Security hole in mgetty+sendfax

Gert Doering (gert@GREENIE.MUC.DE)
Thu, 24 Jul 1997 22:23:09 +0200

-----BEGIN PGP SIGNED MESSAGE-----

Hi,

a security hole has been found in the auxiliary fax scripts "faxq" and
"faxrunq" in the mgetty+sendfax package. It has been in there since
the first day those scripts were written.

Due to improper quoting in these shell scripts, it's possible to execute
code with a foreign user id, and get root access to the machine. The
exploit is actually quite trivial, so it's not necessary to include that
here.

Appended below, you'll find replacement scripts that fix the problems. The
scripts can be used "as is" with mgetty+sendfax 1.0.* and 1.1.*, and I'm
fairly sure that they will work with all older versions as well.

This weekend, I will release new versions of mgetty+sendfax (1.1.8 for
the development cycle, 1.0.1 as "stable release"), which will have the
changes worked in.

Credits for finding the problem go to Herbert Thielen
(thielen@lpr.e-technik.tu-muenchen.de). Thanks again.

gert
- ----------
begin 644 faxq+faxrunq.tar.gz
M'XL( (RYUS, ^U::UL;.;*>K_:OJ AGL!.,+Y#DQ,290QC(,$,@"^3LSC-D
MH7'+=@_M;M.MAGB3/;]]JTI2WVP89F8W^\5Z$FRW2B6I5)>W2CUT/EU_\Q]N
MG7;[^>8F? , &YTN?P(\,Y\ SY\_W\"_&\^?O>AV-S:> ^" %^UOH/V?7ABU
M)%9.!/#-2$;J7KID,/T:Z_G*;>51Z](+6O&XNE)=@2%J TRC<!0Y$^ GOG<E
M0?C3:P%A!&+B>/ZU6(-X'-["K^%E#+>.I[Q@!%X :BPA3-0T47"=R$0R@Y.=
MG9,>_&]]I4',U[V@LKF^ 2]?M-HO6MU-V FGL\@;C174=QK0>?ER$][B2<#W
MH8R0+;+8V_[;^<G[HZ.#?BN)HU8\#4._A;RRCO.C#Z>ESA:N8Q02 UZ$'(S#
M=%]J["BX]7P?G,% 3A7(>.!,90SU2R<>]T P=5/2-I.@!\SY&4F).AK(D#[[
M3"8T?R< Y_9*<_9B"$(%L0H#V0Q]MWD9.5[0=*7C0MU0K#%)B&/6U]>)X_9?
M?^KCKVK5&\+ A5IA;U!%R0;0JTH_EE4RF1HO40R<@/@,QJX7@0I+PY"U@-??
M=GF$_.0IZ%2'7K5*Q]873UH_'KT1U4CR4?4%[F2()SSTG5'5#7G,P(DEU.@)
MGFZUTKQIP(V,+L,8R5642 %;6_@X;$".Y;J+^S8]<;$G?F*>.X7G]FDT1[T%
MZ?*R^9XT<&$*7KW:/=H[?W?REK=8:_=PC3>.[[D03I47XKGQRJOY9W$/]]4,
