diff options
| author | Thorsten Kukuk <kukuk@thkukuk.de> | 2015-06-22 14:53:01 +0200 |
|---|---|---|
| committer | Thorsten Kukuk <kukuk@thkukuk.de> | 2015-06-22 14:53:01 +0200 |
| commit | e89d4c97385ff8180e6e81e84c5aa745daf28a79 (patch) | |
| tree | 17ef8bacb38a0f60a7476420ab62627cc8af440c /modules/pam_unix/passverify.h | |
| parent | f4fbbbcc52696d67ebe57ee8214fbbdf4c479dbc (diff) | |
| download | pam-e89d4c97385ff8180e6e81e84c5aa745daf28a79.tar.gz pam-e89d4c97385ff8180e6e81e84c5aa745daf28a79.tar.bz2 pam-e89d4c97385ff8180e6e81e84c5aa745daf28a79.zip | |
Release version 1.2.1
Security fix: CVE-2015-3238
If the process executing pam_sm_authenticate or pam_sm_chauthtok method
of pam_unix is not privileged enough to check the password, e.g.
if selinux is enabled, the _unix_run_helper_binary function is called.
When a long enough password is supplied (16 pages or more, i.e. 65536+
bytes on a system with 4K pages), this helper function hangs
indefinitely, blocked in the write(2) call while writing to a blocking
pipe that has a limited capacity.
With this fix, the verifiable password length will be limited to
PAM_MAX_RESP_SIZE bytes (i.e. 512 bytes) for pam_exec and pam_unix.
* NEWS: Update
* configure.ac: Bump version
* modules/pam_exec/pam_exec.8.xml: document limitation of password length
* modules/pam_exec/pam_exec.c: limit password length to PAM_MAX_RESP_SIZE
* modules/pam_unix/pam_unix.8.xml: document limitation of password length
* modules/pam_unix/pam_unix_passwd.c: limit password length
* modules/pam_unix/passverify.c: Likewise
* modules/pam_unix/passverify.h: Likewise
* modules/pam_unix/support.c: Likewise
Diffstat (limited to 'modules/pam_unix/passverify.h')
| -rw-r--r-- | modules/pam_unix/passverify.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/modules/pam_unix/passverify.h b/modules/pam_unix/passverify.h index 3de67593..caf7ae8a 100644 --- a/modules/pam_unix/passverify.h +++ b/modules/pam_unix/passverify.h @@ -8,7 +8,7 @@ #define PAM_UNIX_RUN_HELPER PAM_CRED_INSUFFICIENT -#define MAXPASS 200 /* the maximum length of a password */ +#define MAXPASS PAM_MAX_RESP_SIZE /* the maximum length of a password */ #define OLD_PASSWORDS_FILE "/etc/security/opasswd" |