Slackware /bin/login Vulnerability

vendor:

Slackware Linux

by:

SecurityFocus

7.2

CVSS

HIGH

Privilege Escalation

264

CWE

Product Name: Slackware Linux

Affected Version From: Slackware 3.0

Affected Version To: Slackware 3.5

Patch Exists: NO

Related CWE: N/A

CPE: o:slackware:slackware_linux:3.5

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux

2002

Slackware /bin/login Vulnerability

Due to the way /bin/login behaves when a /etc/group file is not present under Slackware's version of the password shadowing suite, users who log in while this file is not present will be given uid and gid 0. This will allow them unrestricted access to the machine. If the call to initgroups() fails in setup_uid_gid(), the function immediately returns value of -1. However, the call to setup_uid_gid() in login.c fails to check this return value. Since the uid and gid were not checked, their value is still 0, and the user will be logged in with 0 as their uid and gid. Remove /etc/group and log in as a valid user. /etc/group must entirely not exist -- mode 000 is not sufficient.

Mitigation:

Ensure that the /etc/group file is present and that it is not set to mode 000.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/155/info

Due to the way /bin/login behaves when a /etc/group file is not present under Slackware's version of the password shadowing suite, users who log in while this file is not present will be given uid and gid 0. This will allow them unrestricted access to the machine. This vulnerability is present in all versions of Slackware which have shadow passwords, up to and including 3.5

If the call to initgroups() fails in setup_uid_gid(), the function immediately returns value of -1. However, the call to setup_uid_gid() in login.c fails to check this return value. Since the uid and gid were not checked, their value is still 0, and the user will be logged in with 0 as their uid and gid.

Remove /etc/group and log in as a valid user. /etc/group must entirely not exist -- mode 000 is not sufficient.