Module Name: src Committed By: drochner Date: Wed Nov 9 20:26:41 UTC 2011
Modified Files: src/dist/openpam/lib: openpam_configure.c Log Message: Don't allow '/' characters in the "service" argument to pam_start() The "service" is blindly appended to config directories ("/etc/pam.d/"), and if a user can control the "service" it can get PAM to read config files from any location. This is not a problem with most software because the "service" is usually a constant string. The check protects 3rd party software from being abused. (CVE-2011-4122) To generate a diff of this commit: cvs rdiff -u -r1.5 -r1.6 src/dist/openpam/lib/openpam_configure.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.