hardenedbsd/HardenedBSD
1
0
Fork 0
mirror of https://git.hardenedbsd.org/hardenedbsd/HardenedBSD.git synced 2024-11-16 15:44:04 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix the bug which allowed people to avoid the "-s" (secure) bug.

Browse Source 
Now, "finger" is invoked with "--" before the first network supplied
argument, so the "--" and "-l" hacks will be stopped.
This commit is contained in:
Peter Wemm 1995-12-10 15:07:12 +00:00
parent bb51c61fdf
commit 279884182f
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=12728
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
libexec/fingerd/fingerd.c
View File

@ -107,10 +107,11 @@ main(argc, argv)
exit(1);
comp = &av[1];
for (lp = line, ap = &av[2];;) {
av[2] = "--";
for (lp = line, ap = &av[3];;) {
*ap = strtok(lp, " \t\r\n");
if (!*ap) {
if (secure && ap == &av[2]) {
if (secure && ap == &av[3]) {
puts("must provide username\r\n");
exit(1);
}