* NEWS, libmisc/chowntty.c, libmisc/utmp.c: is_my_tty() moved from

	utmp.c to chowntty.c. checkutmp() now only uses an existing utmp
	entry if the pid matches and ut_line matches with the current tty.
	This fixes a possible DOS when entries can be forged in the utmp
	file.
	* libmisc/chowntty.c, src/login.c, lib/prototypes.h: Remove the
	tty argument from chown_tty. chown_tty always changes stdin and
	does not need this argument anymore.

diff --git a/ChangeLog b/ChangeLog
index 0c0d5d59515b724db855517f4c036a31a2095ccc..214dbdecb79199f28e62d1872a7882ea7fb0713e 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -2,6 +2,14 @@
 
        * NEWS, libmisc/chowntty.c: Fix a race condition that could lead
        to gaining ownership or changing mode of arbitrary files.
+       * NEWS, libmisc/chowntty.c, libmisc/utmp.c: is_my_tty() moved from
+       utmp.c to chowntty.c. checkutmp() now only uses an existing utmp
+       entry if the pid matches and ut_line matches with the current tty.
+       This fixes a possible DOS when entries can be forged in the utmp
+       file.
+       * libmisc/chowntty.c, src/login.c, lib/prototypes.h: Remove the 
+       tty argument from chown_tty. chown_tty always changes stdin and
+       does not need this argument anymore.
 
 2008-06-26  Nicolas François  <nicolas.francois@centraliens.net>
 

diff --git a/NEWS b/NEWS
index 8afcf03e69a8a52df36ad7bd0000beef942b6a63..fa6d0f12831ff31b0d8d29ba1708cfa234982f90 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -5,6 +5,8 @@ shadow-4.1.2.1 -> shadow-4.1.2.2                                        23-11-2008
 *** security
 - Fix a race condition in login that could lead to gaining ownership or
   changing mode of arbitrary files.
+- Fix a possible login DOS, which could be caused by injecting forged 
+  entries in utmp.
 
 shadow-4.1.2 -> shadow-4.1.2.1                                         26-06-2008
 

diff --git a/lib/prototypes.h b/lib/prototypes.h
index 03f30d12723582dfa45fc79b540283e1b5144837..29d6aeeb751aa47b373a650be6371801d9a361a6 100644 (file)
--- a/lib/prototypes.h
+++ b/lib/prototypes.h
@@ -73,7 +73,7 @@ extern char *Basename (char *str);
 extern int chown_tree (const char *, uid_t, uid_t, gid_t, gid_t);
 
 /* chowntty.c */
-extern void chown_tty (const char *, const struct passwd *);
+extern void chown_tty (const struct passwd *);
 
 /* console.c */
 extern int console (const char *);

diff --git a/libmisc/chowntty.c b/libmisc/chowntty.c
index 745ee8a3de96b7116993e1d49d59eb21a305bf39..6cd0383e80cba4984106d890be14db2acc48be2b 100644 (file)
--- a/libmisc/chowntty.c
+++ b/libmisc/chowntty.c
@@ -43,30 +43,13 @@
 #include "defines.h"
 #include <pwd.h>
 #include "getdef.h"
-/*
- * is_my_tty -- determine if "tty" is the same as TTY stdin is using
- */
-static int is_my_tty (const char *tty)
-{
-       struct stat by_name, by_fd;
-
-       if (stat (tty, &by_name) || fstat (0, &by_fd))
-               return 0;
-
-       if (by_name.st_rdev != by_fd.st_rdev)
-               return 0;
-       else
-               return 1;
-}
-
 /*
  *     chown_tty() sets the login tty to be owned by the new user ID
  *     with TTYPERM modes
  */
 
-void chown_tty (const char *tty, const struct passwd *info)
+void chown_tty (const struct passwd *info)
 {
-       char buf[200], full_tty[200];
        char *group;            /* TTY group name or number */
        struct group *grent;
        gid_t gid;
@@ -90,18 +73,6 @@ void chown_tty (const char *tty, const struct passwd *info)
         * the group as determined above.
         */
 
-       if (*tty != '/') {
-               snprintf (full_tty, sizeof full_tty, "/dev/%s", tty);
-               tty = full_tty;
-       }
-
-       if (!is_my_tty (tty)) {
-               SYSLOG ((LOG_WARN,
-                        "unable to determine TTY name, got %s\n", tty));
-               closelog ();
-               exit (1);
-       }
-
        if (fchown (STDIN_FILENO, info->pw_uid, gid) ||
            fchmod (STDIN_FILENO, getdef_num ("TTYPERM", 0600))) {
                int err = errno;

diff --git a/libmisc/utmp.c b/libmisc/utmp.c
index f4dfbc3f562f9b793be35727004618bdce05653a..130beed647783705d2438e59a1232fcf654ac751 100644 (file)
--- a/libmisc/utmp.c
+++ b/libmisc/utmp.c
@@ -56,6 +56,30 @@ struct utmp utent;
 #define        NO_TTY \
        _("Unable to determine your tty name.")
 
+/*
+ * is_my_tty -- determine if "tty" is the same TTY stdin is using
+ */
+static int is_my_tty (const char *tty)
+{
+       char full_tty[200];
+       struct stat by_name, by_fd;
+
+       if ('/' != *tty) {
+               snprintf (full_tty, sizeof full_tty, "/dev/%s", tty);
+               tty = full_tty;
+       }
+
+       if ((stat (tty, &by_name) != 0) || (fstat (STDIN_FILENO, &by_fd) != 0)) {
+               return 0;
+       }
+
+       if (by_name.st_rdev != by_fd.st_rdev) {
+               return 0;
+       } else {
+               return 1;
+       }
+}
+
 /*
  * checkutmp - see if utmp file is correct for this process
  *
@@ -84,7 +108,8 @@ void checkutmp (int picky)
        while ((ut = getutent ()))
                if (ut->ut_pid == pid && ut->ut_line[0] && ut->ut_id[0] &&
                    (ut->ut_type == LOGIN_PROCESS
-                    || ut->ut_type == USER_PROCESS))
+                    || ut->ut_type == USER_PROCESS) &&
+                   is_my_tty (ut->ut_line))
                        break;
 
        /* If there is one, just use it, otherwise create a new one.  */

diff --git a/src/login.c b/src/login.c
index 689ae1d3de56de7b94df66a1d17199ec0188e0f9..48328b343ed5109b59e95c6f7935f5b7e4985e97 100644 (file)
--- a/src/login.c
+++ b/src/login.c
@@ -1005,7 +1005,7 @@ int main (int argc, char **argv)
        }
        setup_limits (&pwent);  /* nice, ulimit etc. */
 #endif                         /* ! USE_PAM */
-       chown_tty (tty, &pwent);
+       chown_tty (&pwent);
 
 #ifdef USE_PAM
        /*