[prev in list] [next in list] [prev in thread] [next in thread] 

List:       kde-devel
Subject:    [PATCH] kdm accepts faulty password!
From:       Pavel Troller <patrol () sinus ! cz>
Date:       2001-04-17 6:52:16
[Download RAW message or body]

Hi!
   I've found that the current kdm (HEAD as well as 2.2-ALPHA1) accepts any passwords, even for root,
on my system.
   My system doesn't use PAM but uses shadow with MD5 passwords, as available from glibc-2.1.3.
   By debugging, I've found that Verify() is called two times during every login: once
without a password, and then again with real password applied. The internal Verify() logic tries
to keep the encrypted password read from the shadow file and doesn't utilize getspnam() again.
However, the encrypted password is not surviving between these invocations of Verify(), maybe because
it is bzero()'ed later in the code. So, the second attempt doesn't use getspnam(), uses empty
encrypted password, and it passes the verification in every case.
   As a quick fix, I commented out the line which remembers that the sp entry is read. As a result,
it is read again during the second attempt and the authentication works (see the very small patch).
   I think that a real author could find a better way how to handle this problem, not by disabling
his clever logic. I didn't remove the bzero() call - I think that it is more secure do it that way.

                                                      With regards, Pavel Troller

--- verify.c.orig	Tue Apr 17 08:36:30 2001
+++ verify.c	Tue Apr 17 08:33:42 2001
@@ -283,7 +283,9 @@
 # endif  /* QNX4 doesn't need endspent() to end shadow passwd ops */
 	if (sp) {
 	    user_pass = sp->sp_pwdp;
+#if 0
 	    pwinited = 2;
+#endif
 	} else
 	    Debug ("getspnam() failed, errno=%d.  Are you root?\n", errno);
     }

 
>> Visit http://master.kde.org/mailman/listinfo/kde-devel#unsub to unsubscribe <<

[prev in list] [next in list] [prev in thread] [next in thread]