oss-security - Re: CVE id request: GNU libc: NIS shadow password leakage

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <611722421.1141311262988710794.JavaMail.root@zmail01.collab.prod.int.phx2.redhat.com>
Date: Fri, 8 Jan 2010 17:11:50 -0500 (EST)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Cc: Christoph Pleger <Christoph.Pleger@...tu-dortmund.de>
Subject: Re: CVE id request: GNU libc: NIS shadow password
 leakage

----- "Aurelien Jarno" <aurelien@...el32.net> wrote:

> Hi oss-sec,
> 
> Christoph Pleger has reported through the Debian bug tracker [1] that
> non-priviledged users can read NIS shadow password entries simply using
> getpwnam() when nscd is in use.
> 
> The issue has already been reported upstream [2], and a proposed patch is
> available on [3].
> 
> It seems that all GNU libc versions are affected, including derivatives
> like EGLIBC.
> 
> Could we please get a CVE id for this issue?
> 
> Thanks,
> Aurelien
> 
> [1] http://bugs.debian.org/560333
> [2] http://sourceware.org/bugzilla/show_bug.cgi?id=11134
> [3] http://svn.debian.org/viewsvn/pkg-glibc/glibc-package/trunk/debian/patches/any/submitted-nis-shadow.diff?revision=4062&view=markup

I may be missing something here, or perhaps I'm not remembering correctly,
but NIS basically doesn't have any security in this respect. This bug
implies that a user has some sort of access to the NIS client, but the NIS
server would happily hand out the same data if the malicious user asked for
it (not using glibc let's say). While this may be a glibc bug (I doubt it,
as it would just be a false sense of security), I this this is a non issue.

If someone who knows more about NIS could chime in I would appreciate it,
it's been a very long time since I've even thought about NIS honestly. I may
be very mistaken.

-- 
    JB

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.