Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20150219002524.GA16545@zoho.com>
Date: Thu, 19 Feb 2015 00:25:24 +0000
From: mancha <mancha1@...o.com>
To: oss-security@...ts.openwall.com
Cc: cve-assign@...re.org
Subject: Re: CVE request: xrdp

On Wed, Feb 18, 2015 at 08:22:06PM +0000, mancha wrote:
> Starting with glibc 2.17 (eglibc 2.17), crypt() fails with EINVAL (w/
> NULL return) if the salt violates specifications. Additionally, on
> FIPS-140 enabled Linux systems, DES or MD5 encrypted passwords passed
> to crypt() fail with EPERM (w/ NULL return).
> 
> It was discovered by Ken Milnore that xrdp 0.6.1 and earlier, when
> validating user accounts against plain passwd files or via
> shadow-utils, does not check for NULL returns from crypt(). [1]
> 
> --- sesman/verify_user.c ---
>   encr = crypt(pass,salt);
>   if (g_strncmp(encr, hash, 34) != 0)
>   {
>     return 0;
>   }
>   return 1;
> ----------------------------
> 
> A NULL return crashes the xrdp-sesman daemon resulting in an xrdp
> server denial of service (for all modules that use xrdp's session
> manager for user authentication via old-style passwd files or via
> shadow passwords).
> 
> This has been fixed by upstream in its development branch. [2]
> 
> Please allocate a CVE for this issue.
> 
> Thanks.
> 
> --mancha
> 
> ======
> [1] http://sourceforge.net/p/xrdp/mailman/message/32985523/
> [2] https://github.com/neutrinolabs/xrdp/commit/851c762ee722

I should add, because it wasn't entirely clear from my report, this
issue only affects implementations that directly call glibc's crypt
not those that authenticate via PAM or kerberos.

--mancha

Content of type "application/pgp-signature" skipped

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.