[comp.windows.x] xdm security troubles -- public patch availible

keith@EXPO.LCS.MIT.EDU (Keith Packard) (04/18/89)

These two lines were supposed to have been in xdm all along, somehow
they escaped!

As the patch is so short and of general interest, I have included it
below.  It is also available as public patch number 10, anonymous
ftp expo.lcs.mit.edu pub/R3/fixes/fix10 or from the xstuff server
fix 10

The attached patch closes the "window of vulnerability" experienced
by xdm leaving the password around in memory.

*** /u/X/r3/clients/xdm/verify.c	Thu Oct 20 17:38:02 1988
--- clients/xdm/verify.c	Tue Apr 18 12:08:58 1989
***************
*** 53,61 ****
--- 53,63 ----
  		p = &joeblow;
  	Debug ("Verify %s %s\n", greet->name, greet->password);
  	if (strcmp (crypt (greet->password, p->pw_passwd), p->pw_passwd)) {
+ 		bzero (greet->password, strlen (greet->password));
  		Debug ("verify failed\n");
  		return 0;
  	}
+ 	bzero (greet->password, strlen (greet->password));
  	Debug ("verify succeeded\n");
  	verify->uid = p->pw_uid;
  #ifdef NGROUPS