Bug 43990

Date: Fri, 15 Aug 2003 04:57:20 +0100 (IST)
From: Dave Airlie <airlied@samba.org>
To: secalert@redhat.com, security@suse.de, security@debian.org
Cc: security@linux-mandrake.com
Cc: secure@conectiva.com.br
Cc: security-officer@freebsd.org
Subject: [security@suse.de] pam_smb remote buffer overflow..
Sender: security-bounces+okir=suse.de@suse.de


Dear Distribution Security people,

I am writing to give you an advance warning of a remote buffer overflow in
the password handling code in pam_smb 1.1.6 and pam_smb v2 version in
non-daemon mode...

I've attached a patch against my 1.1.6 release, and the latest v2.0.0-rc4
in cvs on sourceforge is not vunerable (all earlier versions are..)

I wish to delay announcing this until all major distributions have
a chance to prepare an upgrade for their users, and I can post new
versions to samba.org,

Thanks,
Dave.

Fix looks simple (From Dave):

diff -ur ../../pam_smb/smbval/smblib.c pam_smb/smbval/smblib.c
--- ../../pam_smb/smbval/smblib.c       Thu Apr 22 21:24:31 1999
+++ pam_smb/smbval/smblib.c     Fri Aug 15 03:54:49 2003
@@ -25,6 +25,7 @@
 
 #include "../config.h"
 #include <malloc.h>
+#include <string.h>
 
 int SMBlib_errno;
 int SMBlib_SMB_Error;
@@ -33,6 +34,7 @@
 #include "smblib-priv.h"
 
 #include "rfcnb.h"
+#define safestrcpy(s1, s2, n) strncpy(s1, s2, n); ((char *)s1)[n-1] = 0
 
 #include <signal.h>
 
@@ -334,7 +336,7 @@
 
   }
 
-  strcpy(pword, PassWord);
+  safestrcpy(pword, PassWord, 128);
#ifdef PAM_SMB_ENC_PASS
   if (Con_Handle -> encrypt_passwords)
   {