- (djm) Apply Cygwin pointer deref fix from Corinna Vinschen

   <vinschen@redhat.com> Could be abused to guess valid usernames

diff --git a/ChangeLog b/ChangeLog
index d7a2e81797c7d802f480ff49c46f3b369a5ba034..21ada53bc6f25c47e7b12ae0b967a04da6485c7a 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+20011229
+ - (djm) Apply Cygwin pointer deref fix from Corinna Vinschen 
+   <vinschen@redhat.com> Could be abused to guess valid usernames
+
 20011228
  - (djm) Remove recommendation to use GNU make, we should support most
    make programs.

diff --git a/auth1.c b/auth1.c
index d7e80c28a208a7787a39b3bd240138f05468f6dc..3aac26fccbc530f466525740c7e2b6f4beb72664 100644 (file)
--- a/auth1.c
+++ b/auth1.c
@@ -313,9 +313,9 @@ do_authloop(Authctxt *authctxt)
 
 #ifdef HAVE_CYGWIN
                if (authenticated &&
-                   !check_nt_auth(type == SSH_CMSG_AUTH_PASSWORD,pw->pw_uid)) {
+                   !check_nt_auth(type == SSH_CMSG_AUTH_PASSWORD, pw)) {
                        packet_disconnect("Authentication rejected for uid %d.",
-                       (int)pw->pw_uid);
+                       pw == NULL ? -1 : pw->pw_uid);
                        authenticated = 0;
                }
 #else

diff --git a/auth2.c b/auth2.c
index b564a8f3cc93b94a5ea5b7062a8d10df99db16d3..2b23651ffd491b8c511fdc6ef0699c9fdd54f2db 100644 (file)
--- a/auth2.c
+++ b/auth2.c
@@ -335,7 +335,7 @@ userauth_none(Authctxt *authctxt)
                return(0);
 
 #ifdef HAVE_CYGWIN
-       if (check_nt_auth(1, authctxt->pw->pw_uid) == 0)
+       if (check_nt_auth(1, authctxt->pw) == 0)
                return(0);
 #endif
 #ifdef USE_PAM
@@ -361,7 +361,7 @@ userauth_passwd(Authctxt *authctxt)
        packet_done();
        if (authctxt->valid &&
 #ifdef HAVE_CYGWIN
-               check_nt_auth(1, authctxt->pw->pw_uid) &&
+           check_nt_auth(1, authctxt->pw) &&
 #endif
 #ifdef USE_PAM
            auth_pam_password(authctxt->pw, password) == 1)
@@ -398,7 +398,7 @@ userauth_kbdint(Authctxt *authctxt)
        xfree(devs);
        xfree(lang);
 #ifdef HAVE_CYGWIN
-       if (check_nt_auth(0, authctxt->pw->pw_uid) == 0)
+       if (check_nt_auth(0, authctxt->pw) == 0)
                return(0);
 #endif
        return authenticated;
@@ -504,7 +504,7 @@ userauth_pubkey(Authctxt *authctxt)
        xfree(pkalg);
        xfree(pkblob);
 #ifdef HAVE_CYGWIN
-       if (check_nt_auth(0, authctxt->pw->pw_uid) == 0)
+       if (check_nt_auth(0, authctxt->pw) == 0)
                return(0);
 #endif
        return authenticated;

diff --git a/openbsd-compat/bsd-cygwin_util.c b/openbsd-compat/bsd-cygwin_util.c
index f9923f5dbfbc3374d7932ce83a369842cdeabfe5..f56ad7c5b4c6857520321326769a5b3caabae71c 100644 (file)
--- a/openbsd-compat/bsd-cygwin_util.c
+++ b/openbsd-compat/bsd-cygwin_util.c
@@ -58,7 +58,7 @@ int binary_pipe(int fd[2])
        return ret;
 }
 
-int check_nt_auth(int pwd_authenticated, uid_t uid)
+int check_nt_auth(int pwd_authenticated, struct passwd *pw)
 {
        /*
        * The only authentication which is able to change the user
@@ -73,6 +73,8 @@ int check_nt_auth(int pwd_authenticated, uid_t uid)
        */
        static int has_create_token = -1;
 
+       if (pw == NULL)
+               return 0;
        if (is_winnt) {
                if (has_create_token < 0) {
                        struct utsname uts;
@@ -90,7 +92,7 @@ int check_nt_auth(int pwd_authenticated, uid_t uid)
                        }
                }
                if (has_create_token < 1 &&
-                   !pwd_authenticated && geteuid() != uid)
+                   !pwd_authenticated && geteuid() != pw->pw_uid)
                        return 0;
        }
        return 1;

diff --git a/openbsd-compat/bsd-cygwin_util.h b/openbsd-compat/bsd-cygwin_util.h
index e6a78948e6b9ddd16e716340b7441f2de441cb42..a87aeee3f17821518b2fd0e294edc4f35db5b44e 100644 (file)
--- a/openbsd-compat/bsd-cygwin_util.h
+++ b/openbsd-compat/bsd-cygwin_util.h
@@ -24,7 +24,7 @@
 
 int binary_open(const char *filename, int flags, ...);
 int binary_pipe(int fd[2]);
-int check_nt_auth(int pwd_authenticated, uid_t uid);
+int check_nt_auth(int pwd_authenticated, struct passwd *pw);
 int check_ntsec(const char *filename);
 void register_9x_service(void);