Re: Patch: Insecure dependency in open (or perl 5.8.0 taint problem)

Jonathan's patch is not needed on 1.26, as the taint changes were taken  
care of, actually.

On Thursday, September 11, 2003, at 12:29  AM, Tod D. Ihde wrote:

>
>
> Paulo Matos wrote:
>
>> Hi All!
>>
>> As a lot of people, I also got the error:
>>
>> Software error:
>> Insecure dependency in open while running setuid
>> at /var/www/cgi-bin/neomail.pl line 2775.
>>
>> After a lot of pain I found out that Jonathan Miller, posted a message
>> with a link to his latest patch to solve taint problem with perl  
>> 5.8.0,
>> which is stocked with redhat-8.0.
>>
>
> A lot of pain? This question is answered in my unofficial FAQ, as well  
> as having been referenced in (quite) a few mailing list messages.
>
>>
>> I made this one based on neomail-1.26 code and called it "official",  
>> hope
>> you don't mind Neo! It's well documented so neomail can run again  
>> with no
>> trouble at all!
>>
>> It might seem an unglorious work but all the keywords are in there,  
>> so the
>> solution will be far simple to find than it was before.
>>
>> Hope someone can host this patch somewhere more appropriately than  
>> here... Tod, Neo?
>>
>> Regards,
>>
>> --
>> Paulo Matos
>>
>
> Hrmm, does Jonathan's patch not apply cleanly to neomail 1.26? If not,  
> I'll be glad to update my page & host the patch.
>
> Thanks!
>
> Tod.
>
>>
>>
>> ---------------------------------------------------------------------- 
>> --
>>
>> # # neomail.pl.taint.official.patch
>> # 2003.09.10 Paulo Matos <[email protected]> #
>> # This patch solves the taint problem with perl 5.8.0, this version
>> # of perl is stocked in RedHat 8.0 distributuion)
>> #
>> # You might have seen this error message
>> #
>> # Software error:
>> # Insecure dependency in open while running setuid # at  
>> /var/www/cgi-bin/neomail.pl line 2775.
>> #
>> # This is the official patch that will apply with no problems to
>> # versions between 1.21 to 1.25 of neomail.
>> #
>> # If you're installing from scratch get neomail-1.26!
>> #
>> #
>> # FAQ
>> # ---
>> #
>> # Q: Why is it called official? You are not the author! # A: Because  
>> is based on neomail-1.26 code.
>> #
>> # Q: I just donwloaded neomail < 1.26 what should I do?
>> # A: Get neomail-1.26 it's fixed the problem. #
>> # Q: I have an older version of neomail, how do I patch?
>> # A: Change dir to wherever is neomail.pl (or equivalent) and do:
>> #
>> #    patch < neomail.pl.taint.official.patch #
>> #    It might apperar a message like
>> #    File to patch:
>> #
>> # be sure you're in the correct dir, and if so, type whatever name you
>> # gave 'neomail.pl' and press enter.
>> #
>> # IMPORTANT: Don't forget to check out permissions and ownership of  
>> the
>> # patched file, they might be changed. # # If something of the above  
>> is somehow incorrect please let me know.
>> #
>> --- neomail.pl.orig	2003-09-10 18:13:42.000000000 +0100
>> +++ neomail.pl	2003-08-16 16:41:36.000000000 +0100
>> @@ -197,6 +197,8 @@
>>    @validfolders = @{&getfolders()};
>>    if (param("folder")) {
>>       $folder = param("folder");
>> +      $folder =~ s/[\.|\/|\\|\`|;|<|>]//g; # clean up $folder for  
>> perl taint
>> +      ($folder =~ /^(.+)$/) && ($folder = $1);
>>       foreach my $checkfolder (@validfolders) {
>>          if ($folder eq $checkfolder) {
>>             $isvalid = 1;
>>
>
>
>
> -------------------------------------------------------
> This sf.net email is sponsored by:ThinkGeek
> Welcome to geek heaven.
> http://thinkgeek.com/sf
> _______________________________________________
> NeoMail-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/neomail-users
>



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf