isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Historically, crypt() returned the empty string on error, which

Browse Source 
ensured that crypt("", "") would return "", which supported matcing
empty encrypted passwords with no additional code.  Some modern
versions of crypt() (such as glibc) return NULL on error so we need
an explicit test to match an empty plaintext password and an empty
encrypted password.
This commit is contained in:
Todd C. Miller
2015-02-19 14:17:57 -07:00
parent 615aee9d1e
commit 9b514ed83c
2 changed files with 9 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
plugins/sudoers/auth/passwd.c
View File

@@ -71,7 +71,9 @@ sudo_passwd_verify(struct passwd *pw, char *pass, sudo_auth *auth)
int matched = 0; int matched = 0;
debug_decl(sudo_passwd_verify, SUDOERS_DEBUG_AUTH) debug_decl(sudo_passwd_verify, SUDOERS_DEBUG_AUTH)
pw_len = strlen(pw_epasswd); /* An empty plain-text password must match an empty encrypted password. */
if (pass[0] == '\0')
debug_return_int(pw_epasswd[0] ? AUTH_FAILURE : AUTH_SUCCESS);
#ifdef HAVE_GETAUTHUID #ifdef HAVE_GETAUTHUID
/* Ultrix shadow passwords may use crypt16() */ /* Ultrix shadow passwords may use crypt16() */
@@ -85,6 +87,7 @@ sudo_passwd_verify(struct passwd *pw, char *pass, sudo_auth *auth)
* If this turns out not to be safe we will have to use OS #ifdef's (sigh). * If this turns out not to be safe we will have to use OS #ifdef's (sigh).
*/ */
sav = pass[8]; sav = pass[8];
pw_len = strlen(pw_epasswd);
if (pw_len == DESLEN || HAS_AGEINFO(pw_epasswd, pw_len)) if (pw_len == DESLEN || HAS_AGEINFO(pw_epasswd, pw_len))
pass[8] = '\0'; pass[8] = '\0';

5
plugins/sudoers/auth/secureware.c
View File

@@ -75,6 +75,11 @@ sudo_secureware_verify(struct passwd *pw, char *pass, sudo_auth *auth)
char *pw_epasswd = auth->data; char *pw_epasswd = auth->data;
char *epass = NULL; char *epass = NULL;
debug_decl(sudo_secureware_verify, SUDOERS_DEBUG_AUTH) debug_decl(sudo_secureware_verify, SUDOERS_DEBUG_AUTH)
/* An empty plain-text password must match an empty encrypted password. */
if (pass[0] == '\0')
debug_return_int(pw_epasswd[0] ? AUTH_FAILURE : AUTH_SUCCESS);
#ifdef __alpha #ifdef __alpha
{ {
extern int crypt_type; extern int crypt_type;