bugtraq - patch for vulnerability in cgiemail

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20031003175820.82665.qmail@smx.pair.com>
Date: Fri, 3 Oct 2003 13:58:20 -0400 (EDT)
From: Matt Riffle <matt@...r.com>
To: bugtraq@...urityfocus.com
Subject: patch for vulnerability in cgiemail



Recently we've seen a marked rise in attempts to exploit the bug in MIT's
cgiemail that's documented here:

  http://www.securitytracker.com/alerts/2002/Jun/1004549.html

Appended below is a quick patch to the cgilib.c file of the distribution,
designed to prevent abuse of the program.

Basically, it attempts to strip all non-printable characters (maybe a little
heavy-handed) from form input that's incorporated into the headers of the
resulting email.  It doesn't strip them from the body (assuming there's a
blank line between the two for it to make the distinction).

Regards,

Matt Riffle
------------------------O----------------------
Senior Systems Programmer         
pair Networks, Inc.        http://www.pair.com/
------------------------O----------------------

--

31,40d30
< int noheader; // flag for when we exit template's header - MPR
< int flag;     // flag used to find split to set above flag - MPR
< 
< /* MPR - 9/30/03 */
< void strip_nonprint(char *s) {
<   while (*s) {
<     if (!isprint(*s)) *s = ' ';
<     s++;
<   }
< }
432,433d421
<   char *myptr;
<   int count;
439,442d426
<           if (!noheader) 
<             {
<               strip_nonprint(formp->fields[i].value);
<             }
554,558d537
<           /* when flag hits 2, we're out of headers -- MPR */
<           if (flag >= 2) 
<             {
<               noheader = 1;
<             }
564d542
<               flag++;
567,574d544
<           if ((inchar != (int)' ') && (inchar != (int)'\n'))
<             {
<               flag = 0; 
<              } 
<           else 
<             {
<               if (inchar == (int)'\n') flag++;
<             }
1192d1161
<