Bug 49741 – Denial of Service: pam_unix authentication hangs in hashsum generation

Bug 49741 - Denial of Service: pam_unix authentication hangs in hashsum generation


Summary:	Denial of Service: pam_unix authentication hangs in hashsum generation

Status:	CLOSED FIXED

Product:	UCS
Classification:	Unclassified
Component:	PAM
Version:	UCS 4.4
Hardware:	Other Linux

Importance:	P5 normal (vote)
Target Milestone:	UCS 4.4-1-errata
Assigned To:	Florian Best
QA Contact:	Johannes Keiser

URL:	https://github.com/linux-pam/linux-pa...
Keywords:

Depends on:
Blocks:	44602
	Show dependency tree / graph

Reported:	2019-06-27 16:52 CEST by Florian Best
Modified:	2021-06-23 07:29 CEST (History)
CC List:	2 users (show)

See Also:
What kind of report is it?:	Security Issue
What type of bug is this?:	---
Who will be affected by this bug?:	---
How will those affected feel about the bug?:	---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):	Security
Max CVSS v3 score:	7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Florian Best

2019-06-27 16:52:34 CEST

https://github.com/linux-pam/linux-pam/issues/118
https://github.com/linux-pam/linux-pam/pull/120

pam_unix hangs during the hashsum generation of the given password.
This causes python-pam processes to hang forever, when someone logs in via a very long password.

Comment 1 Florian Best

2019-07-02 15:45:56 CEST

Build package (for i386 and amd64) in scope fbest:
deb [trusted=yes] http://omar.knut.univention.de/build2/ ucs_4.4-0-fbest/all/
deb [trusted=yes] http://omar.knut.univention.de/build2/ ucs_4.4-0-fbest/$(ARCH)/

Changes in patches repository: svn r18608
YAML file in branch git:fbest/49741-pam-unix

Comment 2 Florian Best

2019-07-12 14:24:21 CEST

Rebuilt the package again: Somehow the quilt patch was not appended to debian/series. Migrated to a .patch file now which worked.

[amd64] successful build
Package: pam
Version: 1.1.8-3.6A~4.4.0.201907121407
Branch: ucs_4.4-0-fbest
Scope: fbest

Comment 3 Florian Best

2019-07-17 11:32:32 CEST

Merged the patch into the errata-4.4-1 scope.

pam.yaml
f1d99e8176dc | YAML Bug #49741
f2f3ea4e5127 | YAML Bug #49740

Comment 4 Florian Best

2019-07-17 11:38:49 CEST

QA: test authentication and password changing (passwords longer than 512 characters should be rejected).

Comment 5 Jürn Brodersen

2019-07-22 15:44:51 CEST

Does this need a release of univention-pam?
I ask because the workaround for bug 49614 is a change in "/etc/pam.d/common-session" which would be overwritten in that case.

Comment 6 Florian Best

2019-07-22 17:29:00 CEST

(In reply to Jürn Brodersen from comment #5)
> Does this need a release of univention-pam?
No.

Comment 7 Johannes Keiser

2019-07-30 09:15:49 CEST

OK: login with password > 512 chars not possible
OK: pam_unix does not hang anymore for big passwords
OK: trying to change password to > 512 chars shows error that password is too long
OK: yaml
-> verified

Comment 8 Arvid Requate

2019-07-31 13:58:43 CEST

<http://errata.software-univention.de/ucs/4.4/206.html>