Re: Patch: Insecure dependency in open (or perl 5.8.0 taint problem)

Paulo Matos wrote:

>Hi All!
>
>As a lot of people, I also got the error:
>
>Software error:
>Insecure dependency in open while running setuid
>at /var/www/cgi-bin/neomail.pl line 2775.
>
>After a lot of pain I found out that Jonathan Miller, posted a message
>with a link to his latest patch to solve taint problem with perl 5.8.0,
>which is stocked with redhat-8.0.
>

A lot of pain? This question is answered in my unofficial FAQ, as well 
as having been referenced in (quite) a few mailing list messages.

>
>I made this one based on neomail-1.26 code and called it "official", hope
>you don't mind Neo! It's well documented so neomail can run again with no
>trouble at all!
>
>It might seem an unglorious work but all the keywords are in there, so the
>solution will be far simple to find than it was before.
>
>Hope someone can host this patch somewhere more appropriately than here... 
>Tod, Neo?
>
>Regards,
>
>--
>Paulo Matos
>

Hrmm, does Jonathan's patch not apply cleanly to neomail 1.26? If not, 
I'll be glad to update my page & host the patch.

 Thanks!

 Tod.

>
>  
>
>------------------------------------------------------------------------
>
># 
># neomail.pl.taint.official.patch
># 2003.09.10 Paulo Matos <[email protected]> 
>#
># This patch solves the taint problem with perl 5.8.0, this version
># of perl is stocked in RedHat 8.0 distributuion)
>#
># You might have seen this error message
>#
># Software error:
># Insecure dependency in open while running setuid 
># at /var/www/cgi-bin/neomail.pl line 2775.
>#
># This is the official patch that will apply with no problems to
># versions between 1.21 to 1.25 of neomail.
>#
># If you're installing from scratch get neomail-1.26!
>#
>#
># FAQ
># ---
>#
># Q: Why is it called official? You are not the author! 
># A: Because is based on neomail-1.26 code.
>#
># Q: I just donwloaded neomail < 1.26 what should I do?
># A: Get neomail-1.26 it's fixed the problem. 
>#
># Q: I have an older version of neomail, how do I patch?
># A: Change dir to wherever is neomail.pl (or equivalent) and do:
>#
>#    patch < neomail.pl.taint.official.patch 
>#
>#    It might apperar a message like
>#    File to patch:
>#
># be sure you're in the correct dir, and if so, type whatever name you
># gave 'neomail.pl' and press enter.
>#
># IMPORTANT: Don't forget to check out permissions and ownership of the
># patched file, they might be changed. 
># 
># If something of the above is somehow incorrect please let me know.
>#
>--- neomail.pl.orig	2003-09-10 18:13:42.000000000 +0100
>+++ neomail.pl	2003-08-16 16:41:36.000000000 +0100
>@@ -197,6 +197,8 @@
>    @validfolders = @{&getfolders()};
>    if (param("folder")) {
>       $folder = param("folder");
>+      $folder =~ s/[\.|\/|\\|\`|;|<|>]//g; # clean up $folder for perl taint
>+      ($folder =~ /^(.+)$/) && ($folder = $1);
>       foreach my $checkfolder (@validfolders) {
>          if ($folder eq $checkfolder) {
>             $isvalid = 1;
>  
>



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf