>Number:         8428
>Category:       bin
>Synopsis:       uucpd truncates login names at 8 characters
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    bin-bug-people (Utility Bug People)
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Sep 17 08:20:00 1999
>Last-Modified:
>Originator:     Eric Schnoebelen
>Organization:
Central Iowa (Model) Railroad, Dallas, TX US
>Release:        19990917
>Environment:
System: NetBSD ihnp4 1.4 NetBSD 1.4 (GENERIC_SCSI3) #0: Sun May 9 04:05:20 MEST 1999 pk@flambard:/usr/src/sys/arch/sparc/compile/GENERIC_SCSI3 sparc

>Description:
	uucpd truncates login names at 8 characters causing uucp users
	with longer login names to be denied access.

	(as I recall, either 1.3 or 1.4 of NetBSD raised the length on
	user names above 8 characters.)

>How-To-Repeat:
	Create a uucp user with a nine character login (Uabcdefgh).
	Attempt to login via uucpd (port 540) to Uabcdefgh.
	See the ``Login incorrect'' message.
	Attempt to login via telnet to Uabcdefgh.
	See the ``Shere='' message of a successful connection.

>Fix:
	[ the following fix is in service on uucp.cirr.com]
	--- uucpd.c~	Fri Sep 17 09:57:44 1999
	+++ uucpd.c	Fri Sep 17 09:56:31 1999
	@@ -159,8 +159,7 @@
				return;
			}
		} while (user[0] == '\0');
	-	/* truncate username to 8 characters */
	-	user[8] = '\0';
	+
		pw = getpwnam(user);
		if (pw == NULL || (pw->pw_passwd && *pw->pw_passwd != '\0')) {
			printf("Password: ");
>Audit-Trail:
>Unformatted: