Changeset 796 in openpam

Timestamp:

Jun 3, 2014, 9:30:08 PM (7 years ago)

Author:

Dag-Erling Smørgrav

Message:

merge r795: fix error handling for nonexistent modules (CVE-2014-3879)

Location:

branches/nooath

Files:

• . (modified) (1 prop)
• HISTORY (modified) (1 diff)
• lib/libpam/openpam_configure.c (modified) (11 diffs)

branches/nooath/HISTORY

@@ +1 @@
+OpenPAM ??????????                                              2014-??-??
+
+ - BUGFIX: Under certain circumstances, specifying a non-existent
+   module (or misspelling the name of a module) in a policy could
+   result in a fail-open scenario.
+
+ - BUGFIX: The is_upper() predicate only accepted the letter A as an
+   upper-case character instead of the entire A-Z range.  As a result,
+   service and module names containing upper-case letters other than A
+   would be rejected.
+============================================================================
 OpenPAM Nummularia                                              2013-09-07
 

branches/nooath/lib/libpam/openpam_configure.c

@@ -1 +1 @@
 /*-
  * Copyright (c) 2001-2003 Networks Associates Technology, Inc.
- * Copyright (c) 2004-2012 Dag-Erling Smørgrav
+ * Copyright (c) 2004-2014 Dag-Erling Smørgrav
  * All rights reserved.
  *
@@ -194 +194 @@
                             "%s(%d): missing or invalid facility",
                             filename, lineno);
+                        errno = EINVAL;
                         goto fail;
                 }
@@ -209 +210 @@
                                     "%s(%d): missing or invalid service name",
                                     filename, lineno);
+                                errno = EINVAL;
                                 goto fail;
                         }
@@ -215 +217 @@
                                     "%s(%d): garbage at end of line",
                                     filename, lineno);
+                                errno = EINVAL;
                                 goto fail;
                         }
                         ret = openpam_load_chain(pamh, servicename, fclt);
                         FREEV(wordc, wordv);
-                        if (ret < 0)
+                        if (ret < 0) {
+                                /*
+                                 * Bogus errno, but this ensures that the
+                                 * outer loop does not just ignore the
+                                 * error and keep searching.
+                                 */
+                                if (errno == ENOENT)
+                                        errno = EINVAL;
                                 goto fail;
+                        }
                         continue;
                 }
@@ -230 +241 @@
                             "%s(%d): missing or invalid control flag",
                             filename, lineno);
+                        errno = EINVAL;
                         goto fail;
                 }
@@ -239 +251 @@
                             "%s(%d): missing or invalid module name",
                             filename, lineno);
+                        errno = EINVAL;
                         goto fail;
                 }
@@ -248 +261 @@
 
                 /* load module */
-                if ((this->module = openpam_load_module(modulename)) == NULL)
+                if ((this->module = openpam_load_module(modulename)) == NULL) {
+                        if (errno == ENOENT)
+                                errno = ENOEXEC;
                         goto fail;
+                }
 
                 /*
@@ -282 +298 @@
          * can happen for four different reasons: an I/O error (ferror(f)
          * is true), a memory allocation failure (ferror(f) is false,
-         * errno is non-zero)
+         * feof(f) is false, errno is non-zero), the file ended with an
+         * unterminated quote or backslash escape (ferror(f) is false,
+         * feof(f) is true, errno is non-zero), or the end of the file was
+         * reached without error (ferror(f) is false, feof(f) is true,
+         * errno is zero).
          */
         if (ferror(f) || errno != 0)
@@ -403 +423 @@
                 ret = openpam_load_file(pamh, service, facility,
                     filename, style);
+                /* success */
+                if (ret > 0)
+                        RETURNN(ret);
                 /* the file exists, but an error occurred */
                 if (ret == -1 && errno != ENOENT)
@@ -412 +435 @@
 
         /* no hit */
-        RETURNN(0);
+        errno = ENOENT;
+        RETURNN(-1);
 }
 
@@ -433 +457 @@
                 RETURNC(PAM_SYSTEM_ERR);
         }
-        if (openpam_load_chain(pamh, service, PAM_FACILITY_ANY) < 0)
-                goto load_err;
+        if (openpam_load_chain(pamh, service, PAM_FACILITY_ANY) < 0) {
+                if (errno != ENOENT)
+                        goto load_err;
+        }
         for (fclt = 0; fclt < PAM_NUM_FACILITIES; ++fclt) {
                 if (pamh->chains[fclt] != NULL)