Slackware /etc/group missing results in root access Vulnerability

Bugtraq ID:	155
Class:	Access Validation Error
CVE:	CVE-1999-1434
Remote:	Yes
Local:	Yes
Published:	Jul 13 1998 12:00AM
Updated:	Jul 11 2009 12:16AM
Credit:	This vulnerability was found by Richard Thomas <[email protected]> and was posted to the Bugtraq mailing list on July 13, 1998.
Vulnerable:	Slackware Linux 3.5 Slackware Linux 3.4 Slackware Linux 3.3 Slackware Linux 3.2 Slackware Linux 3.1
Not Vulnerable:

Slackware /etc/group missing results in root access Vulnerability

Due to the way /bin/login behaves when a /etc/group file is not present under Slackware's version of the password shadowing suite, users who log in while this file is not present will be given uid and gid 0. This will allow them unrestricted access to the machine. This vulnerability is present in all versions of Slackware which have shadow passwords, up to and including 3.5

If the call to initgroups() fails in setup_uid_gid(), the function immediately returns value of -1. However, the call to setup_uid_gid() in login.c fails to check this return value. Since the uid and gid were not checked, their value is still 0, and the user will be logged in with 0 as their uid and gid.

Slackware /etc/group missing results in root access Vulnerability

Remove /etc/group and log in as a valid user. /etc/group must entirely not exist -- mode 000 is not sufficient.

Slackware /etc/group missing results in root access Vulnerability

References: