Attachment 17910 Details for Bug 51659

[patch] The patch. "backported"

03cvs-client-exploit-fix.backport.diff (text/plain), 1.03 KB, created by Sebastian Krahmer on 2004-04-05 18:07:52 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Sebastian Krahmer

Created: 2004-04-05 18:07:52 UTC

Size: 1.03 KB

patch

obsolete

>Index: src/client.c
>===================================================================
>RCS file: /cvs/ccvs/src/client.c,v
>retrieving revision 1.318.4.12
>diff -u -p -r1.318.4.12 client.c
>--- src/client.c	25 Feb 2004 06:46:15 -0000	1.318.4.12
>+++ src/client.c	18 Mar 2004 21:04:46 -0000
>@@ -1045,6 +1045,19 @@ call_in_directory (pathname, func, data)
>     int reposdirname_absolute;
>     int newdir = 0;
> 
>+    /* For security reasons, if PATHNAME is absolute or attemps to ascend
>+     * outside of the current sanbbox, we abort.  The server should not send us
>+     * anything but relative paths which remain inside the sandbox here.
>+     * Anything less means a trojan CVS server could create and edit arbitrary
>+     * files on the client.
>+     */
>+    if (isabsolute (pathname) || pathname_levels (pathname) > 0)
>+    {
>+	error (0, 0,
>+               "Server attempted to update a file via an invalid pathname:");
>+        error (1, 0, "`%s'.", pathname);
>+    }
>+
>     reposname = NULL;
>     read_line (&reposname);
>     assert (reposname != NULL);

Actions: View | Diff

Attachments on bug 51659: 16953 | 17910 | 17911 | 18205 | 18206