Bugzilla – Bug 48934
VUL-0: CVE-2004-0041: mod_auth_shadow: did not check expiration date
Last modified: 2021-09-30 15:17:21 UTC
Hi Peter, Debian reported the following: - -------------------------------------------------------------------------- Debian Security Advisory DSA 421-1 security@debian.org http://www.debian.org/security/ Matt Zimmerman January 12th, 2004 http://www.debian.org/security/faq - -------------------------------------------------------------------------- Package : mod-auth-shadow Vulnerability : password expiration Problem-Type : remote Debian-specific: no CVE Ids : CAN-2004-0041 David B Harris discovered a problem with mod-auth-shadow, an Apache module which authenticates users against the system shadow password database, where the expiration status of the user's account and password were not enforced. This vulnerability would allow an otherwise authorized user to successfully authenticate, when the attempt should be rejected due to the expiration parameters. For the current stable distribution (woody) this problem has been fixed in version 1.3-3.1woody.1 For the unstable distribution (sid) this problem has been fixed in version 1.4-1. We recommend that you update your mod-auth-shadow package. --- The advisory is not online yet. http://www.debian.org/security/2004/dsa-421
<!-- SBZ_reproduce --> -
Maybe this could be fixed together with mod_gzip.
Yes, good idea.
Created attachment 15899 [details] Proposed patch, extracted from fixed Debian package and seperated from another patch
Reproduced the problem with our package, ==> /var/log/httpd/access_log <== 10.0.8.6 - too_old [06/Feb/2004:18:28:59 +0100] "GET /auth_shadow/ HTTP/1.0" 200 243 and verified that the fix resolves it: ==> /var/log/httpd/access_log <== 10.0.8.6 - too_old [06/Feb/2004:18:31:53 +0100] "GET /auth_shadow/ HTTP/1.0" 401 466 ==> /var/log/httpd/error_log <== /usr/sbin/validate: User too_old: account expired [Fri Feb 6 18:31:53 2004] [error] (29)Illegal seek: access to /auth_shadow/ failed for 10.0.8.6, reason: Invalid password entered for user too_old
The fix is now applied and checked in in all our apache-contrib packages.
Thomas, I reassign to you for further processing.
packages approved.
done.
CVE-2004-0041: CVSS v2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)