From: Phil Pennock Date: Tue, 15 May 2018 23:04:34 +0000 (-0400) Subject: Don't open spool data-files which are symlinks X-Git-Url: https://git.exim.org/users/heiko/exim.git/commitdiff_plain/85defcf0e9e4187107b8a1a5138ef9590ac3892c Don't open spool data-files which are symlinks --- diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog index d9b77804b..d99b2684a 100644 --- a/doc/doc-txt/ChangeLog +++ b/doc/doc-txt/ChangeLog @@ -29,6 +29,9 @@ JH/05 Bug 2273: Cutthrough delivery left a window where the received messsage add more error-checking on spoolfile handling while that code is being messed with. +PP/01 Refuse to open a spool data file (*-D) if it's a symlink. + No known attacks, no CVE, this is defensive hardening. + Exim version 4.91 ----------------- diff --git a/src/src/spool_in.c b/src/src/spool_in.c index 33890c516..cd74d1ee7 100644 --- a/src/src/spool_in.c +++ b/src/src/spool_in.c @@ -57,9 +57,17 @@ for (i = 0; i < 2; i++) fname = spool_fname(US"input", message_subdir, id, US"-D"); DEBUG(D_deliver) debug_printf("Trying spool file %s\n", fname); + /* We protect against symlink attacks both in not propagating the + * file-descriptor to other processes as we exec, and also ensuring that we + * don't even open symlinks. + * No -D file inside the spool area should be a symlink. + */ if ((fd = Uopen(fname, #ifdef O_CLOEXEC O_CLOEXEC | +#endif +#ifdef O_NOFOLLOW + O_NOFOLLOW | #endif O_RDWR | O_APPEND, 0)) >= 0) break;