M>UI]\6QX0GH6FV=Q$D]EX,JLQS$]#NJ+?7;3LX(P^DX/HQZNEIR)*G,Q"ZU6
MTG.@C?"IQ,Z@2@(SIW+AQU!CL^J^;KGRIA4DOG]1_06:_P#!'0(^PK??6@4(
M0IYA7?#9>62$3&5/\,/)[C$>[1:\_^'H<%=_VWZ[>\+?WFWO'YP>\=?_VSU^
M8[[RN.V=G5/^M7_X_H/^]OYXGS^/=UE7B IUU:S,2 ,7QQVDKM6*1-'#A8J@
MZ<+J67NSB_]?G'4VVV>=C4W\CO]?;*S"JYH'7^",I8.:C98 J[5.OR^26$8"
M/J/=>H$:@N#-/(ZWT"YK7?AGM4(CF'(Z9IW+2/5V%],Z(QD7:%D@CUVB/=QK
M=HK4D1=&GIH5!J DS@3]Q!G6SP3/\<]5:%Y4*^9<:EY/NT 7+F=0HY6O0XUG
M EI '2V#[)77N5Y#CD+K QGX5Q0<N7,!.5*C$V?B<7PFMM@#7L8JJD.MO0;/
MH?&'Q6XTY%R%@I9<J9C@GPTV.KAX:H0-Q;G1=:OSL1.XOKR+(2OQ'>PV2NR\
M *TXOQ6M^(M'OR@-5MY$%J1XNO]NE\?VS'!:7Z4HRS7 +17Y_L]:>9?8^ZL<
M*)&Q/MZ]8U$ORX=C-;>LN';P77:!5EU'0^CW:3%%(\D/UELBA<U&H%2K\) V
MSQ8RSOA_(^/^AQEB^"LR/=S+J<F<O8KTQYGZBS7=GK9=81>1>3RMK=;AI3XO
M96&?8K#15I[RT#:^D% SA;H>T4B'8-2V9!AAX)%>PO&NH%!P-L_L6"*SXVS*
M_"AMX8M&[C;?H3O D89DT6@VBX73[I,%X6!-4>I\3\K5,QYP(6,RF3F^)QA$
M@:P+AS+!HI%DYG,CM]$]8#0<DE298-%(<KMS6WEO[(962VZY6HE1%9H25ELG
MRE%)W'KDKO+OV#[(Z:%^TFNM0LTK*LV0M&S=#P=7TJ4@OJ4UQ@[,B\LP@8.C
MG9]VOT=8*@E@QS)0H*%R$-XV2OHD/TTCG!,0OJX_(4110^R70@CX\J5X(G8*
M1JK$>"956=T(*Z[0ZH5!86A(YAL\64\Q3O-'C8KL1@/<J!V@P0JO#7<O].H8
MW.57E\,,;O\"L6S@3!!X>FB?S!*/ZQ9J;B:T2DYB%&H93-\&,EI#:!BL*@O$
M4 VU='+T>N<@+EQ'R0L!321V!LJ[P9\Z6A\<O3W<)FU\_1H/D<=.;DBV-9>
M:;62DX_&;JQ4O/$4"#4=_4!C-OH5P;KOQ.H\2@(42A[&GP4'V %G%V<7F+I@
M__7J*A"9@P9U06 W'7F!"OEOS?_,A/]6GN5V?_[?Q=X7Y?S_>??%,O__&FTN
M_R=MT)E_&%X!I14VE:9>3C?6R&6X9(H3N/$<_H5]:^0 X@1SZGB8^.0K)N&-
M1$Y,.(S"B:T0:';:D]01PVE^#A <)5S,9.CJO,!1M( A/4%&.'F#UW8ZEI$$
M!__'BA-Y7"U:?9B,QB!=C#5HUI<)1@!,],/H"E?,LXS#!'.^D7<C818F^(S\
M&R;F0 D>SNM-IA$N&8?-ERY(+K^[>O%GBQ=,M7OX/65Q3(/QP_%;,1^9EKI@
M(L:Z6?K?(GB,P0970,$\&^Y=MDC(+?E)#AC\5ZL[1X=[YWM(5)A"JD%K,I)*
MS9Z:B5I6"(,P&'HC\94J*[=71?9_KKQ"+"?.%>I-@LIS*U=QK4,/=4,$\C:F
MZ"Q854)4N A&88A:HY+A$&ZI D,^F?58#*(P$,@<&;[?/OVAGY,<;J=7HX=Z
MME@J<.7027R%Z^)"#NX';20&+<@D<J@V@<OPT1K0A%!IY2<O5C&MW W/Z9S.
MX[XX/?Z ",@^&-H'=)3GT]&$2'*_AO1KXGPZ'Q+U((R5/^L_RYZH4#E^O].N
MNM*72IX3"N#,7D=Q!!.I8A31BLY.=;K9^CL\66EATA#(3XK2"8UE.M#O@]"N
M(&Z2_C1UIDF)6I:/9'O+$HLZIB7_#ZV__S+[^=<?U6GG8ZOQ'294HB=$F3]M
M T_QM_D/_QA_NWX\5+]I=+ \14[XY<QJT5(?Q&IX+RL\0.+6U"?*^-5NJ=U\
M^;%5XEK6@(>P9M5X.&>M2?<QUBI&!Z6:&A"5#BJG@K_OJ- WYO+NLT!08I=I
M[@47/,D,!^%D0H;M>P$%CE$RP<EB[$IBS$VH9H(?B/G;\$LS_HA_KC^B+=R.
MR2A[A8*HJ'4$U4/1M'TII[#11AM'4W9C<(8*O0;"R3&%JC4=:2:AB^&/LA@*
M,>@.E"]U;93'4_V\O]'>BL?>4&UM(=OKQ$.?$4ZE=@Q(>]T THX\H-\"'@ \
MHECYQ %/&BD\;O<@":XP8PBRPF@GJPN7\H\:RT%WLX1-W9B_F^KK)0+FJW+Y
MDKU&;06:(P5MS(I3=[& <8ZO/9Y12,(A@,%1$# )D .,_;.UU%M2 1;A-_M)
M.KCJ?)W\RQ?+MQHSS.^+ML@JJUQ7+E96"=]@_USA5&]',\& =0V;*:)/3ZU0
M[5QA*5))F09!+PC)O0>XB2VC ;C^\#;6GC*2KH=>E&9-V9$6Q=7":7 ?0:4B
M%>F:3=:T#F;]-C-A=2T+J)4E5[C9B_SY&"GS9-A'=P=\, 4%%/!8R2?P2H:
MT56]VUCE>Q]%)T<YG<YM&SQHU8;350K8"!$G='P[Q5#^*V)O()<8 W-$L[SY
MI?-Q#?A+]R/%/UIB/F0?T&H88EQ*@S!=DB.;)N'&>"P)?UR&D=+25)$SQ11V
M0BEXMLR\&@AH/Y 2S8X5K-L6T($N;$#GF:Z%V_VRI!8/SBG6=ZA*DNTD2WW-
M03@^FI<[ U,IJ%9X5>ULN@J>O_*"1-JC9OM!CT%E7SH+Q#[>< ;UYFNNY)R?
M'C70BJA6"T$RN40BZM(E)@([A.*<R/<HB8UMQ85IJ.9B#^&A16G:OZE*:XSP
M9O?M_B$Z:5H>WR!03.8OE"RKD+_2E/PETA]4F2S4LGFT*5GF2M>?-;="9;61
M$3VD0ITKX7[6Z\AWY.O6G^V*S70X6Z>;F\U6:Y$0MY$1O=0T.E9QL903G4<8
M&46NQFH.*Q<!B4Q70G69YQY2DD_55C?GZM":AC8W1T,UQZ.3W2(WO<\YVK3X
MS)4@KJ'"A8FO8TF&.98,G#,U0NNG^LI8ND:/;$4G*_KEC8![N30#XNGC'X1X
M_$Y<0--7N@"(M)6Y"A#ZJFP^ OYF0E1ZQ#S3," WA3Y-Z%%HWYE]ZD>I1>5+
M.QHU!'B&R4 5\0,:&<7C1$FS*=/;_QWVD0^^)4MAK>V+)MH!76'&;!%<G^]K
MZ%.9NX#A$6E%GSO'Z$;(=JA]-HSXKX#F&(5?()Z&Y 9A(?&T,&<01NC+SR-]
M65"D# J4A2N:,NDVH!;E[&BC(<Y*F[,7$ABCZ^#UNUO@O>H?[N''TZ<-(P_^
M2Y5%.[0("%=%+4NA!:KK#=\TX#_4X/RM$2_+>,DUS=M<$>@L5Y\V 116-7/>
MYO0MQ#%/1>8O:QGA"FA1H':J) H NQ/&,1S%-5JI?5>XW3<J1Q$'(\FMI\:&
MT"(3DR.C#$G%J8 1#/S$E100C3-BA<V;7GI[H8V^8'Y6'<W8OIB%2<2H++VL
MS-U3WD^=35&ZS["V10)*R-"-0 :(DN)<#2FV%21;=]*IMWVS9"%**T;4%8KH
M03SQ$->$@64[3/PTV):+P1F)/^.Z.!6!J>9+S)(I^R54ZS )^)T7*K"D5TC&
M)QLYS?'D<K(MU3 _UB1R\;QI+IG'BEQ25D=/,V2QN/C-XK=L6.QF%8S?F+(.
M)E72\*:-.K]"+U!@CO)F^^0'N$Q&EL P/0U[*1]1ZCO19]V#HY^0R :\$M$>
MGE,/HA!=<7T/SPX'Q3/<VJ2!"5J)]F>K,V,G1D@G WT=43@(*H.?#=*1)-=T
M3UQYM[=A7QAXV!.IF\7"K1/S?=B"Z<^"L^!'5*T6 LL1(]Q>2D*%=Z[W6_$A
M0NI?C"+$VT9OM"^W]T,==Q5_W0XP7%W,34-767R+0QN3]&H()XL":LP71!)D
M>]9SV1-LP!=SZ+J6E^F:X(!5Y0-%<"I25=.N)DKA=CVO8(V\AF4%C'M4C+C3
MXBV[W*A,T7(/RVD'913I4CG=BH'21FB^MC:.H#JM$&L3KTQN4C"M<\P*I_%3
MJA6@5IB!1))FBU / ^PJ[9829/SJN+J2[.DZ'"]DP!7A2RH)#,;>C;X!*DH%
M,\0X+!AE5JVX1V9,99"'SEGA:;;03&QS25J*4IK1$$H)&\M0.^"B[T. U$'G
M5REX/QE%N/A+B0&4"N5.I$R8,&X1S5.AS)R1XP4HIMOQ#/&VKA4(W)9^_<O,
MX)D==AK =,P[YLPKAXST&UI$US5TYA6U<(J636:.R9 WP.Q"PZ_O&MF(#3-"
M9\M>X"E,D;U_Z.(H3Y?1;AI:SJ*I"$4F"&\^G/R<T3Q;2'-X!-_O;Q^<4BAC
M4JYAW!4/]+ U#L%U(XH&^A)D;"-#&@Y3@>NBD94QR7R-@:2'< S7,'24XS]4
MVNV[-K&S?7R\CY@FW6['G@P:J0H'H2;'E'DM?463BAU_.SK,C>G>,8:#"EL\
M%VU^4TY[VZ?;!_AW_^##\>Z]XOH3@72HWTXPS(JQ%*W!2.=5J>+YFO,"NK/2
M%]; ODCG&>S+16'QPCAU[<:A.<)#*7%<F(24)4)6GUZ1]]#H0HS1P<Q(2EM/
M)A-B= \@R,!;'A0,\]ZG\B! 4"$T4+D7"E3NP@&5>1! ,LM@@#F! NEO0(&,
M<)_#-*=OF+7%WJ5ORJ6XEWD4^LB.7AC_<\=R!P;(;7*<X4N,2NF1K?$-(7JO
M])4'NDLD"$ZAP_B\7H'50F_>$F477AR@@USV-@7]*BW1-\@$[9=+B&96 T\T
M/*@LP@86;1OU8HR@793!!_?K678A45"T!^&"H=&WW)/%H*"XQM02,EN%.EWD
MNES6TD&5CJ)1&)!#"ID@\Y6W7%Y/J4<2<*F.N<L;C$P>WS SDQ2'1I).S;75
MS8PQRL^4>VVS$$7C"JIE%FNBYI9:W^H]LA6U<J'1ODQ2JO?QBE68#+3J<94#
M7>MDND:3<&64TE(NFX^=Z72& S3KDL#3ETBJ['Y?W]D]&&,,!GIEXTZ2__9K
M"\NV;,NV;,NV;,NV;,NV;,NV;,NV;,NV;,NV;,NV;,NV;,NV;,NV;,NV;,M6
+:O\"=]F"_0!0 "V

end

- --
USENET is *not* the non-clickable part of WWW!
//www.muc.de/~gert/
Gert Doering - Munich, Germany gert@greenie.muc.de
fax: +49-89-3545980 gert.doering@physik.tu-muenchen.de

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2i

iQCVAwUBM9e5qKkuBuNlUUl1AQG2DwP+KAh9yxiyFXWfXCBA42Xp3iMmzDlvjlic
b27rF9mpjdWA9mzcsI0xCXVnwFyeh5aCDxsUB10typR0oGjk4bzj3ll0k5B9ZXdq
QBgE2mQKkdOod8Ew0gQ89VwlMcJAANS+pp0/68ABRDQp6+1K29HysaCMJwmgV0GH
3+cw2ywsOQ8=
=NOr0
-----END PGP SIGNATURE-----