diff options
| author |   Ben Lutgens <blutgens@gentoo.org> | 2001-07-12 19:43:49 +0000 |
|---|---|---|
| committer | Ben Lutgens <blutgens@gentoo.org> | 2001-07-12 19:43:49 +0000 |
| commit | 1a00eb7a4ed9a30126a96eefbcdd5103d4f43881 (patch) | |
| tree | 07cc97618af70259d3a243d1a4688d2264f77618 /app-arch/unzip/files | |
| parent | fixed doc installs. (diff) | |
| download | historical-1a00eb7a4ed9a30126a96eefbcdd5103d4f43881.tar.gz historical-1a00eb7a4ed9a30126a96eefbcdd5103d4f43881.tar.bz2 historical-1a00eb7a4ed9a30126a96eefbcdd5103d4f43881.zip | |
Some security fixes and some touch ups. tar and unzip are both prone to
undesirable directory traversal (nothing like leaving .. unlinked *shudder*) I
package.masked unzip-5.42 since thier server is busted and I can't test it yet.
http://www.security.nnov.ru/advisories <-- is the advisories. rar is also
suceptible. Remeber you should run archivers under a privleged UID.
Diffstat (limited to 'app-arch/unzip/files')
| -rw-r--r-- | app-arch/unzip/files/unzip-5.42.patch | 31 |
1 files changed, 31 insertions, 0 deletions
diff --git a/app-arch/unzip/files/unzip-5.42.patch b/app-arch/unzip/files/unzip-5.42.patch new file mode 100644 index 000000000000..a39d3c7d137e --- /dev/null +++ b/app-arch/unzip/files/unzip-5.42.patch @@ -0,0 +1,31 @@ +*** extract.orig Sun Jan 14 00:40:20 2001 +--- extract.c Mon Jul 9 14:45:42 2001 +*************** +*** 154,159 **** +--- 154,161 ---- + #ifndef WINDLL + static ZCONST char Far ReplaceQuery[] = + "replace %s? [y]es, [n]o, [A]ll, [N]one, [r]ename: "; ++ static ZCONST char Far TraversalWarning[] = ++ "%s skipped because of directory traversal\n"; + static ZCONST char Far AssumeNone[] = " NULL\n(assuming [N]one)\n"; + static ZCONST char Far NewNameQuery[] = "new name: "; + static ZCONST char Far InvalidResponse[] = "error: invalid response [%c]\n"; +*************** +*** 877,882 **** +--- 879,893 ---- + } /* end switch (*answerbuf) */ + #endif /* ?WINDLL */ + } /* end if (query) */ ++ if(*__G__ G.filename=='/' || !strncmp(__G__ G.filename, "../", 3) ++ || strstr(__G__ G.filename,"/../")){ ++ skip_entry = SKIP_Y_EXISTING; ++ #ifndef WINDLL ++ Info(slide, 0x81, ((char *)slide, ++ LoadFarString(TraversalWarning), ++ FnFilter1(G.filename))); ++ #endif ++ } + if (skip_entry != SKIP_NO) { + #ifdef WINDLL + if (skip_entry == SKIP_Y_EXISTING) { |