[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <51B7B71C.1090006@oracle.com>
Date: Tue, 11 Jun 2013 16:47:40 -0700
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com
CC: "X.Org Security Team" <xorg-security@...ts.x.org>, mancha1@...h.com,
"X.Org Development" <xorg-devel@...ts.x.org>
Subject: CVE request for possible NULL ptr deref in XDM when using crypt()
from glibc 2.17+
It's been suggested we get a CVE id assigned for this recent fix to the xdm
display/login manager from X.Org:
http://cgit.freedesktop.org/xorg/app/xdm/commit/?id=8d1eb5c74413e4c9a21f689fc106949b121c0117
Without this fix, if xdm is built to use raw crypt() authentication, instead
of a higher level system such as PAM or BSD Auth, and that crypt() function
can return a NULL pointer (as glibc 2.17+ does for invalid input, such as
when an account is locked by prepending a "!" to the password field), then
attempting to login to such an account via xdm can crash the xdm daemon.
For single user console machines, this generally just means you get the
text console login prompt instead. For machines set up to support multiple
seats, remote XDMCP access, or X terminals (such as LTSP setups using xdm),
this may be a denial of service for users on those other seats/terminals
/devices.
--
-Alan Coopersmith- alan.coopersmith@...cle.com
Oracle Solaris Engineering - http://blogs.oracle.com/alanc
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
