/usr/bin/passwd crashes with a segmentation fault if given null input

[Andrew Pilley]

Binary package hint: passwd

While changing my password, i hit CTRL-D at one of the inputs, and the program crashed after all password prompts had been cleared:

$ passwd
Changing password for ashridah
(current) UNIX password: <password as normal>
Enter new UNIX password: <enter ctrl-d instead of new password>
Retype new UNIX password: <enter anything>
Segmentation fault

This is easily repeatable, but only if ctrl-d is used for the first new password prompt. Entering ctrl-d for the second new password prompt fails as normal.

It doesn't appear to be much of a security issue, however, as passwd doesn't leave a core file or any other means to exploit it as it's setuid, but it probably should be checked carefully just in case.

Andrew

[Christian Perrier (bubulle)]

tags 338810 upstream
thanks

I can reproduce this bug about entering Ctrl-D when prompted for a new
password by passwd.

This bug did not happen with sarge version of passwd:

spongebob@mykerinos:~$ passwd
Changing password for spongebob
(current) UNIX password:
Enter new UNIX password: ^D
Retype new UNIX password: ^D
Erreur de segmentation

Sarge:

bubulle@kheops:~$ passwd
Changing password for bubulle
(current) UNIX password:
Enter new UNIX password: ^D
Retype new UNIX password: ^D
No password supplied

--

[Nicolas François (nicolas-francois)]

reassign 338810 libpam0g 0.79-3
thanks

Hello,

This issue happens when entering Control+D as the first password during a
password change:

> # passwd
> Enter new UNIX password: ^D
> Retype new UNIX password: ^D
> Segmentation fault

I could not reproduce it with 0.76-23.

In 0.79, a NULL string is returned by the libpam_misc default conversation
fonction (it was an empty string in 0.76).

I'm not sure where this shall be fixed.

I attach 3 patches:
 * libpam-modules_pam_unix_null_passwd.patch
   This fixes this issue in the pam_unix module.
   I'm not sure it is the right place to fix this (maybe this bug can
   appear on other PAM modules). However, another protection should not
   harm.

 * libpam0g_pam_misc_null_passwd.patch
   This fixes the issue at the conversation function level.
   I'm not sure this patch is correct (I don't know if there are some
   specifications that indicate if the password string must be NULL or
   empty in this case).

 * libpam-modules_pam_unix_typo.patch
   This one just fixes a typo.

Kind Regards,
--
Nekral

[Nicolas François (nicolas-francois)]

tags 338810 - upstream
tags 338810 patch
thanks

It was forwarded to the shadow's upstream. So I remove the upstream tag.

--
Nekral

[Steve Langasek (vorlon)]

tags 338810 +upstream
notforwarded 338810
thanks

Wrong change. This is still an upstream bug, even if it's a different
upstream -- you meant to un-forward the bug instead.

Cheers,
--
Steve Langasek Give me a lever long enough and a Free OS
Debian Developer to set it on, and I can move the world.
<email address hidden> http://www.debian.org/

[Nicolas François (nicolas-francois)]

# Raise 338810's severity for the merge.
# (not sure this bug is really important. I will let the PAM maintained
# lower it)
severity 338810 important

merge 338810 360657
thanks,
--
Nekral

[Nicolas François (nicolas-francois)]

# re-merge the bugs because I messed up with the previous command.

reassign 360657 libpam-modules
merge 368952 360657
thanks

--
Nekral

[Margarita Manterola (marga)]

tag 360657 + fixed

quit

This message was generated automatically in response to a
non-maintainer upload. The .changes file follows.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Sat, 5 Aug 2006 02:11:22 -0300
Source: pam
Binary: libpam0g-dev libpam0g libpam-modules libpam-doc libpam-runtime libpam-cracklib
Architecture: source i386 all
Version: 0.79-3.2
Distribution: unstable
Urgency: low
Maintainer: Sam Hartman <email address hidden>
Changed-By: Margarita Manterola <email address hidden>
Description:
 libpam-cracklib - PAM module to enable cracklib support.
 libpam-doc - Documentation of PAM
 libpam-modules - Pluggable Authentication Modules for PAM
 libpam-runtime - Runtime support for the PAM library
 libpam0g - Pluggable Authentication Modules library
 libpam0g-dev - Development files for PAM
Closes: 360657
Changes:
 pam (0.79-3.2) unstable; urgency=low
 .
   * Non-maintainer upload to fix important bug, that makes passwd segfault
     when CTRL-D is pressed at the password prompt. Applied the patch provided
     by Dann Frazier. (Closes: #360657)
Files:
 00c5f8906d4338df8b42460f9bd43f45 940 base optional pam_0.79-3.2.dsc
 b4a8792d2ed624052df12eb2f9357072 129306 base optional pam_0.79-3.2.diff.gz
 788a05d10eeaf83c54dae27487951df0 63492 base required libpam-runtime_0.79-3.2_all.deb
 d607dd0a50d00ea64b67969d2ce47cfa 730572 doc optional libpam-doc_0.79-3.2_all.deb
 f8b34ce2869e27fd1b17644ec379ec77 78890 base required libpam0g_0.79-3.2_i386.deb
 973e370e6bc082e975e0b1ba0a8f3c6e 186380 base required libpam-modules_0.79-3.2_i386.deb
 517a09feb7007f039e4a5e80e98ee21c 117108 libdevel optional libpam0g-dev_0.79-3.2_i386.deb
 16959aa7cc71519b97774594176b9732 58768 libs optional libpam-cracklib_0.79-3.2_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (GNU/Linux)

