pull up r19396 from trunk
authorTom Yu <tlyu@mit.edu>
Wed, 4 Apr 2007 21:39:26 +0000 (21:39 +0000)
committerTom Yu <tlyu@mit.edu>
Wed, 4 Apr 2007 21:39:26 +0000 (21:39 +0000)
commitcd738ae25ea8736717ba81838793fd3af872788b
treeec0efc65d809c4e6ea231b23a5271b7b96334cc3
parent5489f2447ec60c7ab688c30a2213d3bec474d05d
pull up r19396 from trunk

 r19396@cathode-dark-space:  tlyu | 2007-04-03 17:27:25 -0400
 ticket: new
 subject: MITKRB5-SA-2007-001: telnetd allows login as arbitrary user
 tags: pullup
 target_version: 1.6.1

 Fix MITKRB5-SA-2007-001:

  * src/appl/telnet/telnetd/sys_term.c (start_login): Add "--"
  argument preceding username, in addition to the original patch.
  Explicitly check for leading hyphen in username.

  * src/appl/telnet/telnetd/state.c (envvarok): Check for leading
  hyphen in environment variables.  On advice from Shawn Emery, not
  using strchr() as in the original patch.

ticket: 5508
version_fixed: 1.6.1

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-6@19398 dc483132-0cff-0310-8789-dd5450dbe970
src/appl/telnet/telnetd/state.c
src/appl/telnet/telnetd/sys_term.c