SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Security)  >   cmd5checkpw Vendors:   Dabrowski, Krzysztof
(Gentoo Issues Fix) cmd5checkpw May Let Local Users Access Files With Elevated Privileges
SecurityTracker Alert ID:  1013311
SecurityTracker URL:  http://securitytracker.com/id/1013311
CVE Reference:   CVE-2005-0580   (Links to External Site)
Updated:  Feb 28 2005
Original Entry Date:  Feb 27 2005
Impact:   Disclosure of system information, Disclosure of user information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 0.22
Description:   A vulnerability was reported in cmd5checkpw. A local user may be able to access files with 'cmd5checkpw' privileges.

The application is installed with set user id (setuid) cmd5checkpw user privileges on some systems and does not drop privileges before making an execvp() call. A local user can exploit this to view files with 'cmd5checkpw' privileges.

For example, a local user with knowledge with at least one valid /etc/poppasswd username and password combination can read the '/etc/poppasswd' file.

Florian Westphal discovered this vulnerability.

Gentoo reported this vulnerability.

Impact:   A local user can view files with 'cmd5checkpw' privileges.
Solution:   Gentoo has released a fix and indicates that all cmd5checkpw users should upgrade to the latest available version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=net-mail/cmd5checkpw-0.22-r2"

Vendor URL:  members.elysium.pl/brush/cmd5checkpw/ (Links to External Site)
Cause:   Access control error
Underlying OS:  Linux (Gentoo)

Message History:   This archive entry is a follow-up to the message listed below.
Feb 27 2005 cmd5checkpw May Let Local Users Access Files With Elevated Privileges



 Source Message Contents

Subject:  [gentoo-announce] [ GLSA 200502-30 ] cmd5checkpw: Local password leak vulnerability


This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--------------enig4C222933C61CB55EABD5DC23
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 200502-30
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  Severity: Low
     Title: cmd5checkpw: Local password leak vulnerability
      Date: February 25, 2005
      Bugs: #78256
        ID: 200502-30

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

cmd5checkpw contains a flaw allowing local users to access other users
cmd5checkpw passwords.

Background
==========

cmd5checkpw is a checkpassword compatible authentication program that
uses CRAM-MD5 authentication mode.

Affected packages
=================

    -------------------------------------------------------------------
     Package               /  Vulnerable  /                 Unaffected
    -------------------------------------------------------------------
  1  net-mail/cmd5checkpw     <= 0.22-r1                    >= 0.22-r2

Description
===========

Florian Westphal discovered that cmd5checkpw is installed setuid
cmd5checkpw but does not drop privileges before calling execvp(), so
the invoked program retains the cmd5checkpw euid.

Impact
======

Local users that know at least one valid /etc/poppasswd user/password
combination can read the /etc/poppasswd file.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All cmd5checkpw users should upgrade to the latest available version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=net-mail/cmd5checkpw-0.22-r2"

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

  http://security.gentoo.org/glsa/glsa-200502-30.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2005 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.0


--------------enig4C222933C61CB55EABD5DC23
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFCH5j/vcL1obalX08RAsqDAJ44oZOKfpSJQkfYU5QjH5yXy5CwvACeJSxV
iTFWAjUmwut3Nf45I+Yp5YM=
=QiPc
-----END PGP SIGNATURE-----

--------------enig4C222933C61CB55EABD5DC23--

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC