bugTiger UNIX security tool - Bugs: bug #43336, Fix for missing escapes in...

 
 

bug #43336: Fix for missing escapes in check_accounts

Submitted by:  None
Submitted on:  Tue Sep 30 21:02:14 2014  
 
Category: Security check modulesSeverity: 5-Critical
Item Group: Script errorStatus: None
Privacy: PublicAssigned to: None
Open/Closed: OpenOperating System: Debian GNU/Linux

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Tue Sep 30 21:02:14 2014, original submission:

In check_accounts in check_users() there is a check for shell init files which misses escapes for the quotes in the eval'd code.

Here is the patch:

--- /usr/lib/tiger/scripts/check_accounts 2012-04-18 19:45:35.000000000 +0200
+++ check_accounts 2014-09-30 22:50:51.765407045 +0200
@@ -303,7 +303,7 @@
eval "
case \"$shell\" in
$shcase)
- [ ! -r "${home}/.${shell##*/}rc" ] && {
+ [ ! -r \"${home}/.${shell##*/}rc\" ] && {
message WARN acc019w \"\" \"Login ID $user may be missing a shell initialization file ${home}/.${shell##*/}rc.\"
}
;;

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

No Changes Have Been Made to This Item

Back to the top


Powered by Savane 3.1-cleanup1