accountsservice: CVE-2012-6655: passes (encrypted) passwords as commandline arguments

Related Vulnerabilities: CVE-2012-6655  

Debian Bug report logs - #757912
accountsservice: CVE-2012-6655: passes (encrypted) passwords as commandline arguments

version graph

Reported by: Ansgar Burchardt <ansgar@debian.org>

Date: Tue, 12 Aug 2014 10:09:02 UTC

Severity: normal

Tags: security, upstream

Found in versions accountsservice/0.6.37-3, accountsservice/0.6.21-8

Forwarded to https://gitlab.freedesktop.org/accountsservice/accountsservice/issues/8

Reply or subscribe to this bug.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, Alessio Treglia <alessio@debian.org>:
Bug#757912; Package accountsservice. (Tue, 12 Aug 2014 10:09:06 GMT) (full text, mbox, link).


Acknowledgement sent to Ansgar Burchardt <ansgar@debian.org>:
New Bug report received and forwarded. Copy sent to Alessio Treglia <alessio@debian.org>. (Tue, 12 Aug 2014 10:09:07 GMT) (full text, mbox, link).


Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Ansgar Burchardt <ansgar@debian.org>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: accountsservice: passes (encrypted) passwords as commandline arguments
Date: Tue, 12 Aug 2014 12:06:03 +0200
Package: accountsservice
Version: 0.6.37-3
Severity: normal
Tags: security

Hi,

accountsservice passes (encrypted) passwords as command line arguments
to usermod:

+---
|         argv[0] = "/usr/sbin/usermod";
|         argv[1] = "-p";
|         argv[2] = strings[0];
+---[ src/user.c ]

Command line arguments, and thus the (encrypted) password, are by
default readable by every local user.

Please use some other means to set passwords that do not involve
passing them as command line arguments, for example by using chpasswd
which allows passing user name and password via stdin.

Ansgar



Added tag(s) upstream. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Fri, 15 Aug 2014 14:30:14 GMT) (full text, mbox, link).


Set Bug forwarded-to-address to 'https://bugs.freedesktop.org/show_bug.cgi?id=55000'. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Fri, 15 Aug 2014 14:45:07 GMT) (full text, mbox, link).


Changed Bug title to 'accountsservice: CVE-2012-6655: passes (encrypted) passwords as commandline arguments' from 'accountsservice: passes (encrypted) passwords as commandline arguments' Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Sat, 16 Aug 2014 09:27:11 GMT) (full text, mbox, link).


Marked as found in versions accountsservice/0.6.21-8. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Sun, 17 Aug 2014 09:15:04 GMT) (full text, mbox, link).


Added tag(s) fixed-upstream. Request was from debian-bts-link@lists.debian.org to control@bugs.debian.org. (Thu, 09 Aug 2018 17:27:16 GMT) (full text, mbox, link).


Changed Bug forwarded-to-address to 'https://gitlab.freedesktop.org/accountsservice/accountsservice/issues/8' from 'https://bugs.freedesktop.org/show_bug.cgi?id=55000'. Request was from John Scott <jscott@posteo.net> to control@bugs.debian.org. (Sun, 11 Nov 2018 21:06:06 GMT) (full text, mbox, link).


Removed tag(s) fixed-upstream. Request was from John Scott <jscott@posteo.net> to control@bugs.debian.org. (Sun, 11 Nov 2018 21:24:04 GMT) (full text, mbox, link).


Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Wed Jun 19 13:21:22 2019; Machine Name: buxtehude

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.