Date: Mon, 02 Dec 2013 21:47:54 -0700 From: Kurt Seifried <kseifried@...hat.com> To: oss-security@...ts.openwall.com Subject: Re: CVE request: samba pam_winbind authentication fails open -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 12/02/2013 02:24 PM, Vincent Danen wrote: > Just cutting-and-pasting from the bug I just filed. The following > was reported to us, but had been reported upstream last year. > > It was reported  that Samba's pam_winbind module would fail > open (allowing access) when the require_membership_of option is > used as an argument to pam_winbind, and contains a non-existent > group as the value. In such a configuration, rather then failing > and not permitting authentication which is what would be expected, > pam_winbind will allow authentication to proceed. > > For instance, if the following is specified and the user is not a > member of the group 'Admin', they will not obtain access to the > system: > > auth sufficient pam_winbind.so use_first_pass > require_membership_of=Admin > > On the other hand, if the non-existent group 'AdminOops' is > specified, the user is obviously not a member of said group, > authentication will be permitted: > > auth sufficient pam_winbind.so use_first_pass > require_membership_of=AdminOops > > The commit  that most likely introduced this flaw indicates that > this was introduced October 2009 and another commit  looks like > the fix, although that is for another bug  that's somewhat > related to this issue and somewhat not. > >  > https://lists.samba.org/archive/samba-technical/2012-June/084593.html > >  > http://git.samba.org/?p=samba.git;a=commit;h=31f1a36901b5b8959dc51401c09c114829b50392 > >  > http://git.samba.org/?p=samba.git;a=commitdiff;h=f62683956a3b182f6a61cc7a2b4ada2e74cde243 > >  https://bugzilla.samba.org/show_bug.cgi?id=8598 > > > Could a CVE be assigned to this issue? > Please use CVE-2012-6150 for this issue. - -- Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.15 (GNU/Linux) iQIcBAEBAgAGBQJSnWJ5AAoJEBYNRVNeJnmTCFEP/R3S3K+zOCmAzl0Stf/au+KI EIbwXHzNOibVhtXTq46ohJdpNaw+ydEImJKqn9+iACRvXAdHiUESpKjbdoX9NRN7 Yi4r5AC6bkwOtqWnl/xZ+nZO1n+NoNgxxfpBFH6eXfjDCDT79k/jAO+V9tA1UtFL TJClWHsFzjiejjIpEXzqKImwxkbsrwLsVoh1FwTEgMF1MO/Z78+RzR2GeimzQtB0 1obMWbodk8xPKcVi7SkHMBGHnfdmbbPZTG3i8sl2bxmMDh47ypuEsqKut7EZm8gI Th0d9vgm/gLwx/HW6/SfgyjSaLvzucaOsAWfe+EKNG6dsB/JI1Vv3w1gGeAWh6I0 CdPz0/bLkaIkELpr1f35Ccy7/x+D0WN7jaNdIxx2NPXDeqlPnRDAuPACgzXT5FmZ YFm+RumMa1v2b3POFNgFB+r8Yl4iNENUoSue+G/LolYzhS6uM+30Tj1f1O5Zkckb Ur55VJtbh6eQfoahE8DCyIdUvS4cTOFtkGemWQUxdwBmvYBoIwHc40UY2HGzf5nR yMEdwlJUW8o2PF6MXgf/XTYY8fxnvF/c+3Jyn4e0O1cIugdsLH7iIT6Uf3z6suyg RYwMLB/d6K2MdBO0kLsMxAKLUpJAMud398n5i2+wl5LdSuDsPV743sFl7DCaMUd/ u8XceG/IpW8EVL8MXXIQ =OcHn -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.