Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 18 Feb 2015 20:22:06 +0000
From: mancha <>
Subject: CVE request: xrdp

Starting with glibc 2.17 (eglibc 2.17), crypt() fails with EINVAL (w/
NULL return) if the salt violates specifications. Additionally, on
FIPS-140 enabled Linux systems, DES or MD5 encrypted passwords passed to
crypt() fail with EPERM (w/ NULL return).

It was discovered by Ken Milnore that xrdp 0.6.1 and earlier, when
validating user accounts against plain passwd files or via shadow-utils,
does not check for NULL returns from crypt(). [1]

--- sesman/verify_user.c ---
  encr = crypt(pass,salt);
  if (g_strncmp(encr, hash, 34) != 0)
    return 0;
  return 1;

A NULL return crashes the xrdp-sesman daemon resulting in an xrdp server
denial of service (for all modules that use xrdp's session manager for
user authentication via old-style passwd files or via shadow passwords).

This has been fixed by upstream in its development branch. [2]

Please allocate a CVE for this issue.




Content of type "application/pgp-signature" skipped

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.