This patch can be applied to the tiger-2.2.3-ARSC version to produce tiger-2.2.3p1-ARSC. *** scripts/check_rhosts.orig Mon Jul 12 14:39:09 1999 --- scripts/check_rhosts Mon Jul 12 14:44:01 1999 *************** *** 104,113 **** { user="$1" file="$2" ! while read rhost ruser ! do ! check_entry "$user" "$rhost" "$ruser" ! done < "$file" } check_file() --- 104,129 ---- { user="$1" file="$2" ! ! # added #+@_ which should be valid characters. ! $AWK '/^[#\+@_a-zA-Z0-9\.\-\t ]*$/ {print}' < "$file" | ! { ! while read rhost ruser ! do ! check_entry "$user" "$rhost" "$ruser" ! done ! } ! ! # added #+@_ which should be valid characters. ! $AWK 'BEGIN {count = 0} !/^[#\+@_a-zA-Z0-9\.\-\t ]*$/ {count += 1} ! END {print count}' < "$file" | ! { ! read count ! if [ "$count" -ne 0 ];then ! message WARN rcmd015w "" "$count lines of user $user's .rhosts file were not checked because of invalid characters." ! fi ! } ! } check_file() *** doc/explain.idx.orig Mon Jul 12 14:48:31 1999 --- doc/explain.idx Mon Jul 12 14:54:11 1999 *************** *** 210,216 **** rcmd011f rhosts.txt 61 70 rcmd012f rhosts.txt 72 74 rcmd013w rhosts.txt 76 80 ! rcmd014w rhosts.txt 82 $ sig001e signature.txt 2 9 sig002a signature.txt 11 15 sig003w signature.txt 17 20 --- 210,217 ---- rcmd011f rhosts.txt 61 70 rcmd012f rhosts.txt 72 74 rcmd013w rhosts.txt 76 80 ! rcmd014w rhosts.txt 82 86 ! rcmd015w rhosts.txt 88 $ sig001e signature.txt 2 9 sig002a signature.txt 11 15 sig003w signature.txt 17 20 *** doc/rhosts.txt.orig Mon Jul 12 14:44:22 1999 --- doc/rhosts.txt Mon Jul 12 14:45:38 1999 *************** *** 84,86 **** --- 84,91 ---- the named user for all systems. However, if this feature isn't supported for your implementation of hosts.equiv, this opens your site to a dangerous vulnerability. See rcmd002f for details. + %rcmd015w + The indicated .rhosts file contains invalid characters, not expected + to be found in a .rhosts file. This file should be examined and the + invalid characters removed, as it may contain a typo or possibly a + command.