{"id":53580,"date":"2019-12-05T00:00:00","date_gmt":"2019-12-04T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/uyazvimosti-v-openbsd-pozvolyayushhie-povysit-privilegii-i-obojti-autentifikatsiyu-v-smtpd-ldapd-i-radiusd"},"modified":"2021-02-01T11:40:32","modified_gmt":"2021-02-01T09:40:32","slug":"uyazvimosti-v-openbsd-pozvolyayushhie-povysit-privilegii-i-obojti-autentifikatsiyu-v-smtpd-ldapd-i-radiusd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimosti-v-openbsd-pozvolyayushhie-povysit-privilegii-i-obojti-autentifikatsiyu-v-smtpd-ldapd-i-radiusd","title":{"rendered":"Vulnerabilities in OpenBSD that allow privilege escalation and authentication bypass in smtpd, ldapd, and radiusd","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Qualys Company has identified<\/a><\/noindex> four a vulnerability<\/a><\/noindex> In OpenBSD, one of which allows remote connections without authentication to certain network services, while the other three elevate privileges in the system. The Qualys report noted the quick response of OpenBSD developers \u2014 all issues were four vulnerabilities have been fixed<\/a><\/noindex> downward API support (simultaneously with this in OpenBSD 6.5<\/a><\/noindex> and OpenBSD 6.6<\/a><\/noindex> addressed within 40 hours after private notification.<\/p>\n

The remotely exploitable vulnerability is caused by an error in the organization of the authentication handler call in the libc library, which calls
\nthe program \/usr\/libexec\/auth\/login_style with command-line argument passing. This includes allowing the protocol name to be passed when invoking login_style using the optional parameter \"-s service\". If a username starts with the character \"-\", it will be treated as an option when launching login_style. Consequently, if the username specified for authentication is \"-schallenge\" or \"-schallenge:passwd\", login_style will interpret the request as a request to use the handler S\/Key<\/a><\/noindex>.<\/p>\n

The issue is that the S\/Key protocol in login_style is only supported formally, while in practice it is ignored when displaying the indication of successful authentication. Thus, an attacker can bypass authentication by posing as user \"-schallenge\" and gain access without entering a password or keys. All network services using standard libc calls for authentication are potentially vulnerable to this problem. For example, the possibility of bypassing authentication has been confirmed in smtpd (AUTH PLAIN), ldapd, and radiusd.<\/p>\n

In sshd, the vulnerability does not manifest, as it has additional protections that check for the presence of the user in the system. However, sshd can be used to check the system's vulnerability \u2014 when accessed with the username \"-sresponse:passwd\", the connection hangs as sshd waits for login_passwd to return the invocation parameters (challenge), while login_passwd expects the missing parameters to be provided (the name \"-sresponse\" is treated as an option). A local attacker might attempt to bypass authentication in the su utility, but providing the name \"-sresponse\" leads to a crash due to a null pointer being returned when executing the function getpwnam_r(\"-schallenge\", ...).<\/p>\n

Other vulnerabilities:<\/p>\n