|
 |
0ec004 |
From 57a1e2b274d0a6376d92ada9926e5c5741e7da20 Mon Sep 17 00:00:00 2001
|
|
|
0ec004 |
From: "Dmitry V. Levin" <ldv@altlinux.org>
|
|
|
0ec004 |
Date: Fri, 24 Jan 2014 22:18:32 +0000
|
|
|
0ec004 |
Subject: [PATCH] pam_userdb: fix password hash comparison
|
|
|
0ec004 |
|
|
|
0ec004 |
Starting with commit Linux-PAM-0-77-28-g0b3e583 that introduced hashed
|
|
|
0ec004 |
passwords support in pam_userdb, hashes are compared case-insensitively.
|
|
|
0ec004 |
This bug leads to accepting hashes for completely different passwords in
|
|
|
0ec004 |
addition to those that should be accepted.
|
|
|
0ec004 |
|
|
|
0ec004 |
Additionally, commit Linux-PAM-1_1_6-13-ge2a8187 that added support for
|
|
|
0ec004 |
modern password hashes with different lengths and settings, did not
|
|
|
0ec004 |
update the hash comparison accordingly, which leads to accepting
|
|
|
0ec004 |
computed hashes longer than stored hashes when the latter is a prefix
|
|
|
0ec004 |
of the former.
|
|
|
0ec004 |
|
|
|
0ec004 |
* modules/pam_userdb/pam_userdb.c (user_lookup): Reject the computed
|
|
|
0ec004 |
hash whose length differs from the stored hash length.
|
|
|
0ec004 |
Compare computed and stored hashes case-sensitively.
|
|
|
0ec004 |
Fixes CVE-2013-7041.
|
|
|
0ec004 |
|
|
|
0ec004 |
Bug-Debian: http://bugs.debian.org/731368
|
|
|
0ec004 |
---
|
|
|
0ec004 |
modules/pam_userdb/pam_userdb.c | 9 ++++++---
|
|
|
0ec004 |
1 file changed, 6 insertions(+), 3 deletions(-)
|
|
|
0ec004 |
|
|
|
0ec004 |
diff --git a/modules/pam_userdb/pam_userdb.c b/modules/pam_userdb/pam_userdb.c
|
|
|
0ec004 |
index de8b5b1..ff040e6 100644
|
|
|
0ec004 |
--- a/modules/pam_userdb/pam_userdb.c
|
|
|
0ec004 |
+++ b/modules/pam_userdb/pam_userdb.c
|
|
|
0ec004 |
@@ -222,12 +222,15 @@ user_lookup (pam_handle_t *pamh, const char *database, const char *cryptmode,
|
|
|
0ec004 |
} else {
|
|
|
0ec004 |
cryptpw = crypt (pass, data.dptr);
|
|
|
0ec004 |
|
|
|
0ec004 |
- if (cryptpw) {
|
|
|
0ec004 |
- compare = strncasecmp (data.dptr, cryptpw, data.dsize);
|
|
|
0ec004 |
+ if (cryptpw && strlen(cryptpw) == (size_t)data.dsize) {
|
|
|
0ec004 |
+ compare = memcmp(data.dptr, cryptpw, data.dsize);
|
|
|
0ec004 |
} else {
|
|
|
0ec004 |
compare = -2;
|
|
|
0ec004 |
if (ctrl & PAM_DEBUG_ARG) {
|
|
|
0ec004 |
- pam_syslog(pamh, LOG_INFO, "crypt() returned NULL");
|
|
|
0ec004 |
+ if (cryptpw)
|
|
|
0ec004 |
+ pam_syslog(pamh, LOG_INFO, "lengths of computed and stored hashes differ");
|
|
|
0ec004 |
+ else
|
|
|
0ec004 |
+ pam_syslog(pamh, LOG_INFO, "crypt() returned NULL");
|
|
|
0ec004 |
}
|
|
|
0ec004 |
};
|
|
|
0ec004 |
|
|
|
0ec004 |
--
|
|
|
0ec004 |
1.8.3.1
|
|
|
0ec004 |
|