Bug 505604 – <sys-libs/pam-1.1.8-r3: path traversal issue in pam_timestamp's format_timestamp_name()

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Agostino Sarubbo 2014-03-25 09:30:50 UTC]

From ${URL} :

Sebastian Krahmer reported [1] a path traversal issue in pam_timestamp's format_timestamp_name():

""
static int
format_timestamp_name(char *path, size_t len,
                      const char *timestamp_dir,
                      const char *tty,                
                      const char *ruser,
                      const char *user)               
{
        if (strcmp(ruser, user) == 0) {
                return snprintf(path, len, "%s/%s/%s", timestamp_dir, 
                                ruser, tty);                    
        } else {
                return snprintf(path, len, "%s/%s/%s:%s", timestamp_dir,
                                ruser, tty, user);
        }
}

If attacker can control PAM_RUSER or PAM_TTY item and pam_timestamp is "sufficient", (it makes sense to 
have it sufficient, as it aims to mimic sudo timestamp tickets and is suggested so in the man page) they 
can bypass authentication. PAM_RUSER is set in vsftpd or sssd for example. PAM_TTY can be set via dbus in 
gdm's x11-display variable.

That has the following impact:

1. For authentication, this can allow to bypass the auth process, depending on
interal app logic and the existance of certain root owned files (the file
size is checked to match certain value, but chances are that such files
exist somewhere under /). For openssh, if accidently included via auth-common,
this can be dangerous, as the PAM_TTY is always set to "ssh". However due to
PAM_TTY_KLUDGE #ifdef and internal sshd logic this probably is no issue as of today.

2. When a vector is also handling pam sessions (sssd), this bug also allows to create arbitrary files when 
the timestamp file is created and I guess content can be crafted with so much love to create fake 
shadow-file entries is possible.

One should probably take care to not accidently include pam_timestamp in a config file for a remote 
service, as chance is high that the RUSER/TTY is used incorrectly, even when the user string is checked 
via getpwnam(). It should probably be documented in pam_timestamp's manpage.
""

[1] http://seclists.org/oss-sec/2014/q1/645


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.

[Comment 1 Agostino Sarubbo 2014-03-31 13:02:19 UTC]

fixed by this commit:
https://git.fedorahosted.org/cgit/linux-pam.git/commit/?id=Linux-PAM-1_1_8-32-g9dcead8

[Comment 2 Andrey Ovcharov 2014-07-29 06:42:47 UTC]

Created attachment 381762 [details, diff]
pam-1.1.8-cve-2014-2583.patch

[Comment 3 GLSAMaker/CVETool Bot 2014-10-13 20:38:48 UTC]

CVE-2014-2583 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2583):
  Multiple directory traversal vulnerabilities in pam_timestamp.c in the
  pam_timestamp module for Linux-PAM (aka pam) 1.1.8 allow local users to
  create aribitrary files or possibly bypass authentication via a .. (dot dot)
  in the (1) PAM_RUSER value to the get_ruser function or (2) PAM_TTY value to
  the check_tty funtion, which is used by the format_timestamp_name function.

[Comment 4 SpanKY 2015-05-17 03:17:38 UTC]

should be all set now in the tree; thanks for the report!

Commit message: Fix from upstream for timestamp handling
http://sources.gentoo.org/sys-libs/pam/files/pam-1.1.8-CVE-2014-2583.patch?rev=1.1
http://sources.gentoo.org/sys-libs/pam/pam-1.1.8-r3.ebuild?rev=1.1

[Comment 5 Aaron Bauman (RETIRED) 2016-03-13 12:40:53 UTC]

Added to existing GLSA.

[Comment 6 Aaron Bauman (RETIRED) 2016-03-31 06:19:16 UTC]

Cleanup complete:

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a0819b4caa858b34434c1d21217ffea94d76215b

[Comment 7 GLSAMaker/CVETool Bot 2016-05-31 04:53:53 UTC]

This issue was resolved and addressed in
 GLSA 201605-05 at https://security.gentoo.org/glsa/201605-05
by GLSA coordinator Yury German (BlueKnight).