/[base]
ViewVC logotype

Revision 337248


Jump to revision: Previous Next
Author: asomers
Date: Fri Aug 3 14:18:02 2018 UTC (5 years, 11 months ago)
Changed paths: 3
Log Message:
MFC r330718:

tftpd: Verify world-writability for WRQ when using relative paths

tftpd(8) says that files may only be written if they already exist and are
publicly writable.  tftpd.c verifies that a file is publicly writable if it
uses an absolute pathname.  However, if the pathname is relative, that check
is skipped.  Fix it.

Note that this is not a security vulnerability, because the transfer
ultimately doesn't work unless the file already exists and is owned by user
nobody.  Also, this bug does not affect the default configuration, because
the default uses the "-s" option which makes all pathnames absolute.

PR:		226004


Changed paths

Path Details
Directorystable/10/ modified , props changed
Directorystable/10/libexec/tftpd/tests/functional.c modified , text changed
Directorystable/10/libexec/tftpd/tftpd.c modified , text changed

  ViewVC Help
Powered by ViewVC 1.1.27