From owner-freebsd-bugs@FreeBSD.ORG Thu Mar 11 11:30:02 2010 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id D811F106564A for ; Thu, 11 Mar 2010 11:30:02 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 96FE28FC1B for ; Thu, 11 Mar 2010 11:30:02 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.4/8.14.4) with ESMTP id o2BBU2lV018151 for ; Thu, 11 Mar 2010 11:30:02 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.4/8.14.4/Submit) id o2BBU25i018143; Thu, 11 Mar 2010 11:30:02 GMT (envelope-from gnats) Resent-Date: Thu, 11 Mar 2010 11:30:02 GMT Resent-Message-Id: <201003111130.o2BBU25i018143@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Andre Albsmeier Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 10C551065670 for ; Thu, 11 Mar 2010 11:21:49 +0000 (UTC) (envelope-from Andre.Albsmeier@siemens.com) Received: from david.siemens.de (david.siemens.de [192.35.17.14]) by mx1.freebsd.org (Postfix) with ESMTP id 9AEE38FC08 for ; Thu, 11 Mar 2010 11:21:48 +0000 (UTC) Received: from mail2.siemens.de (localhost [127.0.0.1]) by david.siemens.de (8.12.11.20060308/8.12.11) with ESMTP id o2BBLllW020982 for ; Thu, 11 Mar 2010 12:21:47 +0100 Received: from curry.mchp.siemens.de (curry.mchp.siemens.de [139.25.40.130]) by mail2.siemens.de (8.12.11.20060308/8.12.11) with ESMTP id o2BBLlYt022810 for ; Thu, 11 Mar 2010 12:21:47 +0100 Received: (from localhost) by curry.mchp.siemens.de (8.14.4/8.14.4) id o2BBLlo5038821 for FreeBSD-gnats-submit@freebsd.org; Thu, 11 Mar 2010 12:21:47 +0100 (CET) Message-Id: <201003111121.o2BBLl91028812@curry.mchp.siemens.de> Date: Thu, 11 Mar 2010 12:21:47 +0100 (CET) From: Andre Albsmeier To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 Cc: Subject: bin/144652: [PATCH] pwd_mkdb copies comments to /etc/passwd X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 11 Mar 2010 11:30:03 -0000 >Number: 144652 >Category: bin >Synopsis: [PATCH] pwd_mkdb copies comments to /etc/passwd >Confidential: no >Severity: serious >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Thu Mar 11 11:30:02 UTC 2010 >Closed-Date: >Last-Modified: >Originator: Andre Albsmeier >Release: FreeBSD 7.2-STABLE i386 >Organization: >Environment: System: FreeBSD 7.2-STABLE >Description: pwd_mkdb copies comments from /etc/master.passwd to /etc/passwd. Since /etc/passwd is world readable this could reveal encrypted, although currently not active, passwords from entries that have been commented out for some reason. >How-To-Repeat: Add a user with password to /etc/master.passwd. vipw and comment out the entry by adding a # in front of it. As normal user: grep '#' /etc/passwd The result looks something like this: # $FreeBSD: src/etc/master.passwd,v 1.40 2005/06/06 20:19:56 brooks Exp $ # #bla:$1$p6BO4g61$1nBDxyYFx4veLK9TAXYM8/:998:0:md5:0:0::/var/empty:/bin/sh >Fix: A solution would be to not copy comments to /etc/passwd: --- usr.sbin/pwd_mkdb/pwd_mkdb.c.ORI 2009-06-10 21:11:21.000000000 +0200 +++ usr.sbin/pwd_mkdb/pwd_mkdb.c 2010-03-11 11:53:47.000000000 +0100 @@ -555,11 +555,12 @@ error("put"); } } - /* Create original format password file entry */ - if (is_comment && makeold){ /* copy comments */ - if (fprintf(oldfp, "%s\n", line) < 0) - error("write old"); - } else if (makeold) { + /* Create original format password file entry. + * Don't copy comments since this could reveal + * encrypted passwords if entries have been + * simply commented out in master.passwd. + */ + if( makeold && !is_comment ) { char uidstr[20]; char gidstr[20]; >Release-Note: >Audit-Trail: >Unformatted: