Bug 15295

Summary:	format string vulnerability in password input
Product:	PolicyKit	Reporter:	Kees Cook <kees>
Component:	daemon	Assignee:	David Zeuthen (not reading bugmail) <zeuthen>
Status:	RESOLVED FIXED	QA Contact:	David Zeuthen (not reading bugmail) <zeuthen>
Severity:	critical
Priority:	high
Version:	unspecified
Hardware:	Other
OS:	All
Whiteboard:
i915 platform:		i915 features:
Attachments:	fixes for format string vulnerabilities Patch for 0.6

Description Kees Cook 2008-03-31 16:23:48 UTC

If a user types a carefully crafted series of format strings, they can trick  polkit-grant-helper into thinking the password was successful.

https://launchpad.net/bugs/205037


src/polkit-grant/polkit-grant-helper.c line 231:

                /* send to parent */
                fprintf (stdout, buf);

This should be fprintf(stdout, "%s", buf);

I also recommend adding "-Wformat -Wformat-security" to the gcc CFLAGS.

Comment 1 Kees Cook 2008-03-31 16:25:11 UTC

$ grep 'format not a string literal' /scratch/ubuntu/logs/policykit_0.7-2ubuntu6_20080331-1621
polkit-policy-cache.c:150: warning: format not a string literal and no format arguments
polkit-grant-helper.c:231: warning: format not a string literal and no format arguments
polkit-grant-helper.c:242: warning: format not a string literal and no format arguments

There appear to be other cases of this too.

Comment 2 Kees Cook 2008-03-31 16:39:38 UTC

Created attachment 15591 [details] [review]
fixes for format string vulnerabilities

Comment 3 Kees Cook 2008-04-02 11:26:09 UTC

CVE-2008-1658

Comment 4 David Zeuthen (not reading bugmail) 2008-04-03 23:30:30 UTC

Hi,

Thanks for noticing this. I've committed this to HEAD

http://gitweb.freedesktop.org/?p=PolicyKit.git;a=commitdiff;h=5bc86a14cc0e356bcf8b5f861674f842869b1be7

with one change: the hunk in src/polkit/polkit-policy-cache.c didn't apply and isn't needed anymore.

Comment 5 David Zeuthen (not reading bugmail) 2008-04-04 00:01:39 UTC

Created attachment 15671 [details] [review]
Patch for 0.6

Had to backport this for Fedora 8 so sharing the patch against 0.6.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.