iD8DBQFE1CvglAuUx1tI/64RAtsSAJ9FeF5C2K6fTUlOr41Hx8Y1Y6heogCcDKd9
TMy1pvPENHWUcBMm7zWgIq0=
=JMco
-----END PGP SIGNATURE-----

[Andrew Pilley (ashridah)]

Binary package hint: passwd

While changing my password, i hit CTRL-D at one of the inputs, and the program crashed after all password prompts had been cleared:

$ passwd
Changing password for ashridah
(current) UNIX password: <password as normal>
Enter new UNIX password: <enter ctrl-d instead of new password>
Retype new UNIX password: <enter anything>
Segmentation fault

This is easily repeatable, but only if ctrl-d is used for the first new password prompt. Entering ctrl-d for the second new password prompt fails as normal.

It doesn't appear to be much of a security issue, however, as passwd doesn't leave a core file or any other means to exploit it as it's setuid, but it probably should be checked carefully just in case.

Andrew

[didier (did447-deactivatedaccount)]

Moved to pam.

This bug is in libpam-modules. pam_unix.so, read_string() return NULL on CTRL-D

[Vorlon-users (vorlon-users)]

tags 360657 pending
thanks

Author: vorlon
Date: 2006-10-23 12:32:09 +0000 (Mon, 23 Oct 2006)
New Revision: 395

Added:
   trunk/pam/debian/patches-applied/063_paswd_segv
Modified:
   trunk/pam/Linux-PAM/modules/pam_unix/pam_unix_passwd.c
   trunk/pam/debian/changelog
Log:
Incorporate 0.79-3.2 NMU:
 Non-maintainer upload to fix important bug, that makes passwd segfault
 when CTRL-D is pressed at the password prompt. Applied the patch
 provided by Dann Frazier. (Closes: #360657)

Modified: trunk/pam/Linux-PAM/modules/pam_unix/pam_unix_passwd.c
===================================================================
--- trunk/pam/Linux-PAM/modules/pam_unix/pam_unix_passwd.c 2006-10-23 12:24:25 UTC (rev 394)
+++ trunk/pam/Linux-PAM/modules/pam_unix/pam_unix_passwd.c 2006-10-23 12:32:09 UTC (rev 395)
@@ -1121,7 +1121,7 @@
     * password is acceptable.
     */

- if (pass_new[0] == '\0') { /* "\0" password = NULL */
+ if (pass_new && pass_new[0] == '\0') { /* "\0" password = NULL */
     pass_new = NULL;
    }
    retval = _pam_unix_approve_pass(pamh, ctrl, pass_old, pass_new);

Modified: trunk/pam/debian/changelog
===================================================================
--- trunk/pam/debian/changelog 2006-10-23 12:24:25 UTC (rev 394)
+++ trunk/pam/debian/changelog 2006-10-23 12:32:09 UTC (rev 395)
@@ -40,6 +40,14 @@

  -- Steve Langasek <email address hidden> Mon, 23 Oct 2006 02:09:51 -0700

+pam (0.79-3.2) unstable; urgency=low
+
+ * Non-maintainer upload to fix important bug, that makes passwd segfault
+ when CTRL-D is pressed at the password prompt. Applied the patch
+ provided by Dann Frazier. (Closes: #360657)
+
+ -- Margarita Manterola <email address hidden> Sat, 5 Aug 2006 02:11:22 -0300
+
 pam (0.79-3.1) unstable; urgency=low

   * Non-maintainer upload.

