From owner-freebsd-bugs@FreeBSD.ORG  Fri May  2 02:34:32 2003
Return-Path: <owner-freebsd-bugs@FreeBSD.ORG>
Delivered-To: freebsd-bugs@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 2C68637B401
	for <freebsd-bugs@freebsd.org>; Fri,  2 May 2003 02:34:32 -0700 (PDT)
Received: from hpux47.dc.engr.scu.edu (hpux47.dc.engr.scu.edu [129.210.16.47])
	by mx1.FreeBSD.org (Postfix) with ESMTP id C135243F75
	for <freebsd-bugs@freebsd.org>; Fri,  2 May 2003 02:34:31 -0700 (PDT)
	(envelope-from dclark@applmath.scu.edu)
Received: from localhost (dclark@localhost)
	by hpux47.dc.engr.scu.edu (8.10.2/8.10.2) with ESMTP id h4217br11957
	for <freebsd-bugs@freebsd.org>; Thu, 1 May 2003 18:07:40 -0700 (PDT)
Date: Thu, 1 May 2003 18:07:37 -0700 (PDT)
From: "Dorr H. Clark" <dclark@applmath.scu.edu>
To: freebsd-bugs@freebsd.org
Message-ID: <Pine.GHP.4.21.0305011806530.11932-100000@hpux47.dc.engr.scu.edu>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Subject: fix proposal for 43674
X-BeenThere: freebsd-bugs@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Bug reports <freebsd-bugs.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-bugs>,
	<mailto:freebsd-bugs-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-bugs>
List-Post: <mailto:freebsd-bugs@freebsd.org>
List-Help: <mailto:freebsd-bugs-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-bugs>,
	<mailto:freebsd-bugs-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 02 May 2003 09:34:32 -0000


The problem in 43674 occurs because the implementation 
presumes the cooperation of the user, which is normally 
a sub-optimal strategy for system security.  
If the user chooses not to cooperate, login is not aware.  

Our proposed fix checks whether the user has actually made 
the requested password change before proceeding.  
If they attempt the ^C exploit listed in 43674, 
they are prompted again.

NOTE:  This patch is compatible with 4.7-STABLE !

--- /usr/src/usr.bin/login/login.c      Wed Mar 13 10:45:33 2002
+++ login.c     Mon Apr 28 20:45:24 2003
@@ -704,12 +704,15 @@
        (void)signal(SIGQUIT, SIG_DFL);
        (void)signal(SIGINT, SIG_DFL);
        (void)signal(SIGTSTP, SIG_IGN);
-
-       if (changepass) {
+       while (changepass) {
                if (system(_PATH_CHPASS) != 0)
                        sleepexit(1);
+               pwd = getpwnam(username);
+               if(!pwd->pw_change)
+                       changepass = 0;
+               else
+                       printf("\nSorry!Your password is expired.You have
to
enter a new password.\n\n");
        }
-
        /*
         * Login shells have a leading '-' in front of argv[0]
         */

Kuang-Wu "Kerwin" Hsu, engineer
Dorr H. Clark, advisor
COEN 284 - Operating Systems Case Study 
Santa Clara University, 
Santa Clara CA.