glibc 2.17+ XDM crypto() NULL pointer deref

2013-06-12 / 2013-06-15
Risk: Medium
Local: Yes
Remote: No
CWE: CWE-310


CVSS Base Score: 4.3/10
Impact Subscore: 2.9/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: None
Integrity impact: None
Availability impact: Partial

It's been suggested we get a CVE id assigned for this recent fix to the xdm display/login manager from X.Org: http://cgit.freedesktop.org/xorg/app/xdm/commit/?id=8d1eb5c74413e4c9a21f689fc106949b121c0117 Without this fix, if xdm is built to use raw crypt() authentication, instead of a higher level system such as PAM or BSD Auth, and that crypt() function can return a NULL pointer (as glibc 2.17+ does for invalid input, such as when an account is locked by prepending a "!" to the password field), then attempting to login to such an account via xdm can crash the xdm daemon. For single user console machines, this generally just means you get the text console login prompt instead. For machines set up to support multiple seats, remote XDMCP access, or X terminals (such as LTSP setups using xdm), this may be a denial of service for users on those other seats/terminals /devices. greeter/verify.c 5 1 files changed, 4 insertions, 1 deletions diff --git a/greeter/verify.c b/greeter/verify.c index db3cb7d..b009e2b 100644 --- a/greeter/verify.c +++ b/greeter/verify.c @@ -329,6 +329,7 @@ Verify (struct display *d, struct greet_info *greet, struct verify_info *verify) struct spwd *sp; # endif char *user_pass = NULL; + char *crypted_pass = NULL; # endif # ifdef __OpenBSD__ char *s; @@ -464,7 +465,9 @@ Verify (struct display *d, struct greet_info *greet, struct verify_info *verify) # if defined(ultrix) || defined(__ultrix__) if (authenticate_user(p, greet->password, NULL) < 0) # else - if (strcmp (crypt (greet->password, user_pass), user_pass)) + crypted_pass = crypt (greet->password, user_pass); + if ((crypted_pass == NULL) + || (strcmp (crypted_pass, user_pass))) # endif { if(!greet->allow_null_passwd || strlen(p->pw_passwd) > 0) {

References:

http://cgit.freedesktop.org/xorg/app/xdm/commit/?id=8d1eb5c74413e4c9a21f689fc106949b121c0117
http://seclists.org/oss-sec/2013/q2/543
http://seclists.org/oss-sec/2013/q2/558


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top