Subject: [48] Solved: Possible Security Problem?

From: James Ford <[email-masked]>
Date: Fri, 24 Jun 1994 16:37:05 -0600 (CST)

I received this from Bill Pemberton.....as noted in the following text, 
whenever a generic user would PUT a file, it was owned by "user.system" 
regardless of whether or not that user was a member of the group "system".  

This hack fixed my problem  Wth Bill's permission maybe this could be 
included in the release versions if it is not already.

Many, many thanks to Bill Pemberton and Brad Burdick for their help.....

------- Forwarded Message Follows -------

From:           Bill Pemberton <[email-masked]>
Subject:        Re: [47] More on possible security problem?
To:             [email-masked]
Date sent:      Fri, 24 Jun 1994 15:49:01 -0400 (EDT)

James Ford writes:
> 
> >I just remembered that my version of wu-ftpd is slightly modified.  If I
> >remember correctly I had a problem with the user's group not getting set
> >correctly.  Do a put as a regular user and see what group owns the file, I
> >bet it's system.  
> 
> Thats it.  A PUT results the file being owned by user.system...
> 
> >I'll find out exactly what I changed and send you a patch.
> 
> Great!  Thats what I need.  :-)
> 

Here it is.  This also includes my getusershell() change that allows wu-ftpd
to get the valid shells the AIX way (instead of reading /etc/shells).

Index: src/config/config.aix
*** ../wu-ftpd-2.4.orig/src/config/config.aix   Fri Apr  1 14:03:36 1994
--- src/config/config.aix   Thu May 26 11:49:45 1994
***************
*** 15,21 ****
  #define HAVE_VPRINTF
  #define OVERWRITE
  #undef  REGEX
! #define SETPROCTITLE
  #undef  SHADOW_PASSWORD
  #undef  UPLOAD
  #define USG
--- 15,21 ----
  #define HAVE_VPRINTF
  #define OVERWRITE
  #undef  REGEX
! #undef  SETPROCTITLE
  #undef  SHADOW_PASSWORD
  #undef  UPLOAD
  #define USG
Index: src/ftpd.c
Prereq:  1990 
*** ../wu-ftpd-2.4.orig/src/ftpd.c  Wed Apr 13 17:17:18 1994
--- src/ftpd.c  Thu Apr 14 16:24:40 1994
***************
*** 1091,1097 ****
--- 1091,1101 ----
          (void) acl_autogroup(pw);
  
      login_attempts = 0;         /* this time successful */
+ #ifndef AIX
      (void) setegid((gid_t) pw->pw_gid);
+ #else
+   (void) setgid((gid_t)pw->pw_gid);
+ #endif
      (void) initgroups(pw->pw_name, pw->pw_gid);
  
      /* open wtmp before chroot */
Index: src/makefiles/Makefile.aix
*** ../wu-ftpd-2.4.orig/src/makefiles/Makefile.aix  Fri Apr  1 14:03:30 1994
--- src/makefiles/Makefile.aix  Wed Apr  6 14:36:50 1994
***************
*** 1,8 ****
  CC       = cc
  IFLAGS   = -I.. -I../support
  LFLAGS   = -L../support
! CFLAGS   = -O -DDEBUG ${IFLAGS} ${LFLAGS}
! LIBES    = -lsupport
  LIBC     = /lib/libc.a
  LINTFLAGS=
  LKERB    = -lauth -lckrb -lkrb -ldes
--- 1,8 ----
  CC       = cc
  IFLAGS   = -I.. -I../support
  LFLAGS   = -L../support
! CFLAGS   = -O3 ${IFLAGS} ${LFLAGS}
! LIBES    = -lsupport -ls
  LIBC     = /lib/libc.a
  LINTFLAGS=
  LKERB    = -lauth -lckrb -lkrb -ldes
Index: support/getusershell.c
Prereq:     5.6 
*** ../wu-ftpd-2.4.orig/support/getusershell.c  Fri Apr  1 14:03:55 1994
--- support/getusershell.c  Wed Apr  6 14:37:33 1994
***************
*** 22,27 ****
--- 22,29 ----
  
  #endif /* LIBC_SCCS and not lint */
  
+ #ifndef _AIX
+ 
  #include "../src/config.h"
  #include <sys/types.h>
  #include <sys/param.h>
***************
*** 31,36 ****
--- 33,39 ----
  #include <ctype.h>
  #include <stdio.h>
  
+ 
  #define SHELLS "/etc/shells"
  
  /*
***************
*** 126,128 ****
--- 129,198 ----
    (void) fclose(fp);
    return (shells);
  }
+ 
+ #else /* it is AIX */
+        
+ 
+ /* emulate getusershell for AIX */
+ 
+ #include <userconf.h>
+ #include <usersec.h>
+ 
+ static int GETUSERSHELL_opened=0;
+ static char **GETUSERSHELL_shells;
+ static int GETUSERSHELL_current;
+             
+ 
+ char *getusershell()
+ {     
+   static char *val;
+   static char *list;
+   static char *retVal;
+   int n;
+                   
+   if (!GETUSERSHELL_opened)
+   {
+       if(getconfattr(SC_SYS_LOGIN,SC_SHELLS,(void *)&val,SEC_LIST))
+       {
+           return(NULL);
+       }
+       GETUSERSHELL_opened = 1;
+       GETUSERSHELL_current = 0;
+       list = val;
+   }      
+                  
+   if ( (list != NULL) && (*list != NULL) )
+   {
+   while (list && *list)
+       list++;
+       
+   *list = '\0';       
+   
+   retVal = val;
+   list++; 
+   val = list;
+   }
+   else
+       retVal = NULL;
+   
+   return(retVal);
+   
+ }
+ 
+ void setusershell()
+ {
+   GETUSERSHELL_opened = 0;
+ }
+ 
+ void endusershell()
+ {
+   GETUSERSHELL_opened = 0;
+ }
+ 
+   
+                  
+   
+   
+   
+   
+ #endif
Index: support/makefiles/Makefile.aix
*** ../wu-ftpd-2.4.orig/support/makefiles/Makefile.aix  Fri Apr  1 14:03:49 1994
--- support/makefiles/Makefile.aix  Wed Apr  6 14:37:04 1994
***************
*** 4,10 ****
  LIBC   = /lib/libc.a
  IFLAGS =
  LFLAGS =
! CFLAGS = -O -DDEBUG ${IFLAGS} ${LFLAGS}
  
  SRCS   = getusershell.c fnmatch.c strcasestr.c strsep.c \
                   authuser.c strdup.c
--- 4,10 ----
  LIBC   = /lib/libc.a
  IFLAGS =
  LFLAGS =
! CFLAGS = -O3 ${IFLAGS} ${LFLAGS}
  
  SRCS   = getusershell.c fnmatch.c strcasestr.c strsep.c \
                   authuser.c strdup.c

--
Bill