OMG - unsanitized shell command. Thanks to Niels Teusink. (CVE-2009-1579)
authorpdontthink <pdontthink@7612ce4b-ef26-0410-bec9-ea0150e637f0>
Mon, 11 May 2009 22:17:46 +0000 (22:17 +0000)
committerpdontthink <pdontthink@7612ce4b-ef26-0410-bec9-ea0150e637f0>
Mon, 11 May 2009 22:17:46 +0000 (22:17 +0000)
git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@13675 7612ce4b-ef26-0410-bec9-ea0150e637f0

doc/ChangeLog
functions/imap_general.php

index 234feac..730473d 100644 (file)
@@ -301,6 +301,8 @@ Version 1.5.2 - SVN
   - Fixed the lack of sanitizing of contrib/decrypt_headers.php input;
     also includes general cleanup of that page (Thanks to Niels Teusink).
     [also CVE-2009-1578]
+  - Fixed unsanitized shell command in example IMAP username mapping
+    function (map_yp_alias) (Thanks to Niels Teusink). [CVE-2009-1579]
 
 Version 1.5.1 (branched on 2006-02-12)
 --------------------------------------
index d81192a..0121a21 100755 (executable)
@@ -1436,6 +1436,6 @@ function sqimap_get_user_server ($imap_server, $username) {
  * @since 1.3.0
  */
 function map_yp_alias($username) {
-   $yp = `ypmatch $username aliases`;
+   $yp = `ypmatch ' . escapeshellarg($username) . ' aliases`;
    return chop(substr($yp, strlen($username)+1));
 }