[0161] daemon@ATHENA.MIT.EDU (Rod Whitby) Epoch 09/12/90 07:04 (27 lines) Subject: Re: Epoch Resources To: epoch@cs.uiuc.edu Cc: rwhitby@adl.austek.oz.au Date: Wed, 12 Sep 90 08:51:34 +1030 From: Rod Whitby > I modified a few lines in xdefault.c so that the file > /usr/lib/X11/app-defaults/Emacs is examined *before* the > user's .Xdefaults file. The patch follows. > It would be nice if this or a similar feature were added to the > final version of Epoch 3.2. I would hope that this and all other built-in X initialization paths would use XtResolvePathname so as not to disadvantage people who do not have access to /usr/lib (myself for one). Please don't assume that everyone who is installing epoch has root access and/or access to /usr/lib. Rod Whitby _--_|\ Austek Microsystems / \ Technology Park ACSnet: rwhitby@austek.oz \_.--*_/ Adelaide, SA 5095 ARPA: rwhitby@austek.oz.au v Australia UUCP: uunet.uu.net!munnari!austek.oz.au!rwhitby X-Face: %}1klhj1q/qgLe;Nz<&;'7TsMEx5A-`,l|;;\.s5TiG99*0QR{~hNesXoQWp|I*"@r)U1\u Dvj|b#m5uV.2QkJ. To: xbugs@expo.lcs.mit.edu Message-Id: <9010010119.4001.x.babaz@cs.su.oz> Subject: xdm: serious security bug X-Face: 39seV7n\`#asqOFdx#oj/Uz*lseO_1n9n7rQS;~ve\e`&Z},nU1+>0X^>mg&M.^X$[ez>{F k5[Ah<7xBWF-@-ru?& @4K4-b`ydd^`(n%Z{ ### bug number: 3395 ### area: xdm ### severity: medium ### comments: In view of the fairly serious import of this I would appreciate some kind of acknowledgment. Thanks, John. X Window System Bug Report xbugs@expo.lcs.mit.edu VERSION: R4 CLIENT MACHINE and OPERATING SYSTEM: Any DISPLAY TYPE: Any WINDOW MANAGER: Any AREA: xdm SYNOPSIS: xdm, when running a session with authorization, leaves a file descriptor open on /dev/mem after forking the user's session. Fortunately it's read-only, but that's bad enough. DESCRIPTION: There is no close() corresponding to the open() of /dev/mem on line 183 of cryptokey.c. Furthermore, the test for whether the open failed is incorrectly coded. REPEAT BY: Read the code. Or, compile this program, call the result fstat, put it in your path, put "fstat >>fstat.log" in your .xsession, log in on a machine using authorization, and look for a result like this: 0: 16/0 2 0/0 0040775 16 2 2 1024 1: 20/8 59452 0/0 0100600 1 221 10 657 2: 16/6 59786 0/0 0100664 1 2 2 282440 5: 16/0 2191 1/0 0020640 1 0 3 0 <<<<<<<<<<<<<<<<<<<<<<<<<<<< ^^^ where 1,0 is the major,minor number of /dev/mem on that system. --- cut here fstat.c #include #include #include #include #define MAX 128 #ifdef mips #define Errno EBADF #else #ifdef sun #define Errno EBADF #endif #endif #ifndef Errno #define Errno EBADF #endif main() { int fd; int i; struct stat stb; extern int errno; extern int sys_nerr; extern char *sys_errlist[]; for (fd = 0; fd < MAX; fd++) { if (fstat(fd, &stb) < 0) { if (errno == Errno) continue; else { i = errno; printf("%d:\t", fd); if (i < 0 || i >= sys_nerr) printf("Unknown error %d\n", i); else printf("%s\n", sys_errlist[i]); } } else printf("%d:\t%d/%d %d %d/%d 0%06o %d %d %d %ld\n", fd, (stb.st_dev >> 8) & 0377, stb.st_dev & 0377, stb.st_ino, (stb.st_rdev >> 8) & 0377, stb.st_rdev & 0377, stb.st_mode, stb.st_nlink, stb.st_uid, stb.st_gid, stb.st_size); } exit(0); } --- cut here fstat.c SAMPLE FIX: *** cryptokey.c Mon Apr 23 12:40:12 1990 --- /tmp/cryptokey.c Mon Oct 1 01:35:13 1990 *************** *** 181,187 **** int i; fd = open (name, 0); ! if (!fd) return 0; reads = FILE_LIMIT; while ((cnt = read (fd, buf, sizeof (buf))) > 0 && --reads > 0) { --- 181,187 ---- int i; fd = open (name, 0); ! if (fd < 0) return 0; reads = FILE_LIMIT; while ((cnt = read (fd, buf, sizeof (buf))) > 0 && --reads > 0) { *************** *** 191,196 **** --- 191,197 ---- sum[1] += buf[i+1]; } } + close (fd); return 1; } --[1261]--