Bug 48788 (CVE-2003-0690)

<!-- SBZ_reproduce  -->
-

Created attachment 15566 [details]
patchinfo

Created attachment 15567 [details]
patchinfo for the box products

Is there a patch available? Are you sure we use pam_krb5 with XDM? Is this 
some entry in /etc/pam.d/xdm?  

Maybe Thorsten and/or Werner can comment here as well? 

There is nothing to comment: Check, if xdm checks the pam_setcred 
return value or not. If the pam_setcred return value is ignored, 
xdm is buggy. 
This has nothing to do with pam_krb5 and could be a problem with a  
lot of more PAM modules. 

Thorsten, that is right. It has nothing to do with the specific PAM module. 
But it is a exploitable example. 
 
Stefan, Mandrake released the advisory so they have the patch in their RPM 
package. Additionally Adrian made an equal update for KDM and may help you 
too. 

This is already fixed on SuSE because I took the XFree86 4.3.0 stable branch 
(with security fixes) instead of plain XFree86 4.3.0. This seems to be the 
patch (on success 1 is returned). 
 
[...] 
            return (0); 
        } 
 #endif   /* QNX4 doesn't support multi-groups, no initgroups() */ 
 #ifdef USE_PAM 
-       if (thepamh()) { 
-           if (pam_setcred(thepamh(), PAM_ESTABLISH_CRED) != PAM_SUCCESS) { 
-               LogError("pam_setcred for %\"s failed, errno=%d\n", 
-                        name, errno); 
+       if (pamh) { 
+           pam_error = pam_setcred (pamh, PAM_ESTABLISH_CRED); 
+           if (pam_error != PAM_SUCCESS) { 
+               LogError ("pam_setcred for \"%s\" failed: %s\n", 
+                        name, pam_strerror(pamh, pam_error)); 
                return(0); 
            } 
        } 
 #endif 
[...] 
 
# cvs log session.c 
[...] 
use pam_strerror() to print an error message after pam_setcred() fails, 
[...] 
 

Forget about my last comment. This looks more like some cleanup. 

Sorry, this is the correct one. This is the earlier fix also in the 4.3.0 
stable branch: 
 
@@ -604,7 +604,11 @@ 
 #endif   /* QNX4 doesn't support multi-groups, no initgroups() */ 
 #ifdef USE_PAM 
        if (thepamh()) { 
-           pam_setcred(thepamh(), PAM_ESTABLISH_CRED); 
+           if (pam_setcred(thepamh(), PAM_ESTABLISH_CRED) != PAM_SUCCESS) { 
+               LogError("pam_setcred for %\"s failed, errno=%d\n", 
+                        name, errno); 
+               return(0); 
+           } 
        } 
 #endif 
        if (setuid(verify->uid) < 0) 
 

Any SL version >= 8.0 that do not include this patch? 

Sorry, your patchinfo files were for 8.2/9.0 only. So this is a completely new 
question, correct? 

This was not my intention. Maybe the package name was another befoer 8.2? 
 

Yes. The package name was xf86 before. 

Created attachment 15587 [details]
patchinfo-box.xf86

Created attachment 15588 [details]
patchinfo.xf86

Ok. I would like to see the patch Adrian used for KDM. Adrian? 

/work/SRC/old-versions/8.2/all/kdebase3/post-3.1.3-kdebase-kdm.patch 
 
but it covers more issues, the interessting part in this context is the last 
part. 

Thanks for the patch. The patch in Comment #10 looks ok for me then. 

Ouch. We need the patch for SuSE 8.2 and 9.0 as well. I just saw that the 
patch in the 4.3.0 stable branch was applied after I made a tarball of it 
for our products. :-( 
 
 

pam_setcred() isn't used yet in XFree86 of SuSE 7.2. Therefore we won't need a  
security update for SLES7-*. Only for SLES7-PPC as this is SuSE 7.3 based. 

fixed. 

<!-- SBZ_reopen -->Reopened by thomas@suse.de at Thu Jan  8 10:43:04 2004

reopen, reassign for tracking 

packages approved 

CVE-2003-0690: CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)