From owner-freebsd-bugs@FreeBSD.ORG Wed Nov 28 18:50:01 2012 Return-Path: Delivered-To: freebsd-bugs@smarthost.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 008DF354 for ; Wed, 28 Nov 2012 18:50:00 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:1900:2254:206c::16:87]) by mx1.freebsd.org (Postfix) with ESMTP id C92C08FC12 for ; Wed, 28 Nov 2012 18:50:00 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.5/8.14.5) with ESMTP id qASIo0uv054496 for ; Wed, 28 Nov 2012 18:50:00 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.5/8.14.5/Submit) id qASIo0RC054495; Wed, 28 Nov 2012 18:50:00 GMT (envelope-from gnats) Resent-Date: Wed, 28 Nov 2012 18:50:00 GMT Resent-Message-Id: <201211281850.qASIo0RC054495@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Nikos Vassiliadis Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 8608D118 for ; Wed, 28 Nov 2012 18:41:46 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from red.freebsd.org (red.freebsd.org [IPv6:2001:4f8:fff6::22]) by mx1.freebsd.org (Postfix) with ESMTP id 541998FC08 for ; Wed, 28 Nov 2012 18:41:46 +0000 (UTC) Received: from red.freebsd.org (localhost [127.0.0.1]) by red.freebsd.org (8.14.5/8.14.5) with ESMTP id qASIfkHQ033394 for ; Wed, 28 Nov 2012 18:41:46 GMT (envelope-from nobody@red.freebsd.org) Received: (from nobody@localhost) by red.freebsd.org (8.14.5/8.14.5/Submit) id qASIfkx4033378; Wed, 28 Nov 2012 18:41:46 GMT (envelope-from nobody) Message-Id: <201211281841.qASIfkx4033378@red.freebsd.org> Date: Wed, 28 Nov 2012 18:41:46 GMT From: Nikos Vassiliadis To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.1 Subject: bin/173977: pw(8) does not do range-checking on UIDs/GUIs from user's input, passwd DB becomes inconsistent X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 Nov 2012 18:50:01 -0000 >Number: 173977 >Category: bin >Synopsis: pw(8) does not do range-checking on UIDs/GUIs from user's input, passwd DB becomes inconsistent >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Wed Nov 28 18:50:00 UTC 2012 >Closed-Date: >Last-Modified: >Originator: Nikos Vassiliadis >Release: FreeBSD 10.0-CURRENT >Organization: >Environment: FreeBSD lab.local 10.0-CURRENT FreeBSD 10.0-CURRENT #3 r243503: Sun Nov 25 11:44:20 EET 2012 root@lab.local:/usr/obj/usr/src/sys/RCTLLAB i386 >Description: pw(8) command does not do any range checking on the uid and gid input, resulting in inconsistencies in the password database. >How-To-Repeat: Try adding a too big uid: > root@lab:~ # pw user add -n test1 -u 9999999999999 > root@lab:~ # id test1 > uid=2147483647(test1) gid=1004(test1) groups=1004(test1) An invalid number is also accepted and is interpreted as 0: > root@lab:~ # pw user add -n test2 -u asd9999999999999 > pw: uid `0' has already been allocated The password database can become inconsistent because "pw user del" does not really delete the user: > root@lab:~ # pw user add -n test0 -u 9999999999999999999 > root@lab:~ # id test0 > uid=2147483647(test0) gid=2147483647(test0) groups=2147483647(test0) > root@lab:~ # pw user del test0 > root@lab:~ # pw user del test0 > pw: pw_copy(): No such file or directory > root@lab:~ # id test0 > uid=2147483647(test0) gid=2147483647 groups=2147483647 /etc/passwd does not contain the user test0 but /etc/pwd.db is. >Fix: Patch attached with submission follows: Index: usr.sbin/pw/pw_group.c =================================================================== --- usr.sbin/pw/pw_group.c (revision 243652) +++ usr.sbin/pw/pw_group.c (working copy) @@ -350,6 +350,8 @@ */ if (a_gid != NULL) { gid = (gid_t) atol(a_gid->val); + if (errno == ERANGE || errno == EINVAL) + errx(EX_DATAERR, "gid %s is invalid", a_gid->val); if ((grp = GETGRGID(gid)) != NULL && getarg(args, 'o') == NULL) errx(EX_DATAERR, "gid `%ld' has already been allocated", (long) grp->gr_gid); Index: usr.sbin/pw/pw_user.c =================================================================== --- usr.sbin/pw/pw_user.c (revision 243652) +++ usr.sbin/pw/pw_user.c (working copy) @@ -849,6 +849,8 @@ */ if (a_uid != NULL) { uid = (uid_t) atol(a_uid->val); + if (errno == ERANGE || errno == EINVAL) + errx(EX_DATAERR, "uid %s is invalid", a_uid->val); if ((pwd = GETPWUID(uid)) != NULL && getarg(args, 'o') == NULL) errx(EX_DATAERR, "uid `%ld' has already been allocated", (long) pwd->pw_uid); >Release-Note: >Audit-Trail: >Unformatted: