Author: markj
Date: Tue Sep 15 20:54:18 2020
New Revision: 365771
URL: https://svnweb.freebsd.org/changeset/base/365771
Log:
ftpd: Exit during authentication if an error occurs after chroot().
admbug: 969
Security: CVE-2020-7468
Modified:
head/libexec/ftpd/ftpd.c
Modified: head/libexec/ftpd/ftpd.c
==============================================================================
--- head/libexec/ftpd/ftpd.c Tue Sep 15 20:47:33 2020 (r365770)
+++ head/libexec/ftpd/ftpd.c Tue Sep 15 20:54:18 2020 (r365771)
@@ -1595,13 +1595,20 @@ skip:
* (uid 0 has no root power over NFS if not mapped explicitly.)
*/
if (seteuid(pw->pw_uid) < 0) {
- reply(550, "Can't set uid.");
- goto bad;
+ if (guest || dochroot) {
+ fatalerror("Can't set uid.");
+ } else {
+ reply(550, "Can't set uid.");
+ goto bad;
+ }
}
+ /*
+ * Do not allow the session to live if we're chroot()'ed and chdir()
+ * fails. Otherwise the chroot jail can be escaped.
+ */
if (chdir(homedir) < 0) {
if (guest || dochroot) {
- reply(550, "Can't change to base directory.");
- goto bad;
+ fatalerror("Can't change to base directory.");
} else {
if (chdir("/") < 0) {
reply(550, "Root is inaccessible.");
_______________________________________________
svn-src-head@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
