svn commit: r355731 - stable/11/crypto/openssh

[Ed Maste]

Author: emaste
Date: Fri Dec 13 20:45:45 2019
New Revision: 355731
URL: https://svnweb.freebsd.org/changeset/base/355731

Log:
  sftp: disallow creation (of empty files) in read-only mode
  
  Direct commit to stable/11; already fixed in newer OpenSSH in 12 and
  later.
  
  PR:		233801
  Reported by:	Dani
  Obtained from:	OpenBSD 1.111
  Security:	CVE-2017-15906

Modified:
  stable/11/crypto/openssh/sftp-server.c

Modified: stable/11/crypto/openssh/sftp-server.c
==============================================================================
--- stable/11/crypto/openssh/sftp-server.c	Fri Dec 13 20:38:58 2019	(r355730)
+++ stable/11/crypto/openssh/sftp-server.c	Fri Dec 13 20:45:45 2019	(r355731)
@@ -691,8 +691,8 @@ process_open(u_int32_t id)
 	logit("open \"%s\" flags %s mode 0%o",
 	    name, string_from_portable(pflags), mode);
 	if (readonly &&
-	    ((flags & O_ACCMODE) == O_WRONLY ||
-	    (flags & O_ACCMODE) == O_RDWR)) {
+	    ((flags & O_ACCMODE) != O_RDONLY ||
+	    (flags & (O_CREAT|O_TRUNC)) != 0)) {
 		verbose("Refusing open request in read-only mode");
 		status = SSH2_FX_PERMISSION_DENIED;
 	} else {