svn commit: r365771 - head/libexec/ftpd

[Mark Johnston]

Author: markj
Date: Tue Sep 15 20:54:18 2020
New Revision: 365771
URL: https://svnweb.freebsd.org/changeset/base/365771

Log:
  ftpd: Exit during authentication if an error occurs after chroot().
  
  admbug:		969
  Security:	CVE-2020-7468

Modified:
  head/libexec/ftpd/ftpd.c

Modified: head/libexec/ftpd/ftpd.c
==============================================================================
--- head/libexec/ftpd/ftpd.c	Tue Sep 15 20:47:33 2020	(r365770)
+++ head/libexec/ftpd/ftpd.c	Tue Sep 15 20:54:18 2020	(r365771)
@@ -1595,13 +1595,20 @@ skip:
 	 *    (uid 0 has no root power over NFS if not mapped explicitly.)
 	 */
 	if (seteuid(pw->pw_uid) < 0) {
-		reply(550, "Can't set uid.");
-		goto bad;
+		if (guest || dochroot) {
+			fatalerror("Can't set uid.");
+		} else {
+			reply(550, "Can't set uid.");
+			goto bad;
+		}
 	}
+	/*
+	 * Do not allow the session to live if we're chroot()'ed and chdir()
+	 * fails. Otherwise the chroot jail can be escaped.
+	 */
 	if (chdir(homedir) < 0) {
 		if (guest || dochroot) {
-			reply(550, "Can't change to base directory.");
-			goto bad;
+			fatalerror("Can't change to base directory.");
 		} else {
 			if (chdir("/") < 0) {
 				reply(550, "Root is inaccessible.");