyu (Taylor Yu) - Target_Version 1.6.1 added

# Wed Apr 04 17:39:32 2007 tlyu (Taylor Yu) - Version_Fixed 1.6.1 added

# Wed Apr 04 17:39:32 2007 tlyu (Taylor Yu) - Correspondence added

From:	tlyu@mit.edu
Subject:	SVN Commit

Download (untitled) / with headers
text/plain 788B

pull up r19396 from trunk

r19396@cathode-dark-space: tlyu | 2007-04-03 17:27:25 -0400
ticket: new
subject: MITKRB5-SA-2007-001: telnetd allows login as arbitrary user
tags: pullup
target_version: 1.6.1

Fix MITKRB5-SA-2007-001:

* src/appl/telnet/telnetd/sys_term.c (start_login): Add "--"
argument preceding username, in addition to the original patch.
Explicitly check for leading hyphen in username.

* src/appl/telnet/telnetd/state.c (envvarok): Check for leading
hyphen in environment variables. On advice from Shawn Emery, not
using strchr() as in the original patch.

Commit By: tlyu

Revision: 19398
Changed Files:
_U branches/krb5-1-6/
U branches/krb5-1-6/src/appl/telnet/telnetd/state.c
U branches/krb5-1-6/src/appl/telnet/telnetd/sys_term.c

# Wed Apr 04 18:03:31 2007 tlyu (Taylor Yu) - Component telnet added

# Wed Apr 04 18:03:31 2007 tlyu (Taylor Yu) - Version_reported 1.6 added

# Wed Dec 16 18:02:49 2015 tlyu (Taylor Yu) - CustomField pullup deleted