projects / krb5.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: f7f39b9) | patch
MITKRB5-SA-2007-001: telnetd allows login as arbitrary user
authorTom Yu <tlyu@mit.edu>
Tue, 3 Apr 2007 21:27:25 +0000 (21:27 +0000)
committerTom Yu <tlyu@mit.edu>
Tue, 3 Apr 2007 21:27:25 +0000 (21:27 +0000)
commitcd1c8b8a1a9bfd77eae9fbf29bd3273695019125
treec2f7273017dc9d9405e5920dda61615913d2f3c9tree | snapshot
parentf7f39b9dda8998390da542fb9bbc2be563c8a557commit | diff
MITKRB5-SA-2007-001: telnetd allows login as arbitrary user

Fix MITKRB5-SA-2007-001:

* src/appl/telnet/telnetd/sys_term.c (start_login): Add "--"
argument preceding username, in addition to the original patch.
Explicitly check for leading hyphen in username.

* src/appl/telnet/telnetd/state.c (envvarok): Check for leading
hyphen in environment variables.  On advice from Shawn Emery, not
using strchr() as in the original patch.

ticket: new
tags: pullup
target_version: 1.6.1

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19396 dc483132-0cff-0310-8789-dd5450dbe970
src/appl/telnet/telnetd/state.c diff | blob | history
src/appl/telnet/telnetd/sys_term.c diff | blob | history
MIT implementation of the Kerberos network authentication protocol. This repo may be rebased, so don't base your work on it. Use git://github.com/krb5/krb5 instead.