Patch: Insecure dependency in open (or perl 5.8.0 taint problem)
Paulo Matos <[email protected]> Thu, 11 Sep 2003 01:49:59 +0100 (WEST)
| Newsgroups | gmane.mail.neomail.general |
|---|---|
| Message-ID | <[email protected]> |
Hi All! As a lot of people, I also got the error: Software error: Insecure dependency in open while running setuid at /var/www/cgi-bin/neomail.pl line 2775. After a lot of pain I found out that Jonathan Miller, posted a message with a link to his latest patch to solve taint problem with perl 5.8.0, which is stocked with redhat-8.0. I made this one based on neomail-1.26 code and called it "official", hope you don't mind Neo! It's well documented so neomail can run again with no trouble at all! It might seem an unglorious work but all the keywords are in there, so the solution will be far simple to find than it was before. Hope someone can host this patch somewhere more appropriately than here... Tod, Neo? Regards, -- Paulo Matos
neomail.pl.taint.official.patch
(text/plain, 1.8 KB)
# # neomail.pl.taint.official.patch # 2003.09.10 Paulo Matos <[email protected]> # # This patch solves the taint problem with perl 5.8.0, this version # of perl is stocked in RedHat 8.0 distributuion) # # You might have seen this error message # # Software error: # Insecure dependency in open while running setuid # at /var/www/cgi-bin/neomail.pl line 2775. # # This is the official patch that will apply with no problems to # versions between 1.21 to 1.25 of neomail. # # If you're installing from scratch get neomail-1.26! # # # FAQ # --- # # Q: Why is it called official? You are not the author! # A: Because is based on neomail-1.26 code. # # Q: I just donwloaded neomail < 1.26 what should I do? # A: Get neomail-1.26 it's fixed the problem. # # Q: I have an older version of neomail, how do I patch? # A: Change dir to wherever is neomail.pl (or equivalent) and do: # # patch < neomail.pl.taint.official.patch # # It might apperar a message like # File to patch: # # be sure you're in the correct dir, and if so, type whatever name you # gave 'neomail.pl' and press enter. # # IMPORTANT: Don't forget to check out permissions and ownership of the # patched file, they might be changed. # # If something of the above is somehow incorrect please let me know. # --- neomail.pl.orig 2003-09-10 18:13:42.000000000 +0100 +++ neomail.pl 2003-08-16 16:41:36.000000000 +0100 @@ -197,6 +197,8 @@ @validfolders = @{&getfolders()}; if (param("folder")) { $folder = param("folder"); + $folder =~ s/[\.|\/|\\|\`|;|<|>]//g; # clean up $folder for perl taint + ($folder =~ /^(.+)$/) && ($folder = $1); foreach my $checkfolder (@validfolders) { if ($folder eq $checkfolder) { $isvalid = 1;