|
| From: | NETBSD | | Date: | 27.10.2000 | | Subject: | Security Advisory 2000-015 |
-----BEGIN PGP SIGNED MESSAGE-----
NetBSD Security Advisory 2000-015
=================================
Topic: format-string bugs in passwd/libutil
Version: all releases up to and including 1.4.2
Severity: local root compromise possible
Fixed: 2000/10/03 in -current and netbsd-1-5 branches
2000/10/04 in netbsd-1-4 branch.
fix will be in the 1.4.3 and 1.5 releases
Abstract
========
The pw_error() function of the system libutil library, used by several
programs including the setuid passwd program, was vulnerable to a
format string attack.
Technical Details
=================
pw_error passed its first argument to the warn(3) function, which
interprets its first argument as a format string. in certain
circumstances, passwd(1) passes a value derived from untrusted user
input to pw_error().
Solutions and Workarounds
=========================
The problem was fixed in NetBSD-current on 2000/10/03; systems running
NetBSD-current dated from before that date should be upgraded to
NetBSD-current dated 2000/10/04 or later. The two active release
branches were both fixed by 2000/10/05.
Systems running releases older than NetBSD 1.4 should be upgraded to
NetBSD 1.4.2 before applying the fixes described here.
Systems running 1.4.2 should apply the following patch to
lib/libutil/passwd.c usign the patch(1), and rebuild and reinstall the
"libutil" library. On systems which do not support shared libraries,
you should then rebuild and reinstall the "passwd" command.
- --- lib/libutil/passwd.c 1999/12/04 20:00:55 1.15.2.1
+++ lib/libutil/passwd.c 2000/10/04 14:11:02 1.15.2.2
@@ -319,7 +319,7 @@
int err, eval;
{
if (err)
- - warn(name);
+ warn("%s", name);
warnx("%s: unchanged", _PATH_MASTERPASSWD);
pw_abort();
Revision History
================
20001024 Initial draft of advisory.
More Information
================
Information about NetBSD and NetBSD security can be found at
http://www.NetBSD.ORG/ and http://www.NetBSD.ORG/Security/.
Copyright 2000, The NetBSD Foundation, Inc. All Rights Reserved.
$NetBSD: NetBSD-SA2000-015.txt,v 1.3 2000/10/26 15:22:01 sommerfeld Exp $
-----BEGIN PGP SIGNATURE-----
Version: 2.6.3ia
Charset: noconv
iQCVAwUBOfhMIT5Ru2/4N2IFAQFsPQP+P0d5nzIuDDlXFeS/8Oksb91uGaGoPrZl
sd2JASfLXcgPAemQVLzuAqNsJwxjcDpKlwvbDUrySSrvi4FxJ8scjlUl4g7XCf3G
MfY/NqB2bfoLJIUv3PT3Vx/bHi5rYodu4uqopXQZwWg/PfmXEa0LRgDk/UOuxoNC
+yq0nhXqsOE=
=iNoz
-----END PGP SIGNATURE-----
|
