Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 591456 (CVE-2016-6318) - <sys-libs/cracklib-2.9.6-r1: Stack-based buffer overflow when parsing large GECOS field
Summary: <sys-libs/cracklib-2.9.6-r1: Stack-based buffer overflow when parsing large G...
Status: RESOLVED FIXED
Alias: CVE-2016-6318
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal major (vote)
Assignee: Gentoo Security
URL: http://www.openwall.com/lists/oss-sec...
Whiteboard: A2 [glsa cve]
Keywords:
Depends on:
Blocks:
 
Reported: 2016-08-17 11:51 UTC by Agostino Sarubbo
Modified: 2016-12-08 13:55 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2016-08-17 11:51:02 UTC
From ${URL} :

A security flaw was reported to us by CSG Labs, details as follows:

A stack-based overflow was found in the way cracklib, a library used to
stop users from choosing easy to guess passwords, handled large GECOS
field in the /etc/passwd file. When an application compiled against the
cracklib libary, such as "passwd" is used to parse the GECOS field, it
could cause the application to crash or execute arbitary code with the
permissions of the user running such an application.

To trigger the flaw, you need a specially-crafted "long" GECOS field,
which can be done by a local user on the system. The attacker then needs
to run some utility which uses cracklib to process this long GECOS field
on the system. (such as "passwd" application which runs suid root)

All versions of the cracklib library shipped with Red Hat Enterprise
Linux are compiled with FORTIFY_SOURCE, which detects the
buffer-overflow and aborts the application safely.

Therefore the maximum impact of this flaw is application crash.

However, there may be other applications, distributions which dont
compile cracklib with FORTIFY_SOURCE, and this can lead to easy code
exec or even privsec.

A proposed patch is available at:
https://bugzilla.redhat.com/attachment.cgi?id=1188599

This flaw was assigned CVE-2016-6318 and it was previously disclosed via
linux-distros mailing list.


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 1 Thomas Deutschmann gentoo-dev Security 2016-09-14 21:01:19 UTC
Bumped revision with cherry-picked https://github.com/cracklib/cracklib/commit/47e5dec521ab6243c9b249dd65b93d232d90d6b1 and https://github.com/cracklib/cracklib/commit/33d7fa4585247cd2247a1ffa032ad245836c6edb:

> commit aac5b4f4a65ce70854e77014fa096b7bd2d34e43
> Author: Thomas Deutschmann
> Date:   Wed Sep 14 22:55:05 2016 +0200
> 
>     sys-libs/cracklib: Revision bump to address CVE-2016-6318 and another buffer overflow
> 
>     Signed-off-by: Lars Wendler
>     Gentoo-Bug: https://bugs.gentoo.org/591456
> 
>     Package-Manager: portage-2.3.0
>
Comment 2 Thomas Deutschmann gentoo-dev Security 2016-09-14 21:06:00 UTC
@ Arches,

please test and mark stable: =sys-libs/cracklib-2.9.6-r1

Stable targets: alpha amd64 arm hppa ia64 ppc ppc64 x86 sparc
Comment 3 Agostino Sarubbo gentoo-dev 2016-09-16 08:40:27 UTC
amd64 stable
Comment 4 Tobias Klausmann gentoo-dev 2016-09-17 09:52:20 UTC
Stable on alpha.
Comment 5 Jeroen Roovers gentoo-dev 2016-09-19 13:32:41 UTC
Stable for HPPA PPC64.
Comment 6 Markus Meier gentoo-dev 2016-09-24 19:18:44 UTC
arm stable
Comment 7 Agostino Sarubbo gentoo-dev 2016-09-29 08:42:25 UTC
x86 stable
Comment 8 Agostino Sarubbo gentoo-dev 2016-09-29 09:37:32 UTC
sparc stable
Comment 9 Agostino Sarubbo gentoo-dev 2016-09-29 12:38:18 UTC
ppc stable
Comment 10 Agostino Sarubbo gentoo-dev 2016-09-29 13:30:46 UTC
ia64 stable.

Maintainer(s), please cleanup.
Security, please add it to the existing request, or file a new one.
Comment 11 SpanKY gentoo-dev 2016-12-07 08:33:09 UTC
cleaned up
Comment 12 Aaron Bauman Gentoo Infrastructure gentoo-dev Security 2016-12-07 08:41:09 UTC
GLSA created.
Comment 13 GLSAMaker/CVETool Bot gentoo-dev 2016-12-08 13:55:48 UTC
This issue was resolved and addressed in
 GLSA 201612-25 at https://security.gentoo.org/glsa/201612-25
by GLSA coordinator Aaron Bauman (b-man).