Hi, Below I describe a bug in Slackware 7.0. I did notify supportat_private about a week ago and thought that it was about time to send the bug report to bugtraq. This is regarding a logic but in the shadow suite that enables a brute force attack for finding and cracking login in accounts via telnet (and possibly some other nasty side affects). The bug comes about as a result of the interplay between using md5_crypt and disabling the traditional crypt. The bug occurs when either an account is locked or the account does not exits. In either case the result is that login.c makes a call to pw_auth() in pwauth.c with the password set to "!". This in turn calls _old_auth() in pwauth.c. This finally calls pw_encrypt() in encrypt.c. Now because the password is set to "!" (and not "$1$") the md5_crypt function is not called. Instead the tradition crypt() is called. This has, as far as I can see, been disabled in the Slack 7.0 distribution and always returns NULL and sets errno=95. This causes pw_encrypt() to print out `crypt: Operation not supported' and immediatly call exit(1). Hence, from logging in one can see that the user name does not exist or is locked, further more the exit is immediate with no sleep before prompting again. I did not confirm that crypt() was disabled in the glibc source (simply because it meant downloading all of the glibc source). But the test program I wrote did seem to confirm this. Thanks Stewart
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 15:16:26 PDT