<Ctrl+C> might allow to bypass authentication

[Thierry Carrez]

CVE-2008-2516
pam_sm_authenticate in pam_pgsql.c in libpam-pgsql 0.6.3 does not properly consider operator precedence when evaluating the success of a pam_get_pass function call, which allows local users to gain privileges via a SIGINT signal when this function is executing, as demonstrated by a CTRL-C sequence at a sudo password prompt in an "auth sufficient pam_pgsql.so" configuration.

Affected : gutsy, hardy, intrepid
Fixed in Debian 0.6.3-2, I'm working on a fakesync (our orig.tar.gz is borken)

[Thierry Carrez (ttx)]

The minimal fix, for the record (and learning).

[Thierry Carrez (ttx)]

Debdiff for the fake sync to 0.6.3-2 to intrepid

[William Grant (wgrant)]

Are you able to prepare and test fixes for Gutsy and Hardy as well? Simply applying that parentheses-addition patch should do, but I've nowhere to test this.

[Thierry Carrez (ttx)]

Here is the debdiff for hardy.
I had to apply an extra patch because the current version in hardy FTBFS.
I have tested that it closes the hole, but I've not tested that there are no regressions in usual features.

[Thierry Carrez (ttx)]

New debdiff for hardy, with proper version number.
Furthermore I've tested on a basic setup that there was no obvious regression.

I'm working on the gutsy one.

[Thierry Carrez (ttx)]

Debdiff for gutsy.
The package also FTBFS in pbuilder so I applied the same patch.

[Thierry Carrez (ttx)]

Subscribing ubuntu-universe-sponsors to help getting the fake-sync in comment 2 into Intrepid first.

[Launchpad Janitor (janitor)]

This bug was fixed in the package pam-pgsql - 0.6.3-0ubuntu1.8.04.1

---------------
pam-pgsql (0.6.3-0ubuntu1.8.04.1) hardy-security; urgency=low

  * SECURITY UPDATE: local users may bypass authentication and gain
    privileges by sending <CTRL-C> at the password prompt.
  * pam_pgsql.c: applied Debian patch to fix operator precedence
    (Fixes LP: #242690)
  * pam_get_service.c: applied Debian patch from 0.6.3-2 to fix FTBFS
  * References
    CVE-2008-2516
    http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=481970
    http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=441679

 -- Thierry Carrez <email address hidden> Wed, 25 Jun 2008 21:04:24 +0200

[Launchpad Janitor (janitor)]

This bug was fixed in the package pam-pgsql - 0.6.3-0ubuntu1.7.10.1

---------------
pam-pgsql (0.6.3-0ubuntu1.7.10.1) gutsy-security; urgency=low

  * SECURITY UPDATE: local users may bypass authentication and gain
    privileges by sending <CTRL-C> at the password prompt.
  * pam_pgsql.c: applied Debian patch to fix operator precedence
    (Fixes LP: #242690)
  * pam_get_service.c: applied Debian patch from 0.6.3-2 to fix FTBFS
  * References
    CVE-2008-2516
    http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=481970
    http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=441679

 -- Thierry Carrez <email address hidden> Wed, 25 Jun 2008 19:26:46 +0000

[reidmefirst (reid-launchpad)]

Naive question about a bug that was closed a year ago...

Can a user do a similar thing with pam_pgsql when changing her password? For example the operator precedence in pam_sm_chauthtok() line 696 is:

if ((rc = pam_get_pass(pamh, PAM_OLDAUTHTOK, &pass, PASSWORD_PROMPT, options->std_flags)) == PAM_SUCCESS) {

which is identical to the buggy operator precedence being performed in the old version of pam_sm_authenticate(). Is it possible for a malicious user to change a victim's password in this way if pam_pgsql is used and the victim walked away without locking their screen?

Reid

[Thierry Carrez (ttx)]

The operator precedence you quote from line 696 looks like the fixed one, not the buggy one ?