From: Tom Yu <tlyu@mit.edu>
Date: Fri, 6 Apr 2007 20:06:24 +0000 (+0000)
Subject: pull up r19396 from trunk
X-Git-Tag: krb5-1.5.3-final~5
X-Git-Url: http://git.tremily.us/?a=commitdiff_plain;h=9505c155f400396bbb8248e7fa30aca7a05253fe;p=krb5.git

pull up r19396 from trunk

 r19396@cathode-dark-space:  tlyu | 2007-04-03 17:27:25 -0400
 ticket: new
 subject: MITKRB5-SA-2007-001: telnetd allows login as arbitrary user
 tags: pullup
 target_version: 1.6.1

 Fix MITKRB5-SA-2007-001:

 	* src/appl/telnet/telnetd/sys_term.c (start_login): Add "--"
 	argument preceding username, in addition to the original patch.
 	Explicitly check for leading hyphen in username.

 	* src/appl/telnet/telnetd/state.c (envvarok): Check for leading
 	hyphen in environment variables.  On advice from Shawn Emery, not
 	using strchr() as in the original patch.



ticket: 5512
version_fixed: 1.5.3

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-5@19403 dc483132-0cff-0310-8789-dd5450dbe970
---

diff --git a/src/appl/telnet/telnetd/state.c b/src/appl/telnet/telnetd/state.c
index e08c5bb13..4693fc912 100644
--- a/src/appl/telnet/telnetd/state.c
+++ b/src/appl/telnet/telnetd/state.c
@@ -1665,7 +1665,8 @@ static int envvarok(varp)
 	    strcmp(varp, "RESOLV_HOST_CONF") && /* linux */
 	    strcmp(varp, "NLSPATH") && /* locale stuff */
 	    strncmp(varp, "LC_", strlen("LC_")) && /* locale stuff */
-	    strcmp(varp, "IFS")) {
+	    strcmp(varp, "IFS") &&
+	    (varp[0] != '-')) {
 		return 1;
 	} else {
 		syslog(LOG_INFO, "Rejected the attempt to modify the environment variable \"%s\"", varp);
diff --git a/src/appl/telnet/telnetd/sys_term.c b/src/appl/telnet/telnetd/sys_term.c
index bfd1f81af..d78c2e83d 100644
--- a/src/appl/telnet/telnetd/sys_term.c
+++ b/src/appl/telnet/telnetd/sys_term.c
@@ -1287,12 +1287,25 @@ start_login(host, autologin, name)
 #endif
 #if	defined (AUTHENTICATION)
 	if (auth_level >= 0 && autologin == AUTH_VALID) {
+		if (name[0] == '-') {
+		    /*
+		     * Authenticated and authorized to log in to an
+		     * account starting with '-'?  Even if that
+		     * unlikely case comes to pass, the current login
+		     * program will not parse the resulting command
+		     * line properly.
+		     */
+		    syslog(LOG_ERR, "user name cannot start with '-'");
+		    fatal(net, "user name cannot start with '-'");
+		    exit(1);
+		}
 # if	!defined(NO_LOGIN_F)
 #if	defined(LOGIN_CAP_F)
 		argv = addarg(argv, "-F");
 #else
 		argv = addarg(argv, "-f");
 #endif
+		argv = addarg(argv, "--");
 		argv = addarg(argv, name);
 # else
 #  if defined(LOGIN_R)
@@ -1371,17 +1384,27 @@ start_login(host, autologin, name)
 			pty = xpty;
 		}
 #  else
+		argv = addarg(argv, "--");
 		argv = addarg(argv, name);
 #  endif
 # endif
 	} else
 #endif
 	if (getenv("USER")) {
-		argv = addarg(argv, getenv("USER"));
+		char *user = getenv("USER");
+		if (user[0] == '-') {
+		    /* "telnet -l-x ..." */
+		    syslog(LOG_ERR, "user name cannot start with '-'");
+		    fatal(net, "user name cannot start with '-'");
+		    exit(1);
+		}
+		argv = addarg(argv, "--");
+		argv = addarg(argv, user);
 #if	defined(LOGIN_ARGS) && defined(NO_LOGIN_P)
 		{
 			register char **cpp;
 			for (cpp = environ; *cpp; cpp++)
+			    if ((*cpp)[0] != '-')
 				argv = addarg(argv, *cpp);
 		}
 #endif