oss-security - CVE request: xrdp

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Wed, 18 Feb 2015 20:22:06 +0000
From: mancha <mancha1@...o.com>
To: oss-security@...ts.openwall.com
Cc: cve-assign@...re.org
Subject: CVE request: xrdp

Starting with glibc 2.17 (eglibc 2.17), crypt() fails with EINVAL (w/
NULL return) if the salt violates specifications. Additionally, on
FIPS-140 enabled Linux systems, DES or MD5 encrypted passwords passed to
crypt() fail with EPERM (w/ NULL return).

It was discovered by Ken Milnore that xrdp 0.6.1 and earlier, when
validating user accounts against plain passwd files or via shadow-utils,
does not check for NULL returns from crypt(). [1]

--- sesman/verify_user.c ---
  encr = crypt(pass,salt);
  if (g_strncmp(encr, hash, 34) != 0)
  {
    return 0;
  }
  return 1;
----------------------------

A NULL return crashes the xrdp-sesman daemon resulting in an xrdp server
denial of service (for all modules that use xrdp's session manager for
user authentication via old-style passwd files or via shadow passwords).

This has been fixed by upstream in its development branch. [2]

Please allocate a CVE for this issue.

Thanks.

--mancha

======
[1] http://sourceforge.net/p/xrdp/mailman/message/32985523/
[2] https://github.com/neutrinolabs/xrdp/commit/851c762ee722

Content of type "application/pgp-signature" skipped

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.