| Summary: | <sys-libs/pam-1.1.8-r3: path traversal issue in pam_timestamp's format_timestamp_name() | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Agostino Sarubbo <ago> | ||||
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> | ||||
| Status: | RESOLVED FIXED | ||||||
| Severity: | minor | CC: | pam-bugs+disabled, sudormrfhalt | ||||
| Priority: | Normal | ||||||
| Version: | unspecified | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| URL: | https://bugzilla.redhat.com/show_bug.cgi?id=1080243 | ||||||
| Whiteboard: | A4 [glsa] | ||||||
| Package list: | Runtime testing required: | --- | |||||
| Attachments: |
|
||||||
fixed by this commit: https://git.fedorahosted.org/cgit/linux-pam.git/commit/?id=Linux-PAM-1_1_8-32-g9dcead8 Created attachment 381762 [details, diff]
pam-1.1.8-cve-2014-2583.patch
CVE-2014-2583 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2583): Multiple directory traversal vulnerabilities in pam_timestamp.c in the pam_timestamp module for Linux-PAM (aka pam) 1.1.8 allow local users to create aribitrary files or possibly bypass authentication via a .. (dot dot) in the (1) PAM_RUSER value to the get_ruser function or (2) PAM_TTY value to the check_tty funtion, which is used by the format_timestamp_name function. should be all set now in the tree; thanks for the report! Commit message: Fix from upstream for timestamp handling http://sources.gentoo.org/sys-libs/pam/files/pam-1.1.8-CVE-2014-2583.patch?rev=1.1 http://sources.gentoo.org/sys-libs/pam/pam-1.1.8-r3.ebuild?rev=1.1 Added to existing GLSA. Cleanup complete: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a0819b4caa858b34434c1d21217ffea94d76215b This issue was resolved and addressed in GLSA 201605-05 at https://security.gentoo.org/glsa/201605-05 by GLSA coordinator Yury German (BlueKnight). |
From ${URL} : Sebastian Krahmer reported [1] a path traversal issue in pam_timestamp's format_timestamp_name(): "" static int format_timestamp_name(char *path, size_t len, const char *timestamp_dir, const char *tty, const char *ruser, const char *user) { if (strcmp(ruser, user) == 0) { return snprintf(path, len, "%s/%s/%s", timestamp_dir, ruser, tty); } else { return snprintf(path, len, "%s/%s/%s:%s", timestamp_dir, ruser, tty, user); } } If attacker can control PAM_RUSER or PAM_TTY item and pam_timestamp is "sufficient", (it makes sense to have it sufficient, as it aims to mimic sudo timestamp tickets and is suggested so in the man page) they can bypass authentication. PAM_RUSER is set in vsftpd or sssd for example. PAM_TTY can be set via dbus in gdm's x11-display variable. That has the following impact: 1. For authentication, this can allow to bypass the auth process, depending on interal app logic and the existance of certain root owned files (the file size is checked to match certain value, but chances are that such files exist somewhere under /). For openssh, if accidently included via auth-common, this can be dangerous, as the PAM_TTY is always set to "ssh". However due to PAM_TTY_KLUDGE #ifdef and internal sshd logic this probably is no issue as of today. 2. When a vector is also handling pam sessions (sssd), this bug also allows to create arbitrary files when the timestamp file is created and I guess content can be crafted with so much love to create fake shadow-file entries is possible. One should probably take care to not accidently include pam_timestamp in a config file for a remote service, as chance is high that the RUSER/TTY is used incorrectly, even when the user string is checked via getpwnam(). It should probably be documented in pam_timestamp's manpage. "" [1] http://seclists.org/oss-sec/2014/q1/645 @maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.