ftpd/ftpd.c | 10 7 + 3 - 0 !
src/rcp.c | 39 33 + 6 - 0 !
src/rlogin.c | 11 9 + 2 - 0 !
src/rsh.c | 25 21 + 4 - 0 !
src/rshd.c | 20 17 + 3 - 0 !
src/uucpd.c | 15 13 + 2 - 0 !
6 files changed, 100 insertions(+), 20 deletions(-)

 [patch 2/2] ftpd,rcp,rlogin,rsh,rshd,uucpd: fix: check set*id()
 return values

Several setuid(), setgid(), seteuid() and setguid() return values
were not checked in ftpd/rcp/rlogin/rsh/rshd/uucpd code potentially
leading to potential security issues.

Signed-off-by: Jeffrey Bencteux <jeffbencteux@gmail.com>
Signed-off-by: Simon Josefsson <simon@josefsson.org>
Fixes: CVE-2023-40303
Closes: #1049365

src/inetd.c | 7 4 + 3 - 0 !
1 file changed, 4 insertions(+), 3 deletions(-)

 [patch 1/2] inetd: change protocol semantics in inetd.conf

Readd parts of the original patch that got botched when applied
upstream.

* src/inetd.c (getconfigent) [IPV6]: Change default family to IPv4 for "tcp"
and "udp". Change "tcp6" and "udp6" to support IPv4 mapped addresses.

Fixes: commit a12021ee959a88b48cd16e947c671f8f59e29c9d

Makefile.am | 1 0 + 1 - 0 !
configure.ac | 3 0 + 3 - 0 !
2 files changed, 4 deletions(-)

 [patch 2/2] build: disable gfdl info files and useless man pages

We do not install the info file due to GFDL, and because it would
require an inetutils-doc package. Nor the man pages from upstream
generated with help2man as they are problematic for cross-building
and contain no additional information to what is already available
via --help output.

Instead we ship our own proper man pages.

Not forwarded upstream due to GNU policies regarding man pages.

telnet/telnet.c | 10 8 + 2 - 0 !
1 file changed, 8 insertions(+), 2 deletions(-)

 [patch] telnet: add checks for option reply parsing limits

This fixes buffer overflows caused by for example:

  telnet -l`perl -e 'print "A"x5000'` localhost

Taken from FreeBSD.

telnet/utilities.c | 1 0 + 1 - 0 !
1 file changed, 1 deletion(-)

 [patch] telnet: don't infloop for malicious server.

See https://bugs.debian.org/945861 and the tiny patch used by NetBSD:

ftp/ftp.c | 21 21 + 0 - 0 !
1 file changed, 21 insertions(+)

 [patch] ftp: check that pasv/lspv addresses match.

* ftp/ftp.c (initconn): Validate returned addresses.

telnetd/state.c | 12 9 + 3 - 0 !
1 file changed, 9 insertions(+), 3 deletions(-)

 fix remote dos vulnerability in inetutils-telnetd
 This is caused by a crash by a NULL pointer dereference when sending the
 byte sequences 0xff 0xf7 or 0xff 0xf8.
Authors:
 Pierre Kim (original patch),
 Alexandre Torres (original patch),
 Erik Auerswald <auerswal@unix-ag.uni-kl.de> (adapted patch),