SECURITY PROBLEM: wierd values to -d could give you root!

SCCS-vsn: usr.sbin/sendmail/src/trace.c 8.2
SCCS-vsn: usr.sbin/sendmail/src/version.c 8.6.7.1
SCCS-vsn: usr.sbin/sendmail/RELEASE_NOTES 8.6.7.1

diff --git a/usr/src/usr.sbin/sendmail/RELEASE_NOTES b/usr/src/usr.sbin/sendmail/RELEASE_NOTES
index 17d0766..8f70b55 100644 (file)
--- a/usr/src/usr.sbin/sendmail/RELEASE_NOTES
+++ b/usr/src/usr.sbin/sendmail/RELEASE_NOTES
@@ -1,10 +1,16 @@
                        SENDMAIL RELEASE NOTES
                        SENDMAIL RELEASE NOTES

-            @(#)RELEASE_NOTES  8.6.6.1 (Berkeley) %G%
+            @(#)RELEASE_NOTES  8.6.7.1 (Berkeley) %G%

 
 This listing shows the version of the sendmail binary, the version
 of the sendmail configuration files, the date of release, and a
 summary of the changes in that release.
 
 
 This listing shows the version of the sendmail binary, the version
 of the sendmail configuration files, the date of release, and a
 summary of the changes in that release.
 

+8.6.7/8.6.6    94/03/14
+       SECURITY: it was possible to get root access by using wierd
+               values to the -d flag.  Thanks to Alain Durand of
+               INRIA for forwarding me the notice from the bugtraq
+               list.
+

 8.6.6/8.6.6    94/03/13
        SECURITY: the ability to give files away on System V-based
                systems proved dangerous -- don't run as the owner
 8.6.6/8.6.6    94/03/13
        SECURITY: the ability to give files away on System V-based
                systems proved dangerous -- don't run as the owner

diff --git a/usr/src/usr.sbin/sendmail/src/trace.c b/usr/src/usr.sbin/sendmail/src/trace.c
index 63be701..1afa0ee 100644 (file)
--- a/usr/src/usr.sbin/sendmail/src/trace.c
+++ b/usr/src/usr.sbin/sendmail/src/trace.c
@@ -7,7 +7,7 @@
  */
 
 #ifndef lint
  */
 
 #ifndef lint

-static char sccsid[] = "@(#)trace.c    8.1 (Berkeley) %G%";
+static char sccsid[] = "@(#)trace.c    8.2 (Berkeley) %G%";

 #endif /* not lint */
 
 # include "sendmail.h"
 #endif /* not lint */
 
 # include "sendmail.h"


@@ -56,8 +56,8 @@ tTsetup(vect, size, defflags)
 tTflag(s)
        register char *s;
 {
 tTflag(s)
        register char *s;
 {

-       int first, last;
-       register int i;
+       unsigned int first, last;
+       register unsigned int i;

 
        if (*s == '\0')
                s = DefFlags;
 
        if (*s == '\0')
                s = DefFlags;

diff --git a/usr/src/usr.sbin/sendmail/src/version.c b/usr/src/usr.sbin/sendmail/src/version.c
index ef55ceb..b9d894f 100644 (file)
--- a/usr/src/usr.sbin/sendmail/src/version.c
+++ b/usr/src/usr.sbin/sendmail/src/version.c
@@ -7,7 +7,7 @@
  */
 
 #ifndef lint
  */
 
 #ifndef lint

-static char sccsid[] = "@(#)version.c  8.6.6.1 (Berkeley) %G%";
+static char sccsid[] = "@(#)version.c  8.6.7.1 (Berkeley) %G%";

 #endif /* not lint */
 
 #endif /* not lint */
 

-char   Version[] = "8.6.6";
+char   Version[] = "8.6.7";