From: msweet <msweet@a1ca3aef-8c08-0410-bb20-df032aa958be>
Date: Sun, 22 Dec 2013 00:44:02 +0000 (+0000)
Subject: Security: the lppasswd program incorrectly used settings from ~/.cups/client.conf... 
X-Git-Tag: v2.2b1~787
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=83bc2aac57ce01384e694603aaa72f166d740a32;p=thirdparty%2Fcups.git

Security: the lppasswd program incorrectly used settings from ~/.cups/client.conf (STR #4319)

Don't use the HOME environment variable when running setuid, setgid, or as root.


git-svn-id: svn+ssh://src.apple.com/svn/cups/cups.org/trunk@11484 a1ca3aef-8c08-0410-bb20-df032aa958be
---

diff --git a/CHANGES-1.7.txt b/CHANGES-1.7.txt
index 4e30d9fd3f..6e819927de 100644
--- a/CHANGES-1.7.txt
+++ b/CHANGES-1.7.txt
@@ -3,6 +3,8 @@ CHANGES-1.7.txt
 
 CHANGES IN CUPS V1.7.1
 
+	- Security: the lppasswd program incorrectly used settings from
+	  ~/.cups/client.conf (STR #4319)
 	- Auto debug logging was broken in 1.7.0 (<rdar://problem/15331639>)
 	- Some gzip'd PPD files could not be used (<rdar://problem/15386424>)
 	- Cleaned up some job logging in the scheduler
diff --git a/cups/usersys.c b/cups/usersys.c
index 9a2df68b65..867226d5b9 100644
--- a/cups/usersys.c
+++ b/cups/usersys.c
@@ -1,43 +1,18 @@
 /*
  * "$Id$"
  *
- *   User, system, and password routines for CUPS.
+ * User, system, and password routines for CUPS.
  *
- *   Copyright 2007-2013 by Apple Inc.
- *   Copyright 1997-2006 by Easy Software Products.
+ * Copyright 2007-2013 by Apple Inc.
+ * Copyright 1997-2006 by Easy Software Products.
  *
- *   These coded instructions, statements, and computer programs are the
- *   property of Apple Inc. and are protected by Federal copyright
- *   law.  Distribution and use rights are outlined in the file "LICENSE.txt"
- *   which should have been included with this file.  If this file is
- *   file is missing or damaged, see the license at "http://www.cups.org/".
+ * These coded instructions, statements, and computer programs are the
+ * property of Apple Inc. and are protected by Federal copyright
+ * law.  Distribution and use rights are outlined in the file "LICENSE.txt"
+ * which should have been included with this file.  If this file is
+ * file is missing or damaged, see the license at "http://www.cups.org/".
  *
- *   This file is subject to the Apple OS-Developed Software exception.
- *
- * Contents:
- *
- *   cupsEncryption()	     - Get the current encryption settings.
- *   cupsGetPassword()	     - Get a password from the user.
- *   cupsGetPassword2()      - Get a password from the user using the advanced
- *			       password callback.
- *   cupsServer()	     - Return the hostname/address of the current
- *			       server.
- *   cupsSetClientCertCB()   - Set the client certificate callback.
- *   cupsSetCredentials()    - Set the default credentials to be used for
- *			       SSL/TLS connections.
- *   cupsSetEncryption()     - Set the encryption preference.
- *   cupsSetPasswordCB()     - Set the password callback for CUPS.
- *   cupsSetPasswordCB2()    - Set the advanced password callback for CUPS.
- *   cupsSetServer()	     - Set the default server name and port.
- *   cupsSetServerCertCB()   - Set the server certificate callback.
- *   cupsSetUser()	     - Set the default user name.
- *   cupsSetUserAgent()      - Set the default HTTP User-Agent string.
- *   cupsUser() 	     - Return the current user's name.
- *   cupsUserAgent()	     - Return the default HTTP User-Agent string.
- *   _cupsGetPassword()      - Get a password from the user.
- *   _cupsGSSServiceName()   - Get the GSS (Kerberos) service name.
- *   _cupsSetDefaults()      - Set the default server, port, and encryption.
- *   cups_read_client_conf() - Read a client.conf file.
+ * This file is subject to the Apple OS-Developed Software exception.
  */
 
 /*
@@ -885,7 +860,13 @@ _cupsSetDefaults(void)
   if (cg->encryption == (http_encryption_t)-1 || !cg->server[0] ||
       !cg->user[0] || !cg->ipp_port)
   {
+#  ifdef HAVE_GETEUID
+    if ((geteuid() == getuid() || !getuid()) && getegid() == getgid() && (home = getenv("HOME")) != NULL)
+#  elif !defined(WIN32)
+    if (getuid() && (home = getenv("HOME")) != NULL)
+#  else
     if ((home = getenv("HOME")) != NULL)
+#  endif /* HAVE_GETEUID */
     {
      /*
       * Look for ~/.cups/client.conf...