RedHat su No Logging Vulnerability
BID:320
Info
RedHat su No Logging Vulnerability
| Bugtraq ID: | 320 |
| Class: | Unknown |
| CVE: |
CVE-2000-0118 |
| Remote: | No |
| Local: | Yes |
| Published: | Jun 09 1999 12:00AM |
| Updated: | Jul 11 2009 12:16AM |
| Credit: | This vulnerability was reported to the BUGTRAQ mailing list by Tani Hosokawa <[email protected]>. |
| Vulnerable: |
Redhat Linux 6.0 Redhat Linux 5.2 i386 |
| Not Vulnerable: |
Redhat Linux 6.1 i386 |
Discussion
RedHat su No Logging Vulnerability
A vulnerability in PAM allows local malicious users to brute force passwords via the su command without any logging of their activity.
su is a command that allows users to change identifies by supplying a password. If the password is correct su immediately executes a new shell with the identity of the nw user, otherwise it sleeps for a second and then logs an authentication failure to syslog.
Since su sleeps before logging the failure and does not trap SIGINT a user can try a password and if su does not immediately give him a new shell and before one second hits control-c his attempt will not be logged. He can automate the process to brute force passwords.
Its been tested using sh-utils-1.16-14 and pam-0.64-3.
A vulnerability in PAM allows local malicious users to brute force passwords via the su command without any logging of their activity.
su is a command that allows users to change identifies by supplying a password. If the password is correct su immediately executes a new shell with the identity of the nw user, otherwise it sleeps for a second and then logs an authentication failure to syslog.
Since su sleeps before logging the failure and does not trap SIGINT a user can try a password and if su does not immediately give him a new shell and before one second hits control-c his attempt will not be logged. He can automate the process to brute force passwords.
Its been tested using sh-utils-1.16-14 and pam-0.64-3.
Exploit / POC
Solution / Fix
RedHat su No Logging Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
References
RedHat su No Logging Vulnerability
References:
References: