From Andre.Albsmeier@siemens.com  Thu Mar 11 11:21:49 2010
Return-Path: <Andre.Albsmeier@siemens.com>
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 10C551065670
	for <FreeBSD-gnats-submit@freebsd.org>; Thu, 11 Mar 2010 11:21:49 +0000 (UTC)
	(envelope-from Andre.Albsmeier@siemens.com)
Received: from david.siemens.de (david.siemens.de [192.35.17.14])
	by mx1.freebsd.org (Postfix) with ESMTP id 9AEE38FC08
	for <FreeBSD-gnats-submit@freebsd.org>; Thu, 11 Mar 2010 11:21:48 +0000 (UTC)
Received: from mail2.siemens.de (localhost [127.0.0.1])
	by david.siemens.de (8.12.11.20060308/8.12.11) with ESMTP id o2BBLllW020982
	for <FreeBSD-gnats-submit@freebsd.org>; Thu, 11 Mar 2010 12:21:47 +0100
Received: from curry.mchp.siemens.de (curry.mchp.siemens.de [139.25.40.130])
	by mail2.siemens.de (8.12.11.20060308/8.12.11) with ESMTP id o2BBLlYt022810
	for <FreeBSD-gnats-submit@freebsd.org>; Thu, 11 Mar 2010 12:21:47 +0100
Received: (from localhost)
	by curry.mchp.siemens.de (8.14.4/8.14.4) id o2BBLlo5038821
	for FreeBSD-gnats-submit@freebsd.org; Thu, 11 Mar 2010 12:21:47 +0100 (CET)
Message-Id: <201003111121.o2BBLl91028812@curry.mchp.siemens.de>
Date: Thu, 11 Mar 2010 12:21:47 +0100 (CET)
From: Andre Albsmeier <Andre.Albsmeier@siemens.com>
To: FreeBSD-gnats-submit@freebsd.org
Cc:
Subject: [PATCH] pwd_mkdb copies comments to /etc/passwd
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         144652
>Category:       bin
>Synopsis:       [PATCH] pwd_mkdb(8) copies comments to /etc/passwd
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Thu Mar 11 11:30:02 UTC 2010
>Closed-Date:    
>Last-Modified:  Thu Mar 11 23:45:44 UTC 2010
>Originator:     Andre Albsmeier
>Release:        FreeBSD 7.2-STABLE i386
>Organization:
>Environment:

System: FreeBSD 7.2-STABLE

>Description:

pwd_mkdb copies comments from /etc/master.passwd to /etc/passwd.
Since /etc/passwd is world readable this could reveal encrypted,
although currently not active, passwords from entries that have
been commented out for some reason.

>How-To-Repeat:

Add a user with password to /etc/master.passwd.
vipw and comment out the entry by adding a # in front of it.
As normal user: grep '#' /etc/passwd

The result looks something like this:

# $FreeBSD: src/etc/master.passwd,v 1.40 2005/06/06 20:19:56 brooks Exp $
#
#bla:$1$p6BO4g61$1nBDxyYFx4veLK9TAXYM8/:998:0:md5:0:0::/var/empty:/bin/sh

>Fix:

A solution would be to not copy comments to /etc/passwd:

--- usr.sbin/pwd_mkdb/pwd_mkdb.c.ORI	2009-06-10 21:11:21.000000000 +0200
+++ usr.sbin/pwd_mkdb/pwd_mkdb.c	2010-03-11 11:53:47.000000000 +0100
@@ -555,11 +555,12 @@
 					error("put");
 			}
 		}
-		/* Create original format password file entry */
-		if (is_comment && makeold){	/* copy comments */
-			if (fprintf(oldfp, "%s\n", line) < 0)
-				error("write old");
-		} else if (makeold) {
+		/* Create original format password file entry.
+		 * Don't copy comments since this could reveal
+		 * encrypted passwords if entries have been
+		 * simply commented out in master.passwd.
+		 */
+		if( makeold && !is_comment ) {
 			char uidstr[20];
 			char gidstr[20];
 
>Release-Note:
>Audit-Trail:
>Unformatted:
