Subject: Another security patch...

From: Marek Michalkiewicz <[email-masked]>
Date: Tue, 8 Aug 1995 20:52:17 +0200 (MET DST)

Currently wu-ftpd runs any external programs (like ls, gzip, tar
and so on, including SITE EXEC commands) with the effective uid
of the user who is logged in, but with real uid 0.  The patch
(included below) will cause it to drop privileges completely
before executing any external commands.  You never know...

For example, tar (especially the GNU one) is a complex program
- if a user can manage to pass it arbitrary arguments, then we
may be in trouble: GNU tar has a nice --use-compress-program
option...  You never know when the GNU folks add a similar
(normally harmless) feature to GNU ls where you can pass it
any arguments and run anything with real uid 0.

I have tested this patch and it seems to work.  But please
look at it carefully and test it, and tell me if it breaks
anything.  If it doesn't, we could have it in the official
version...

The patch is below.  Note that closing all files is important
- otherwise the bad guys can attach to the process and access
wtmp, pid files etc...

To apply, cd wu-ftpd-2.4.2-beta-5/src ; patch -s -p0 <this_file

Regards,
Marek

----------
--- popen.c.orig	Tue Jul 11 01:50:56 1995
+++ popen.c	Tue Aug  1 12:14:50 1995
@@ -61,6 +61,7 @@
     int argc,
       gargc,
       pdes[2],
+      i,
       pid;
     char **pop,
      *argv[100],
@@ -141,6 +142,12 @@
             }
             (void) close(pdes[1]);
         }
+#if 1  /* drop privileges before executing external commands */
+        for (i = 3; i < fds; i++)
+            (void) close(i);
+        if (setgid(getegid()) || setuid(geteuid()))
+            _exit(1);
+#endif
         execv(gargv[0], gargv);
         _exit(1);
     }
----------