diff options
| author | Qualys Security Advisory <qsa@qualys.com> | 2021-02-23 08:33:03 -0800 |
|---|---|---|
| committer | Heiko Schlittermann (HS12-RIPE) <hs@schlittermann.de> | 2021-05-27 21:30:58 +0200 |
| commit | b6c1434e4765d1a53efa2f3046bfb20ba682b5d2 (patch) | |
| tree | 561440f802ded6128aa5ec09e2b624146f64e926 /test/stderr/0397 | |
| parent | f83d4a2b3fedd9a8a0e7367db82a68a719f08e30 (diff) | |
CVE-2020-28007: Link attack in Exim's log directory
We patch this vulnerability by opening (instead of just creating) the
log file in an unprivileged (exim) child process, and by passing this
file descriptor back to the privileged (root) parent process. The two
functions log_send_fd() and log_recv_fd() are inspired by OpenSSH's
functions mm_send_fd() and mm_receive_fd(); thanks!
This patch also fixes:
- a NULL-pointer dereference in usr1_handler() (this signal handler is
installed before process_log_path is initialized);
- a file-descriptor leak in dmarc_write_history_file() (two return paths
did not close history_file_fd).
Note: the use of log_open_as_exim() in dmarc_write_history_file() should
be fine because the documentation explicitly states "Make sure the
directory of this file is writable by the user exim runs as."
(cherry picked from commit 2502cc41d1d92c1413eca6a4ba035c21162662bd)
(cherry picked from commit 93e9a18fbf09deb59bd133986f4c89aeb2d2d86a)
Diffstat (limited to 'test/stderr/0397')
| -rw-r--r-- | test/stderr/0397 | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/test/stderr/0397 b/test/stderr/0397 index 82f143787..4d9dcaa47 100644 --- a/test/stderr/0397 +++ b/test/stderr/0397 @@ -1,7 +1,7 @@ -1999-03-02 09:44:33 Cannot open main log file "/non/existent/path/to/force/failure/main": No such file or directory: euid=uuuu egid=EXIM_GID +1999-03-02 09:44:33 Cannot open main log file "/non/existent/path/to/force/failure/main": Permission denied: euid=uuuu egid=EXIM_GID 1999-03-02 09:44:33 Start queue run: pid=pppp -1999-03-02 09:44:33 Cannot open main log file "/non/existent/path/to/force/failure/main": No such file or directory: euid=uuuu egid=EXIM_GID +1999-03-02 09:44:33 Cannot open main log file "/non/existent/path/to/force/failure/main": Permission denied: euid=uuuu egid=EXIM_GID SYSLOG: '2017-07-30 18:51:05 Start queue run: pid=pppp' -SYSLOG: '2017-07-30 18:51:05 Cannot open main log file "/non/existent/path/to/force/failure/main": No such file or directory: euid=uuuu egid=EXIM_GID' +SYSLOG: '2017-07-30 18:51:05 Cannot open main log file "/non/existent/path/to/force/failure/main": Permission denied: euid=uuuu egid=EXIM_GID' SYSLOG: 'exim: could not open panic log - aborting: see message(s) above' exim: could not open panic log - aborting: see message(s) above |