[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20130715081827.GB30861@suse.de>
Date: Mon, 15 Jul 2013 10:18:27 +0200
From: Sebastian Krahmer <krahmer@...e.de>
To: oss-security@...ts.openwall.com
Cc: mancha1@...h.com
Subject: Re: CVE request: Cyrus-sasl NULL ptr. dereference
Hi,
Even if it won't be a DoS, it could potentially be an
auth bypass. What if you can alloc so much memory in
one of the threads that one alloc would return
(and actually alloc space at) NULL which
you could fill with your own pwd struct? I am not so deep
in the glibc heap to know whether this could still work
(also to mention mmap_min_addr).
Sebastian
On Fri, Jul 12, 2013 at 07:35:07PM +0400, Solar Designer wrote:
> On Fri, Jul 12, 2013 at 03:27:18PM +0000, mancha wrote:
> > Starting with glibc 2.17 (eglibc 2.17), crypt() fails with
> > EINVAL (w/ NULL return) if the salt violates specifications.
> > Additionally, on FIPS-140 enabled Linux systems, DES/MD5-encrypted
> > passwords passed to crypt() fail with EPERM (w/ NULL return).
> >
> > When authenticating against Cyrus-sasl via mechanisms that use
> > glibc's crypt (e.g. getpwent or shadow auth. mechs), and this
> > crypt() returns a NULL as glibc 2.17+ does on above-described
> > input, the client crashes the authentication daemon resulting
> > in a DoS.
>
> Does this really crash the entire daemon process rather than just one of
> its children (where a new one would be spawned for another request)?
>
> I think this needs to be clarified, and the answer will affect whether
> we have a security issue (CVE-worthy) or not.
>
> Alexander
--
~ perl self.pl
~ $_='print"\$_=\47$_\47;eval"';eval
~ krahmer@...e.de - SuSE Security Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
