Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Tue, 16 Aug 2016 15:34:54 +0530
From: Huzaifa Sidhpurwala <huzaifas@...hat.com>
To: oss-security@...ts.openwall.com
Subject: cracklib: Stack-based buffer overflow when parsing large GECOS field

Hi All,

A security flaw was reported to us by CSG Labs, details as follows:

A stack-based overflow was found in the way cracklib, a library used to
stop users from choosing easy to guess passwords, handled large GECOS
field in the /etc/passwd file. When an application compiled against the
cracklib libary, such as "passwd" is used to parse the GECOS field, it
could cause the application to crash or execute arbitary code with the
permissions of the user running such an application.

To trigger the flaw, you need a specially-crafted "long" GECOS field,
which can be done by a local user on the system. The attacker then needs
to run some utility which uses cracklib to process this long GECOS field
on the system. (such as "passwd" application which runs suid root)

All versions of the cracklib library shipped with Red Hat Enterprise
Linux are compiled with FORTIFY_SOURCE, which detects the
buffer-overflow and aborts the application safely.

Therefore the maximum impact of this flaw is application crash.

However, there may be other applications, distributions which dont
compile cracklib with FORTIFY_SOURCE, and this can lead to easy code
exec or even privsec.

A proposed patch is available at:
https://bugzilla.redhat.com/attachment.cgi?id=1188599

This flaw was assigned CVE-2016-6318 and it was previously disclosed via
linux-distros mailing list.


-- 
Huzaifa Sidhpurwala / Red Hat Product Security Team

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