View | Details | Raw Unified
Collapse All | Expand All

(-) krb5-1.5.2.orig/src/appl/telnet/telnetd/state.c (-1 / +2 lines)
 Lines 1665-1671    Link Here  
	    strcmp(varp, "RESOLV_HOST_CONF") && /* linux */
	    strcmp(varp, "RESOLV_HOST_CONF") && /* linux */
	    strcmp(varp, "NLSPATH") && /* locale stuff */
	    strcmp(varp, "NLSPATH") && /* locale stuff */
	    strncmp(varp, "LC_", strlen("LC_")) && /* locale stuff */
	    strncmp(varp, "LC_", strlen("LC_")) && /* locale stuff */
	    strcmp(varp, "IFS")) {
 
	    strcmp(varp, "IFS") &&
 

              
		!strchr(varp, '-')) {

            

        
		return 1;
		return 1;

        
	} else {
	} else {

        
		syslog(LOG_INFO, "Rejected the attempt to modify the environment variable \"%s\"", varp);
		syslog(LOG_INFO, "Rejected the attempt to modify the environment variable \"%s\"", varp);



(-) krb5-1.5.2.orig/src/appl/telnet/telnetd/sys_term.c
      (-2 / +20 lines)




  

    

    

       Lines 1287-1292
       
    
  Link Here 
    

  

        
#endif
#endif

        
#if	defined (AUTHENTICATION)
#if	defined (AUTHENTICATION)

        
	if (auth_level >= 0 && autologin == AUTH_VALID) {
	if (auth_level >= 0 && autologin == AUTH_VALID) {

            

              
              
		if (name[0] == '-') {

            

            

              
              
			/* Authenticated and authorized to log in to an account

            

            

              
              
			 * starting with '-'?  Even if that unlikely case comes

            

            

              
              
			 * to pass, the current program will not patse the

            

            

              
              
			 * resulting command line properly.

            

            

              
              
			 */

            

            

              
              
			syslog(LOG_ERR, "user name can not start with '-'");

            

            

              
              
			fatal(net, "user name can not start with '-'");

            

            

              
              
			exit(1);

            

            

              
              
		}

            

        
# if	!defined(NO_LOGIN_F)
# if	!defined(NO_LOGIN_F)

        
#if	defined(LOGIN_CAP_F)
#if	defined(LOGIN_CAP_F)

        
		argv = addarg(argv, "-F");
		argv = addarg(argv, "-F");

  

    

    

       Lines 1377-1388
       
    
  Link Here 
    

  

        
	} else
	} else

        
#endif
#endif

        
	if (getenv("USER")) {
	if (getenv("USER")) {

            

              
		argv = addarg(argv, getenv("USER"));

              
		char *user = getenv("USER");

            

            

              

              
		if (user[0] == '-') {

            

            

              

              
			/* "telnet -l-x ..." */

            

            

              

              
			syslog(LOG_ERR, "user name cannot start with '-'");

            

            

              

              
			fatal(net, "user name cannot start with '-'");

            

            

              

              
			exit(1);

            

            

              

              
		}

            

            

              

              
		argv = addarg(argv, user);

            

        
#if	defined(LOGIN_ARGS) && defined(NO_LOGIN_P)
#if	defined(LOGIN_ARGS) && defined(NO_LOGIN_P)

        
		{
		{

        
			register char **cpp;
			register char **cpp;

        
			for (cpp = environ; *cpp; cpp++)
			for (cpp = environ; *cpp; cpp++)

            

              
				argv = addarg(argv, *cpp);

              
				if ((*cpp[0] != '-')

            

            

              

              
					argv = addarg(argv, *cpp);

            

        
		}
		}

        
#endif
#endif

        
		/*
		/*