Great Circle Associates Majordomo-Workers
(September 1995)
 

Indexed By Date: [Previous] [Next] Indexed By Thread: [Previous] [Next]

Subject: bug/security hole in approve script
From: "John P. Rouillard" <rouilj @ cs . umb . edu>
Date: Tue, 05 Sep 1995 18:57:58 -0400
To: majordomo-workers @ greatcircle . com


Figures, just after I gigged one of my programmers for using
/usr/ucb/Mail for just this very reason, I got bit by it.

Then approving a bounced message, approve has to quote all lines that
being with ~ in the message to be approved. Or it shouldn't use
/usr/ucb/Mail (/usr/bin/mailx) and should send the message via
sendmail directly. The offending line is:

	open(MAIL, "|/usr/ucb/mail -s \"\" $post_to") || die("open(\"|mail ...\"): $!");


at line 196. Looks at a fast grep like approve is the only problem
program. I think the following patch should work. I took the quoting
solution. Anybody care to try it out?

*** /home/rouilj/bin/mapprove   Tue Sep  5 18:51:51 1995
--- /tools/majordomo/bin/approve        Mon Jun 26 14:24:25 1995
***************
*** 204,210 ****
            $from_skipped = 1;
            next;
        }
-       $_ =~ s/\~/\~\~/ if /^\~/;
        print MAIL $_;
      }
      close(MAIL);
--- 204,209 ----

The security implications of this should be obvious.

				-- John
John Rouillard

Senior Systems Administrator		  IDD Information Services
rouilj@dstar.iddis.com			  Waltham, MA (617) 890-7227 x337
						      (617) 487-3937 (Direct)
Senior Systems Consultant (SERL Project)  University of Massachusetts at Boston
rouilj@cs.umb.edu (preferred)	          Boston, MA, (617) 287-6480
===============================================================================
My employers don't acknowledge my existence much less my opinions.



Follow-Ups:
Indexed By Date Previous: Re: listdir gets huge...
From: "John P. Rouillard" <rouilj@cs.umb.edu>
Next: Re: bug/security hole in approve script
From: dwolfe@risc.sps.mot.com (Dave Wolfe)
Indexed By Thread Previous: Re: Is there still majordomo 1.94 or 2.00 development being done ?
From: Alan Stebbens <aks@dokoka.ucsb.edu>
Next: Re: bug/security hole in approve script
From: dwolfe@risc.sps.mot.com (Dave Wolfe)

Google
 
Search Internet Search www.greatcircle.com