Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 505604 (CVE-2014-2583)

Summary: <sys-libs/pam-1.1.8-r3: path traversal issue in pam_timestamp's format_timestamp_name()
Product: Gentoo Security Reporter: Agostino Sarubbo <ago>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: RESOLVED FIXED    
Severity: minor CC: pam-bugs+disabled, sudormrfhalt
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
URL: https://bugzilla.redhat.com/show_bug.cgi?id=1080243
Whiteboard: A4 [glsa]
Package list:
Runtime testing required: ---
Attachments:
Description Flags
pam-1.1.8-cve-2014-2583.patch none

Description Agostino Sarubbo gentoo-dev 2014-03-25 09:30:50 UTC
From ${URL} :

Sebastian Krahmer reported [1] a path traversal issue in pam_timestamp's format_timestamp_name():

""
static int
format_timestamp_name(char *path, size_t len,
                      const char *timestamp_dir,
                      const char *tty,                
                      const char *ruser,
                      const char *user)               
{
        if (strcmp(ruser, user) == 0) {
                return snprintf(path, len, "%s/%s/%s", timestamp_dir, 
                                ruser, tty);                    
        } else {
                return snprintf(path, len, "%s/%s/%s:%s", timestamp_dir,
                                ruser, tty, user);
        }
}

If attacker can control PAM_RUSER or PAM_TTY item and pam_timestamp is "sufficient", (it makes sense to 
have it sufficient, as it aims to mimic sudo timestamp tickets and is suggested so in the man page) they 
can bypass authentication. PAM_RUSER is set in vsftpd or sssd for example. PAM_TTY can be set via dbus in 
gdm's x11-display variable.

That has the following impact:

1. For authentication, this can allow to bypass the auth process, depending on
interal app logic and the existance of certain root owned files (the file
size is checked to match certain value, but chances are that such files
exist somewhere under /). For openssh, if accidently included via auth-common,
this can be dangerous, as the PAM_TTY is always set to "ssh". However due to
PAM_TTY_KLUDGE #ifdef and internal sshd logic this probably is no issue as of today.

2. When a vector is also handling pam sessions (sssd), this bug also allows to create arbitrary files when 
the timestamp file is created and I guess content can be crafted with so much love to create fake 
shadow-file entries is possible.

One should probably take care to not accidently include pam_timestamp in a config file for a remote 
service, as chance is high that the RUSER/TTY is used incorrectly, even when the user string is checked 
via getpwnam(). It should probably be documented in pam_timestamp's manpage.
""

[1] http://seclists.org/oss-sec/2014/q1/645


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 1 Agostino Sarubbo gentoo-dev 2014-03-31 13:02:19 UTC
fixed by this commit:
https://git.fedorahosted.org/cgit/linux-pam.git/commit/?id=Linux-PAM-1_1_8-32-g9dcead8
Comment 2 Andrey Ovcharov 2014-07-29 06:42:47 UTC
Created attachment 381762 [details, diff]
pam-1.1.8-cve-2014-2583.patch
Comment 3 GLSAMaker/CVETool Bot gentoo-dev 2014-10-13 20:38:48 UTC
CVE-2014-2583 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2583):
  Multiple directory traversal vulnerabilities in pam_timestamp.c in the
  pam_timestamp module for Linux-PAM (aka pam) 1.1.8 allow local users to
  create aribitrary files or possibly bypass authentication via a .. (dot dot)
  in the (1) PAM_RUSER value to the get_ruser function or (2) PAM_TTY value to
  the check_tty funtion, which is used by the format_timestamp_name function.
Comment 4 SpanKY gentoo-dev 2015-05-17 03:17:38 UTC
should be all set now in the tree; thanks for the report!

Commit message: Fix from upstream for timestamp handling
http://sources.gentoo.org/sys-libs/pam/files/pam-1.1.8-CVE-2014-2583.patch?rev=1.1
http://sources.gentoo.org/sys-libs/pam/pam-1.1.8-r3.ebuild?rev=1.1
Comment 5 Aaron Bauman (RETIRED) gentoo-dev 2016-03-13 12:40:53 UTC
Added to existing GLSA.
Comment 6 Aaron Bauman (RETIRED) gentoo-dev 2016-03-31 06:19:16 UTC
Cleanup complete:

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a0819b4caa858b34434c1d21217ffea94d76215b
Comment 7 GLSAMaker/CVETool Bot gentoo-dev 2016-05-31 04:53:53 UTC
This issue was resolved and addressed in
 GLSA 201605-05 at https://security.gentoo.org/glsa/201605-05
by GLSA coordinator Yury German (BlueKnight).