Added: trunk/pam/debian/patches-applied/063_paswd_segv
===================================================================
--- trunk/pam/debian/patches-applied/063_paswd_segv (rev 0)
+++ trunk/pam/debian/patches-applied/063_paswd_segv 2006-10-23 12:32:09 UTC (rev 395)
@@ -0,0 +1,13 @@
+Index: Linux-PAM/modules/pam_unix/pam_unix_passwd.c
+===================================================================
+--- Linux-PAM/modules/pam_unix/pam_unix_passwd.c (revision 392)
++++ Linux-PAM/modules/pam_unix/pam_unix_passwd.c (working copy)
+@@ -1121,7 +1121,7 @@
+ * password is acceptable.
+ */
+
+- if (pass_new[0] == '\0') { /* "\0" password = NULL */
++ if (pass_new && pass_new[0] == '\0') { /* "\0" password = NULL */
+ pass_new = NULL;
+ }
+ retval = _pam_unix_approve_pass(pamh, ctrl, pass_old, pass_new);

[Vorlon-users (vorlon-users)]

tags 344447 pending
tags 335273 pending
tags 327272 pending
tags 352329 pending
tags 122400 pending
tags 149027 pending
tags 149883 pending
tags 241663 pending
tags 313542 pending
tags 313588 pending
tags 388431 pending
tags 318452 pending
tags 360657 pending
tags 344447 pending
tags 330829 pending
tags 330852 pending
tags 165068 pending
tags 330458 pending
tags 284954 pending
tags 300775 pending
tags 319026 pending
tags 323982 pending
tags 330097 pending
tags 248310 pending
tags 249499 pending
tags 327876 pending
tags 295296 pending
tags 259634 pending
tags 248928 pending
tags 277633 pending
tags 254904 pending
tags 243698 pending
tags 243413 pending
tags 218318 pending
tags 227681 pending
tags 237537 pending
tags 228114 pending
tags 213566 pending
tags 204506 pending
tags 209755 pending
tags 210014 pending
tags 212354 pending
tags 212158 pending
tags 214092 pending
tags 220980 pending
tags 221318 pending
tags 220439 pending
tags 220158 pending
tags 186011 pending
tags 207497 pending
tags 196605 pending
tags 186011 pending
tags 198618 pending
tags 197080 pending
tags 176693 pending
tags 196903 pending
tags 196949 pending
tags 191906 pending
tags 175900 pending
tags 191906 pending
tags 190954 pending
tags 185286 pending
tags 165240 pending
tags 180310 pending
tags 172229 pending
tags 172914 pending
tags 172186 pending
tags 173097 pending
tags 167798 pending
tags 153152 pending
tags 164713 pending
tags 165066 pending
tags 038 pending
tags 039 pending
tags 165065 pending
tags 169836 pending
tags 165190 pending
tags 164659 pending
tags 163839 pending
tags 164298 pending
tags 163787 pending
tags 163841 pending
tags 163839 pending
tags 163711 pending
tags 163742 pending
tags 163600 pending
tags 162175 pending
tags 112965 pending
tags 160566 pending
tags 126251 pending
tags 159961 pending
tags 58429 pending
tags 116874 pending
tags 132545 pending
tags 148657 pending
tags 143801 pending
tags 103495 pending
tags 139949 pending
tags 147763 pending
tags 135990 pending
tags 135604 pending
tags 120795 pending
tags 93414 pending
tags 126251 pending
tags 109281 pending
tags 119893 pending
tags 107705 pending
tags 119689 pending
tags 111854 pending
tags 108697 pending
tags 103556 pending
tags 104584 pending
tags 100812 pending
tags 95220 pending
tags 66152 pending
tags 100125 pending
tags 96779 pending
tags 96736 pending
tags 92874 pending
tags 91998 pending
tags 93063 pending
tags 92353 pending
tags 89390 pending
tags 88825 pending
tags 84428 pending
tags 88794 pending
tags 88401 pending
tags 88406 pending
tags 88525 pending
tags 88399 pending
tags 59917 pending
tags 86156 pending
tags 88519 pending
tags 86203 pending
tags 85352 pending
tags 82100 pending
tags 76119 pending
tags 66849 pending
tags 77229 pending
tags 74176 pending
tags 77228 pending
tags 69960 pending
tags 78959 pending
tags 75987 pending
tags 71442 pending
tags 80397 pending
tags 77017 pending
tags 76119 pending
tags 71941 pending
tags 67172 pending
tags 80249 pending
tags 77661 pending
tags 76087 pending
tags 72858 pending
tags 69550 pending
tags 76236 pending
tags 69242 pending
tags 64473 pending
tags 69236 pending
tags 61759 pending
tags 70000 pending
tags 70 pending
tags 59459 pending
...

[Colin Watson (cjwatson)]

Fixed in Feisty by merging this change from Debian:

pam (0.79-3.2) unstable; urgency=low

  * Non-maintainer upload to fix important bug, that makes passwd segfault
    when CTRL-D is pressed at the password prompt. Applied the patch
    provided by Dann Frazier. (Closes: #360657)

 -- Margarita Manterola <email address hidden> Sat, 5 Aug 2006 02:11:22 -0300

I don't think this is a security issue, as you can't get an arbitrary pointer in there - all you can do is make it dereference a null pointer, which will immediately raise SIGSEGV.