COMMAND

	pam_ldap format string vulnerability

SYSTEMS AFFECTED

	nss_ldap packages prior to nss_ldap-189-1.6.2

PROBLEM

	In Blackshell Advisory # 5 a Local Format String Vulnerability has  been
	found in pam_ldap :
	

	

	fp = fopen (configFile, \"r\"); 

	

	

	  if (fp == NULL) 

	    { 

	      /* 

	       * According to PAM Documentation, such an error in a config file 

	       * SHOULD be logged at LOG_ALERT level 

	       */ 

	      snprintf (errmsg, sizeof (errmsg), \"pam_ldap: missing file \\\"%s\\\"\", 

	                configFile); 

	      syslog (LOG_ALERT, errmsg); 

	      return PAM_SERVICE_ERR; 

	    } 

	

	

	

	configfile is defined as:
	

	

	      else if (!strncmp (argv[i], \"config=\", 7)) 

	        configFile = argv[i] + 7; 

	

	in the main function.
	

	

	vulnerable calls to the function logging() would include:
	

	

	ldap_utils.c: logging( INFO, \"- password check for %s\", dn ); 

	ldap_utils.c: logging( DEBUG, \"- (%d) %s\", i, val[i] ); 

	ldap_utils.c: logging( DEBUG, \"- open connection to ldapserver: %s:%d\", ldapServer, ldapPort); 

	ldap_utils.c: logging( WARN, \"- cannot login to: %s:%d\", ldapServer, ldapPort); 

	ldap_utils.c: logging( DEBUG, \"- search for: %s\", searchStr ); 

	ldap_utils.c: logging( DEBUG, \"- entry found: %s\", grpDN ); 

	ldap_utils.c: logging( DEBUG, \"- searchstr: %s\", searchStr ); 

	ldap_utils.c: logging( DEBUG, \"- start searching for uid: %s\", uid ); 

	ldap_utils.c: logging( WARN, \"- user \\\"%s\\\", not found!\\n\", uid); 

	ldap_utils.c: logging( DEBUG, \"- DN found: %s\", udn ); 

	ldap_utils.c: logging( DEBUG, \"- is user %s in %s\\n\", dn, gdn ); 

	ldap_utils.c: logging( DEBUG, \"- user \\\"%s\\\" is in Group \\\"%s\\\"\", dn, gdn ); 

	ldap_utils.c: logging( DEBUG, \"- user \\\"%s\\\" is NOT in Group \\\"%s\\\"\", dn, gdn ); 

	main.c: logging( RUN, \"%s - %s - starting\", PROG, VERS ); 

	main.c: logging( RUN, \"- find DN for group %s\\n\", conf.pxyGroup ); 

	main.c: logging( WARN, \"- unable to find group: %s\", conf.pxyGroup ); 

	main.c: logging( DEBUG, \"- group DN: %s\", dnGrp ); 

	main.c: logging( RUN, \"%s - %s - ready\", PROG, VERS ); 

	main.c: logging( RUN, \"- unable to connect to LDAP server: %s:%d\", conf.ldapServer, conf.ldapPort); 

	main.c: logging( DEBUG, \"- connected to ldapServer %s:%d\", conf.ldapServer, conf.ldapPort); 

	main.c: logging( RUN, \"- unable to connect to LDAP server: %s:%d\", conf.ldapServer, conf.ldapPort); 

	main.c: logging( DEBUG, \"- connected to ldapServer %s:%d\", conf.ldapServer, conf.ldapPort); 

	main.c: logging( RUN, \"%s - %s - stopping\", PROG, VERS ); 

	main.c: logging( DEBUG, \"- user string: |%s|\", buf); 

	main.c: logging( DEBUG, \"- got User: %s\", user ); 

	main.c: logging( DEBUG, \"- got Password: %s\", crypt (pass, \"42\") ); 

	options.c: logging(DEBUG,\"- ldapServer: %s \", conf->ldapServer ); 

	options.c: logging(DEBUG,\"- searchBase: %s \", conf->searchBase ); 

	options.c: logging(DEBUG,\"- pxyGroup: %s \", conf->pxyGroup ); 

	options.c: logging(DEBUG,\"- confFile: %s \", conf->confFile ); 

	

	

SOLUTION

	Upgrade your nss_ldap package.