S.u.S.E. Linux useradd Vulnerability
BID:350
Info
S.u.S.E. Linux useradd Vulnerability
| Bugtraq ID: | 350 |
| Class: | Design Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Jun 06 1999 12:00AM |
| Updated: | Jun 06 1999 12:00AM |
| Credit: | First posted to BugTraq by Emils Klotins <[email protected]> on June 11, 1999. |
| Vulnerable: |
SuSE Linux 6.1 |
| Not Vulnerable: | |
Discussion
S.u.S.E. Linux useradd Vulnerability
The useradd binary included with S.u.S.E. 6.1 had a parameter, -p, not listed in the man page for the new user's password that caused a plaintext password to be written to /etc/shadow if the individual adding the account specified the plaintext.
[root@box etc]$ useradd newuser -p password
The paramater is meant for adding an encrypted password (using one of the mkpasswd utilities) at the command line.
Besides the fact that a password on the command line is a bad idea, this percieved misfeature makes the system vulnerable by writing the plaintext to /etc/shadow. It's not readable by world, but it could allow for more intelligent compromise if the administrator were to think that they could add their plaintext password on the command line. The account, of course, won't work as the user's encrypted password will not match the plaintext in /etc/shadow.
The useradd binary included with S.u.S.E. 6.1 had a parameter, -p, not listed in the man page for the new user's password that caused a plaintext password to be written to /etc/shadow if the individual adding the account specified the plaintext.
[root@box etc]$ useradd newuser -p password
The paramater is meant for adding an encrypted password (using one of the mkpasswd utilities) at the command line.
Besides the fact that a password on the command line is a bad idea, this percieved misfeature makes the system vulnerable by writing the plaintext to /etc/shadow. It's not readable by world, but it could allow for more intelligent compromise if the administrator were to think that they could add their plaintext password on the command line. The account, of course, won't work as the user's encrypted password will not match the plaintext in /etc/shadow.
Exploit / POC
S.u.S.E. Linux useradd Vulnerability
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution / Fix
S.u.S.E. Linux useradd Vulnerability
Solution:
S.u.S.E. 6.1 ships with older manpages that don't explain the -p option. The new version/manpages are available at:
ftp://piast.t19.ds.pwr.wroc.pl/pub/linux/shadow/
Solution:
S.u.S.E. 6.1 ships with older manpages that don't explain the -p option. The new version/manpages are available at:
ftp://piast.t19.ds.pwr.wroc.pl/pub/linux/shadow/
References
S.u.S.E. Linux useradd Vulnerability
References:
References: