* NEWS, libmisc/chowntty.c: Fix a race condition that could lead to

	gaining ownership or changing mode of arbitrary files.

diff --git a/ChangeLog b/ChangeLog
index 02962127d60fa8c885f0008dbe78b311199ba0ab..31d5597f0d6c4fea732e06d9394d594bd8660ba9 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2008-11-23  Nicolas François  <nicolas.francois@centraliens.net>
+
+       * NEWS, libmisc/chowntty.c: Fix a race condition that could lead to
+       gaining ownership or changing mode of arbitrary files.
+
 2008-10-11  Nicolas François  <nicolas.francois@centraliens.net>
 
        * man/gshadow.5.xml, man/shadow.5.xml, man/passwd.5.xml,

diff --git a/NEWS b/NEWS
index 39ef48987438decdb48fcad8c374ab30672ec181..b91ec42e0ce1f280ed94b335a666e4aa3999dd32 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,6 @@
 $Id$
 
-shadow-4.1.2.1 -> shadow-4.1.3                                         UNRELEASED
+shadow-4.1.2.2 -> shadow-4.1.3                                         UNRELEASED
 
 *** general:
 - packaging
@@ -59,6 +59,12 @@ shadow-4.1.2.1 -> shadow-4.1.3                                               UNRELEASED
   * Allow adding LDAP users (or any user not present in the local passwd
     file) to local groups
 
+shadow-4.1.2.1 -> shadow-4.1.2.2                                       23-11-2008
+
+*** security
+- Fix a race condition in login that could lead to gaining ownership or
+  changing mode of arbitrary files.
+
 shadow-4.1.2 -> shadow-4.1.2.1                                         26-06-2008
 
 *** security

diff --git a/libmisc/chowntty.c b/libmisc/chowntty.c
index 0a68e337ee2ca0e44d4c76130e306029cb58c14f..4a4d0aeba9f7794d8d9c5940b90bfe4eb8cbf9fa 100644 (file)
--- a/libmisc/chowntty.c
+++ b/libmisc/chowntty.c
@@ -109,14 +109,14 @@ void chown_tty (const char *tty, const struct passwd *info)
                exit (1);
        }
 
-       if (   (chown (tty, info->pw_uid, gid) != 0)
-           || (chmod (tty, getdef_num ("TTYPERM", 0600)) != 0)) {
+       if (   (fchown (STDIN_FILENO, info->pw_uid, gid) != 0)
+           || (fchmod (STDIN_FILENO, getdef_num ("TTYPERM", 0600)) != 0)) {
                int err = errno;
 
-               snprintf (buf, sizeof buf, _("Unable to change tty %s"), tty);
+               snprintf (buf, sizeof buf, _("Unable to change tty stdin"));
                perror (buf);
                SYSLOG ((LOG_WARN,
-                        "unable to change tty `%s' for user `%s'\n", tty,
+                        "unable to change tty stdin for user `%s'\n",
                         info->pw_name));
                closelog ();