Prevent hardlink attack on mbox sticky mail directory. fixes: bug #988

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index 1c1a81b706e308d958127e3ec0df1c87291a2868..1f86a569d3d5bc00fbe4466119fe5aead2f5597a 100644 (file)
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -1,4 +1,4 @@
-$Cambridge: exim/doc/doc-txt/ChangeLog,v 1.607 2010/03/23 14:06:48 jetmore Exp $
+$Cambridge: exim/doc/doc-txt/ChangeLog,v 1.608 2010/05/26 12:26:00 nm4 Exp $
 
 Change log file for Exim from version 4.21
 -------------------------------------------
@@ -25,6 +25,9 @@ NM/05 Bugzilla 671: Added umask to procmail example.
 
 JJ/03 installed exipick 20100323.0, fixing doc bug
 
+NM/06 Bugzilla 988: CVE-2010-2023 - prevent hardlink attack on sticky mail
+      directory.  Notification and patch from Dan Rosenberg
+
 
 Exim version 4.71
 -----------------

diff --git a/src/src/transports/appendfile.c b/src/src/transports/appendfile.c
index df2ce1cd8772f2037456270031a81fe7298eb206..984f2d7d64f7c25d63e2db4783c6cdd44e4e1eac 100644 (file)
--- a/src/src/transports/appendfile.c
+++ b/src/src/transports/appendfile.c
@@ -1,4 +1,4 @@
-/* $Cambridge: exim/src/src/transports/appendfile.c,v 1.24 2009/11/16 19:50:39 nm4 Exp $ */
+/* $Cambridge: exim/src/src/transports/appendfile.c,v 1.25 2010/05/26 12:26:01 nm4 Exp $ */
 
 /*************************************************
 *     Exim - an Internet mail transport agent    *
@@ -1806,6 +1806,18 @@ if (!isdirectory)
         goto RETURN;
         }
 
+      /* Just in case this is a sticky-bit mail directory, we don't want
+      users to be able to create hard links to other users' files. */
+
+      if (statbuf.st_nlink != 1)
+        {
+        addr->basic_errno = ERRNO_NOTREGULAR;
+        addr->message = string_sprintf("mailbox %s%s has too many links (%d)",
+          filename, islink? " (symlink)" : "", statbuf.st_nlink);
+        goto RETURN;
+
+        }
+
       /* If symlinks are permitted (not recommended), the lstat() above will
       have found the symlink. Its ownership has just been checked; go round
       the loop again, using stat() instead of lstat(). That will never yield a