Fix the latest security issue in fetchmailconf.

http://fetchmail.berlios.de/fetchmail-SA-2005-02.txt
"passwords are written to a world-readable file"

nicer fetchmailconf diff & ok fgsch@ (thanks!)
This commit is contained in:
bernd 2005-10-27 21:58:51 +00:00
parent fec479ae4c
commit e339a20163
2 changed files with 22 additions and 2 deletions

View File

@ -1,9 +1,9 @@
# $OpenBSD: Makefile,v 1.103 2005/08/31 19:55:36 sturm Exp $
# $OpenBSD: Makefile,v 1.104 2005/10/27 21:58:51 bernd Exp $
COMMENT= "mail retrieval utility for POP2, POP3, KPOP, IMAP and more"
DISTNAME= fetchmail-6.2.5.2
PKGNAME= ${DISTNAME}p0
PKGNAME= ${DISTNAME}p1
CATEGORIES= mail
MASTER_SITES= http://download.berlios.de/fetchmail/

View File

@ -0,0 +1,20 @@
$OpenBSD: patch-fetchmailconf,v 1.1 2005/10/27 21:58:51 bernd Exp $
--- fetchmailconf.orig Thu Oct 27 14:42:59 2005
+++ fetchmailconf Thu Oct 27 14:57:33 2005
@@ -858,14 +858,13 @@ class ConfigurationEdit(Frame, MyWidget)
# Pre-1.5.2 compatibility...
except os.error:
pass
- fm = open(self.outfile, 'w')
+ fd = os.open(self.outfile, os.O_CREAT|os.O_WRONLY, 0600)
+ fm = os.fdopen(fd, 'w')
if fm:
fm.write("# Configuration created %s by fetchmailconf\n" % time.ctime(time.time()))
fm.write(`self.configuration`)
if self.outfile:
fm.close()
- if fm != sys.stdout:
- os.chmod(self.outfile, 0600)
self.destruct()
#