FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

FreeBSD -- Incorrect error handling in PAM policy parser

Affected packages
9.2 <= FreeBSD < 9.2_7
10.0 <= FreeBSD < 10.0_4

Details

VuXML ID 6e8f9003-6007-11e6-a6c3-14dae9d210b8
Discovery 2014-06-03
Entry 2016-08-11

Problem Description:

The OpenPAM library searches for policy definitions in several locations. While doing so, the absence of a policy file is a soft failure (handled by searching in the next location) while the presence of an invalid file is a hard failure (handled by returning an error to the caller).

The policy parser returns the same error code (ENOENT) when a syntactically valid policy references a non-existent module as when the requested policy file does not exist. The search loop regards this as a soft failure and looks for the next similarly-named policy, without discarding the partially-loaded configuration.

A similar issue can arise if a policy contains an include directive that refers to a non-existent policy.

Impact:

If a module is removed, or the name of a module is misspelled in the policy file, the PAM library will proceed with a partially loaded configuration. Depending on the exact circumstances, this may result in a fail-open scenario where users are allowed to log in without a password, or with an incorrect password.

In particular, if a policy references a module installed by a package or port, and that package or port is being reinstalled or upgraded, there is a brief window of time during which the module is absent and policies that use it may fail open. This can be especially damaging to Internet-facing SSH servers, which are regularly subjected to brute-force scans.

References

CVE Name CVE-2014-3879
FreeBSD Advisory SA-14:13.pam