From a7831a16c3e0e1463d5eb08a58af152cb75ca976 Mon Sep 17 00:00:00 2001
|
From: Yi Zhao <yi.zhao@windriver.com>
|
Date: Mon, 15 Apr 2019 06:05:58 +0000
|
Subject: [PATCH] Fix CVE-2019-7282 and CVE-2019-7283
|
|
Description: Fix CVE-2018-20685 and CVE-2019-6111
|
Bug-Debian: https://bugs.debian.org/920486
|
Origin: https://github.com/openssh/openssh-portable/commit/6010c0303a422a9c5fa8860c061bf7105eb7f8b2#diff-9f340c228413d5a9a9206ea2ed2bc624R1114
|
|
Upstream-Status: Backport [Debian]
|
[https://sources.debian.org/src/netkit-rsh/0.17-20/debian/patches/fix-CVE-2018-20685-and-CVE-2019-6111.patch]
|
|
CVE: CVE-2019-7282 CVE-2019-7283
|
|
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
|
---
|
rcp/rcp.c | 5 +++++
|
1 file changed, 5 insertions(+)
|
|
diff --git a/rcp/rcp.c b/rcp/rcp.c
|
index ca61c18..77d8ff8 100644
|
--- a/rcp/rcp.c
|
+++ b/rcp/rcp.c
|
@@ -740,6 +740,11 @@ sink(int argc, char *argv[])
|
size = size * 10 + (*cp++ - '0');
|
if (*cp++ != ' ')
|
SCREWUP("size not delimited");
|
+ if (*cp == '\0' || strchr(cp, '/') != NULL ||
|
+ strcmp(cp, ".") == 0 || strcmp(cp, "..") == 0) {
|
+ error("error: unexpected filename: %s", cp);
|
+ exit(1);
|
+ }
|
if (targisdir) {
|
static char *namebuf;
|
static int cursize;
|
