| 1 |
diff -up sudo-1.8.6p3/aclocal.m4.CVE-2014-9680 sudo-1.8.6p3/aclocal.m4 |
| 2 |
--- sudo-1.8.6p3/aclocal.m4.CVE-2014-9680 2012-09-18 15:56:28.000000000 +0200 |
| 3 |
+++ sudo-1.8.6p3/aclocal.m4 2015-03-31 12:55:08.392841672 +0200 |
| 4 |
@@ -156,6 +156,25 @@ AC_DEFUN([SUDO_IO_LOGDIR], [ |
| 5 |
AC_MSG_RESULT($iolog_dir) |
| 6 |
])dnl |
| 7 |
|
| 8 |
+dnl Detect time zone file directory, if any. |
| 9 |
+dnl |
| 10 |
+AC_DEFUN([SUDO_TZDIR], [AC_MSG_CHECKING(time zone data directory) |
| 11 |
+tzdir="$with_tzdir" |
| 12 |
+if test -z "$tzdir"; then |
| 13 |
+ tzdir=no |
| 14 |
+ for d in /usr/share /usr/share/lib /usr/lib /etc; do |
| 15 |
+ if test -d "$d/zoneinfo"; then |
| 16 |
+ tzdir="$d/zoneinfo" |
| 17 |
+ break |
| 18 |
+ fi |
| 19 |
+ done |
| 20 |
+fi |
| 21 |
+AC_MSG_RESULT([$tzdir]) |
| 22 |
+if test "${tzdir}" != "no"; then |
| 23 |
+ SUDO_DEFINE_UNQUOTED(_PATH_ZONEINFO, "$tzdir") |
| 24 |
+fi |
| 25 |
+])dnl |
| 26 |
+ |
| 27 |
dnl |
| 28 |
dnl check for working fnmatch(3) |
| 29 |
dnl |
| 30 |
diff -up sudo-1.8.6p3/configure.in.CVE-2014-9680 sudo-1.8.6p3/configure.in |
| 31 |
--- sudo-1.8.6p3/configure.in.CVE-2014-9680 2015-03-31 12:55:08.375841856 +0200 |
| 32 |
+++ sudo-1.8.6p3/configure.in 2015-03-31 12:55:08.393841662 +0200 |
| 33 |
@@ -774,6 +774,12 @@ AC_ARG_WITH(iologdir, [AS_HELP_STRING([- |
| 34 |
;; |
| 35 |
esac]) |
| 36 |
|
| 37 |
+AC_ARG_WITH(tzdir, [AS_HELP_STRING([--with-tzdir=DIR], [path to the time zone data directory])], |
| 38 |
+[case $with_tzdir in |
| 39 |
+ yes) AC_MSG_ERROR(["must give --with-tzdir an argument."]) |
| 40 |
+ ;; |
| 41 |
+esac]) |
| 42 |
+ |
| 43 |
AC_ARG_WITH(sendmail, [AS_HELP_STRING([--with-sendmail], [set path to sendmail]) |
| 44 |
AS_HELP_STRING([--without-sendmail], [do not send mail at all])], |
| 45 |
[case $with_sendmail in |
| 46 |
@@ -3240,6 +3246,7 @@ fi |
| 47 |
SUDO_LOGFILE |
| 48 |
SUDO_TIMEDIR |
| 49 |
SUDO_IO_LOGDIR |
| 50 |
+SUDO_TZDIR |
| 51 |
|
| 52 |
dnl |
| 53 |
dnl Turn warnings into errors. |
| 54 |
diff -up sudo-1.8.6p3/doc/sudoers.cat.CVE-2014-9680 sudo-1.8.6p3/doc/sudoers.cat |
| 55 |
--- sudo-1.8.6p3/doc/sudoers.cat.CVE-2014-9680 2015-03-31 12:55:08.365841964 +0200 |
| 56 |
+++ sudo-1.8.6p3/doc/sudoers.cat 2015-03-31 13:00:04.625640465 +0200 |
| 57 |
@@ -1421,20 +1421,36 @@ SSUUDDOOEERRSS OOPPTTIIOONN |
| 58 |
|
| 59 |
LLiissttss tthhaatt ccaann bbee uusseedd iinn aa bboooolleeaann ccoonntteexxtt: |
| 60 |
|
| 61 |
- env_check Environment variables to be removed from the user's |
| 62 |
- environment if the variable's value contains `%' or `/' |
| 63 |
+ env_check Environment variables to be removed from the user's |
| 64 |
+ environment if unless they are considered ``safe''. |
| 65 |
+ For all variables except TZ, ``safe'' means that the |
| 66 |
+ variable's value does not contain any `%' or `/' |
| 67 |
characters. This can be used to guard against printf- |
| 68 |
style format vulnerabilities in poorly-written |
| 69 |
- programs. The argument may be a double-quoted, space- |
| 70 |
- separated list or a single value without double-quotes. |
| 71 |
- The list can be replaced, added to, deleted from, or |
| 72 |
- disabled by using the =, +=, -=, and ! operators |
| 73 |
- respectively. Regardless of whether the env_reset |
| 74 |
- option is enabled or disabled, variables specified by |
| 75 |
- env_check will be preserved in the environment if they |
| 76 |
- pass the aforementioned check. The default list of |
| 77 |
- environment variables to check is displayed when ssuuddoo |
| 78 |
- is run by root with the --VV option. |
| 79 |
+ programs. The TZ variable is considerd unsafe if any |
| 80 |
+ of the following are true: |
| 81 |
+ |
| 82 |
+ ++oo It consists of a fully-qualified path name, |
| 83 |
+ optionally prefixed with a colon (`:'), that does |
| 84 |
+ not match the location of the _z_o_n_e_i_n_f_o directory. |
| 85 |
+ |
| 86 |
+ ++oo It contains a _._. path element. |
| 87 |
+ |
| 88 |
+ ++oo It contains white space or non-printable |
| 89 |
+ characters. |
| 90 |
+ |
| 91 |
+ ++oo It is longer than the value of PATH_MAX. |
| 92 |
+ |
| 93 |
+ The argument may be a double-quoted, space-separated |
| 94 |
+ list or a single value without double-quotes. The list |
| 95 |
+ can be replaced, added to, deleted from, or disabled by |
| 96 |
+ using the =, +=, -=, and ! operators respectively. |
| 97 |
+ Regardless of whether the env_reset option is enabled |
| 98 |
+ or disabled, variables specified by env_check will be |
| 99 |
+ preserved in the environment if they pass the |
| 100 |
+ aforementioned check. The default list of environment |
| 101 |
+ variables to check is displayed when ssuuddoo is run by |
| 102 |
+ root with the --VV option. |
| 103 |
|
| 104 |
env_delete Environment variables to be removed from the user's |
| 105 |
environment when the _e_n_v___r_e_s_e_t option is not in effect. |
| 106 |
diff -up sudo-1.8.6p3/doc/sudoers.man.in.CVE-2014-9680 sudo-1.8.6p3/doc/sudoers.man.in |
| 107 |
--- sudo-1.8.6p3/doc/sudoers.man.in.CVE-2014-9680 2015-03-31 12:55:08.366841953 +0200 |
| 108 |
+++ sudo-1.8.6p3/doc/sudoers.man.in 2015-03-31 13:01:57.539420274 +0200 |
| 109 |
@@ -3002,14 +3002,47 @@ The default value is |
| 110 |
\fBLists that can be used in a boolean context\fR: |
| 111 |
.TP 18n |
| 112 |
env_check |
| 113 |
-Environment variables to be removed from the user's environment if |
| 114 |
-the variable's value contains |
| 115 |
-`%' |
| 116 |
+ Environment variables to be removed from the user's environment if |
| 117 |
+unless they are considered |
| 118 |
+\(lqsafe\(rq. |
| 119 |
+For all variables except |
| 120 |
+\fRTZ\fR, |
| 121 |
+\(lqsafe\(rq |
| 122 |
+means that the variable's value does not contain any |
| 123 |
+\(oq%\(cq |
| 124 |
or |
| 125 |
-`/' |
| 126 |
+\(oq/\(cq |
| 127 |
characters. |
| 128 |
This can be used to guard against printf-style format vulnerabilities |
| 129 |
in poorly-written programs. |
| 130 |
+The |
| 131 |
+\fRTZ\fR |
| 132 |
+variable is considerd unsafe if any of the following are true: |
| 133 |
+.PP |
| 134 |
+.RS 18n |
| 135 |
+.PD 0 |
| 136 |
+.TP 4n |
| 137 |
+\fB\(bu\fR |
| 138 |
+It consists of a fully-qualified path name, |
| 139 |
+optionally prefixed with a colon |
| 140 |
+(\(oq:\&\(cq), |
| 141 |
+that does not match the location of the |
| 142 |
+\fIzoneinfo\fR |
| 143 |
+directory. |
| 144 |
+.PD |
| 145 |
+.TP 4n |
| 146 |
+\fB\(bu\fR |
| 147 |
+It contains a |
| 148 |
+\fI..\fR |
| 149 |
+path element. |
| 150 |
+.TP 4n |
| 151 |
+\fB\(bu\fR |
| 152 |
+It contains white space or non-printable characters. |
| 153 |
+.TP 4n |
| 154 |
+\fB\(bu\fR |
| 155 |
+It is longer than the value of |
| 156 |
+\fRPATH_MAX\fR. |
| 157 |
+.PP |
| 158 |
The argument may be a double-quoted, space-separated list or a |
| 159 |
single value without double-quotes. |
| 160 |
The list can be replaced, added to, deleted from, or disabled by using |
| 161 |
@@ -3031,6 +3064,7 @@ is run by root with |
| 162 |
the |
| 163 |
\fB\-V\fR |
| 164 |
option. |
| 165 |
+.RE |
| 166 |
.TP 18n |
| 167 |
env_delete |
| 168 |
Environment variables to be removed from the user's environment when the |
| 169 |
diff -up sudo-1.8.6p3/doc/sudoers.mdoc.in.CVE-2014-9680 sudo-1.8.6p3/doc/sudoers.mdoc.in |
| 170 |
--- sudo-1.8.6p3/doc/sudoers.mdoc.in.CVE-2014-9680 2015-03-31 12:55:08.366841953 +0200 |
| 171 |
+++ sudo-1.8.6p3/doc/sudoers.mdoc.in 2015-03-31 13:03:21.721510569 +0200 |
| 172 |
@@ -2791,13 +2791,40 @@ The default value is |
| 173 |
.Bl -tag -width 16n |
| 174 |
.It env_check |
| 175 |
Environment variables to be removed from the user's environment if |
| 176 |
-the variable's value contains |
| 177 |
+unless they are considered |
| 178 |
+.Dq safe . |
| 179 |
+For all variables except |
| 180 |
+.Li TZ , |
| 181 |
+.Dq safe |
| 182 |
+means that the variable's value does not contain any |
| 183 |
.Ql % |
| 184 |
or |
| 185 |
.Ql / |
| 186 |
characters. |
| 187 |
This can be used to guard against printf-style format vulnerabilities |
| 188 |
in poorly-written programs. |
| 189 |
+The |
| 190 |
+.Li TZ |
| 191 |
+variable is considerd unsafe if any of the following are true: |
| 192 |
+.Bl -bullet |
| 193 |
+.It |
| 194 |
+It consists of a fully-qualified path name, |
| 195 |
+optionally prefixed with a colon |
| 196 |
+.Pq Ql :\& , |
| 197 |
+that does not match the location of the |
| 198 |
+.Pa zoneinfo |
| 199 |
+directory. |
| 200 |
+.It |
| 201 |
+It contains a |
| 202 |
+.Pa .. |
| 203 |
+path element. |
| 204 |
+.It |
| 205 |
+It contains white space or non-printable characters. |
| 206 |
+.It |
| 207 |
+It is longer than the value of |
| 208 |
+.Li PATH_MAX . |
| 209 |
+.El |
| 210 |
+.Pp |
| 211 |
The argument may be a double-quoted, space-separated list or a |
| 212 |
single value without double-quotes. |
| 213 |
The list can be replaced, added to, deleted from, or disabled by using |
| 214 |
diff -up sudo-1.8.6p3/INSTALL.CVE-2014-9680 sudo-1.8.6p3/INSTALL |
| 215 |
--- sudo-1.8.6p3/INSTALL.CVE-2014-9680 2012-09-18 15:57:43.000000000 +0200 |
| 216 |
+++ sudo-1.8.6p3/INSTALL 2015-03-31 12:55:08.394841651 +0200 |
| 217 |
@@ -461,6 +461,16 @@ The following options are also configura |
| 218 |
Override the default location of the sudo timestamp directory and |
| 219 |
use "path" instead. |
| 220 |
|
| 221 |
+ --with-tzdir=DIR |
| 222 |
+ Set the directory to the system's time zone data files. This |
| 223 |
+ is only used when sanitizing the TZ environment variable to |
| 224 |
+ allow for fully-qualified paths in TZ. |
| 225 |
+ By default, configure will look for an existing "zoneinfo" |
| 226 |
+ directory in the following locations: |
| 227 |
+ /usr/share /usr/share/lib /usr/lib /etc |
| 228 |
+ If no zoneinfo directory is found, the TZ variable may not |
| 229 |
+ contain a fully-qualified path. |
| 230 |
+ |
| 231 |
--with-sendmail=PATH |
| 232 |
Override configure's guess as to the location of sendmail. |
| 233 |
|
| 234 |
diff -up sudo-1.8.6p3/pathnames.h.in.CVE-2014-9680 sudo-1.8.6p3/pathnames.h.in |
| 235 |
--- sudo-1.8.6p3/pathnames.h.in.CVE-2014-9680 2012-09-18 15:56:28.000000000 +0200 |
| 236 |
+++ sudo-1.8.6p3/pathnames.h.in 2015-03-31 12:55:08.394841651 +0200 |
| 237 |
@@ -168,3 +168,7 @@ |
| 238 |
#ifndef _PATH_NETSVC_CONF |
| 239 |
#undef _PATH_NETSVC_CONF |
| 240 |
#endif /* _PATH_NETSVC_CONF */ |
| 241 |
+ |
| 242 |
+#ifndef _PATH_ZONEINFO |
| 243 |
+# undef _PATH_ZONEINFO |
| 244 |
+#endif /* _PATH_ZONEINFO */ |
| 245 |
diff -up sudo-1.8.6p3/plugins/sudoers/env.c.CVE-2014-9680 sudo-1.8.6p3/plugins/sudoers/env.c |
| 246 |
--- sudo-1.8.6p3/plugins/sudoers/env.c.CVE-2014-9680 2012-09-18 15:57:43.000000000 +0200 |
| 247 |
+++ sudo-1.8.6p3/plugins/sudoers/env.c 2015-03-31 12:55:08.394841651 +0200 |
| 248 |
@@ -198,6 +198,7 @@ static const char *initial_checkenv_tabl |
| 249 |
"LC_*", |
| 250 |
"LINGUAS", |
| 251 |
"TERM", |
| 252 |
+ "TZ", |
| 253 |
NULL |
| 254 |
}; |
| 255 |
|
| 256 |
@@ -213,7 +214,6 @@ static const char *initial_keepenv_table |
| 257 |
"PATH", |
| 258 |
"PS1", |
| 259 |
"PS2", |
| 260 |
- "TZ", |
| 261 |
"XAUTHORITY", |
| 262 |
"XAUTHORIZATION", |
| 263 |
NULL |
| 264 |
@@ -584,6 +584,54 @@ matches_env_delete(const char *var) |
| 265 |
} |
| 266 |
|
| 267 |
/* |
| 268 |
+ * Sanity-check the TZ environment variable. |
| 269 |
+ * On many systems it is possible to set this to a pathname. |
| 270 |
+ */ |
| 271 |
+static bool |
| 272 |
+tz_is_sane(const char *tzval) |
| 273 |
+{ |
| 274 |
+ const char *cp; |
| 275 |
+ char lastch; |
| 276 |
+ debug_decl(tz_is_sane, SUDO_DEBUG_ENV) |
| 277 |
+ |
| 278 |
+ /* tzcode treats a value beginning with a ':' as a path. */ |
| 279 |
+ if (tzval[0] == ':') |
| 280 |
+ tzval++; |
| 281 |
+ |
| 282 |
+ /* Reject fully-qualified TZ that doesn't being with the zoneinfo dir. */ |
| 283 |
+ if (tzval[0] == '/') { |
| 284 |
+#ifdef _PATH_ZONEINFO |
| 285 |
+ if (strncmp(tzval, _PATH_ZONEINFO, sizeof(_PATH_ZONEINFO) - 1) != 0 || |
| 286 |
+ tzval[sizeof(_PATH_ZONEINFO) - 1] != '/') |
| 287 |
+ debug_return_bool(false); |
| 288 |
+#else |
| 289 |
+ /* Assume the worst. */ |
| 290 |
+ debug_return_bool(false); |
| 291 |
+#endif |
| 292 |
+ } |
| 293 |
+ |
| 294 |
+ /* |
| 295 |
+ * Make sure TZ only contains printable non-space characters |
| 296 |
+ * and does not contain a '..' path element. |
| 297 |
+ */ |
| 298 |
+ lastch = '/'; |
| 299 |
+ for (cp = tzval; *cp != '\0'; cp++) { |
| 300 |
+ if (isspace((unsigned char)*cp) || !isprint((unsigned char)*cp)) |
| 301 |
+ debug_return_bool(false); |
| 302 |
+ if (lastch == '/' && cp[0] == '.' && cp[1] == '.' && |
| 303 |
+ (cp[2] == '/' || cp[2] == '\0')) |
| 304 |
+ debug_return_bool(false); |
| 305 |
+ lastch = *cp; |
| 306 |
+ } |
| 307 |
+ |
| 308 |
+ /* Reject extra long TZ values (even if not a path). */ |
| 309 |
+ if ((size_t)(cp - tzval) >= PATH_MAX) |
| 310 |
+ debug_return_bool(false); |
| 311 |
+ |
| 312 |
+ debug_return_bool(true); |
| 313 |
+} |
| 314 |
+ |
| 315 |
+/* |
| 316 |
* Apply the env_check list. |
| 317 |
* Returns true if the variable is allowed, false if denied |
| 318 |
* or -1 if no match. |
| 319 |
@@ -607,8 +655,13 @@ matches_env_check(const char *var) |
| 320 |
iswild = false; |
| 321 |
if (strncmp(cur->value, var, len) == 0 && |
| 322 |
(iswild || var[len] == '=')) { |
| 323 |
+ if (strncmp(var, "TZ=", 3) == 0 ) { |
| 324 |
+ /* Sperial case for TZ */ |
| 325 |
+ keepit = tz_is_sane(var + 3); |
| 326 |
+ } else { |
| 327 |
keepit = !strpbrk(var, "/%"); |
| 328 |
- break; |
| 329 |
+ } |
| 330 |
+ break; |
| 331 |
} |
| 332 |
} |
| 333 |
debug_return_bool(keepit); |
Parent Directory
| 
Revision Log
| 
Revision Graph
