Executive brief
CrackLib is a software library used by Unix-like operating systems to enforce strong password policies. A security flaw allows a local user to crash the system or potentially gain administrative (root) privileges by providing an excessively long string in their user information (GECOS) field. This could allow a standard user to take full control of the affected system.
Technical details
A stack-based buffer overflow exists in CrackLib 2.5 within the fascist.c component. The vulnerability is caused by the use of the unsafe 'strcpy' function when copying the GECOS (user information) field from the passwd structure into a fixed-size buffer (gbuffer) of 256 bytes (STRINGSIZE). A local attacker can exploit this by using tools like 'chfn' to populate their GECOS field with a string exceeding the buffer capacity. When a password change is subsequently attempted, the overflow occurs, potentially allowing for arbitrary code execution with root privileges. Mitigation involves replacing unsafe string functions with bounds-checked alternatives like 'strncpy' or 'snprintf'.
Affected products
- CrackLib CrackLib 2.5
Timeline
- 1997-12-14: disclosed: Initial discovery reported on Bugtraq mailing list.
- 1997-12-14: advisory: NVD publication date.