[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20150219002524.GA16545@zoho.com>
Date: Thu, 19 Feb 2015 00:25:24 +0000
From: mancha <mancha1@...o.com>
To: oss-security@...ts.openwall.com
Cc: cve-assign@...re.org
Subject: Re: CVE request: xrdp
On Wed, Feb 18, 2015 at 08:22:06PM +0000, mancha wrote:
> Starting with glibc 2.17 (eglibc 2.17), crypt() fails with EINVAL (w/
> NULL return) if the salt violates specifications. Additionally, on
> FIPS-140 enabled Linux systems, DES or MD5 encrypted passwords passed
> to crypt() fail with EPERM (w/ NULL return).
>
> It was discovered by Ken Milnore that xrdp 0.6.1 and earlier, when
> validating user accounts against plain passwd files or via
> shadow-utils, does not check for NULL returns from crypt(). [1]
>
> --- sesman/verify_user.c ---
> encr = crypt(pass,salt);
> if (g_strncmp(encr, hash, 34) != 0)
> {
> return 0;
> }
> return 1;
> ----------------------------
>
> A NULL return crashes the xrdp-sesman daemon resulting in an xrdp
> server denial of service (for all modules that use xrdp's session
> manager for user authentication via old-style passwd files or via
> shadow passwords).
>
> This has been fixed by upstream in its development branch. [2]
>
> Please allocate a CVE for this issue.
>
> Thanks.
>
> --mancha
>
> ======
> [1] http://sourceforge.net/p/xrdp/mailman/message/32985523/
> [2] https://github.com/neutrinolabs/xrdp/commit/851c762ee722
I should add, because it wasn't entirely clear from my report, this
issue only affects implementations that directly call glibc's crypt
not those that authenticate via PAM or kerberos.
--mancha
Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
