Date: Thu, 1 May 2003 20:40:13 -0700 (PDT) From: "Dorr H. Clark" <dclark@applmath.scu.edu> To: freebsd-bugs@FreeBSD.org Subject: fix proposed Re: misc/43674: Able to bypass expired password Message-ID: <200305020340.h423eDJS092409@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
The following reply was made to PR misc/43674; it has been noted by GNATS.
From: "Dorr H. Clark" <dclark@applmath.scu.edu>
To: freebsd-gnats-submit@FreeBSD.org,
crawford.jeffrey.eugene@bigfoot.com
Cc:
Subject: fix proposed Re: misc/43674: Able to bypass expired password
Date: Thu, 01 May 2003 17:57:12 -0700
The problem in 43674 occurs because the implementation
presumes the cooperation of the user, which is normally
a sub-optimal strategy for system security.
If the user chooses not to cooperate, login is not aware.
Our proposed fix checks whether the user has actually made
the requested password change before proceeding.
If they attempt the ^C exploit listed in 43674,
they are prompted again.
NOTE: This patch is compatible with 4.7-STABLE !
--- /usr/src/usr.bin/login/login.c Wed Mar 13 10:45:33 2002
+++ login.c Mon Apr 28 20:45:24 2003
@@ -704,12 +704,15 @@
(void)signal(SIGQUIT, SIG_DFL);
(void)signal(SIGINT, SIG_DFL);
(void)signal(SIGTSTP, SIG_IGN);
-
- if (changepass) {
+ while (changepass) {
if (system(_PATH_CHPASS) != 0)
sleepexit(1);
+ pwd = getpwnam(username);
+ if(!pwd->pw_change)
+ changepass = 0;
+ else
+ printf("\nSorry!Your password is expired.You
have to
enter a new password.\n\n");
}
-
/*
* Login shells have a leading '-' in front of argv[0]
*/
Kuang-Wu "Kerwin" Hsu, engineer
Dorr H. Clark, advisor
COEN 284 - Operating Systems Case Study
Santa Clara University,
Santa Clara CA.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200305020340.h423eDJS092409>