Linux OpenExchange - cleartext rootpw in swap

[Rene]

date: 31.08.2004
author: l0om - l0om [at] excluded dot org - www.excluded.org
discovered in: SuSE Linux Openexchange Server 4
problem: cleartext rootpw in swap caused by fergotten "mlock" or wiping out memory


hi,

i have noticed my root password flying around on my swap in cleartext.
an attacker who has successfully rooted a box can get the cleartext password from the swap device.

i dont know if this is caused by some SuSE mistake at the web login- maybe its a fault in openldap.
i dont know exactly where this is caused.



ro~ # strings swap -5 | grep GroupwareDBport -A 2| grep -A 2 loginDestination
loginDestination
MYROOTCLEARTEXT_PASSWORD
--
--
loginDestination
MYROOTCLEARTEXT_PASSWORD
--
--
loginDestination
MYROOTCLEARTEXT_PASSWORD
[...]


i also had success in getting my cleartext password with

ro~ # strings swap -5 | grep /etc/postfix/main.cf -A 2
/etc/postfix/main.cf
MYROOTCLEARTEXT_PASSWORD
erfolgreich
--
/etc/postfix/main.cf
MYROOTCLEARTEXT_PASSWORD
SIEVEpor
[...]


however- such things can be prevented with wiping out the memory where the
password was stored or with using mlock.


greets @ murfie, johnny, klouw, (other google masters ;])
maximilian, and the guys from excluded.org

[Rainer Duffner]

On Di, 31.08.2004, 10:11, Rene sagte:
>
>
> date: 31.08.2004
> author: l0om - l0om [at] excluded dot org - www.excluded.org
> discovered in: SuSE Linux Openexchange Server 4
> problem: cleartext rootpw in swap caused by fergotten "mlock" or wiping
> out memory
>
>
> hi,
>
> i have noticed my root password flying around on my swap in cleartext.
> an attacker who has successfully rooted a box can get the cleartext
> password from the swap device.
>
> i dont know if this is caused by some SuSE mistake at the web login- maybe
> its a fault in openldap.
> i dont know exactly where this is caused.
>

Well, if the server is "rooted", as you like to put it, there's little
point in gaining the root-password anyway, isn't it ?
You can do pretty much everything, except login as the administrator-user
via the web-interface. Being able to scratch the root-pw out of swap is
just a bonus, if you ask me.

It would be bad, if a non-priviledged user had access to the swap-partition.
On the two SLOXs I have access to, the swap-partition is only
group-readable by the "disk" group.
Or is there some other way of reading the swap-partition ?

If not, this is not a big concern to me (and we run and support some of
these for various customers).

If, OTOH, you had talked about the empty password for the SLOX'
postgres-database.... that would be something completely different (TM).




cheers,
Rainer

[Valdis.Kletnieks@vt.edu]

--==_Exmh_616922166P
Content-Type: text/plain; charset=us-ascii

On Tue, 31 Aug 2004 20:48:50 +0200, Rainer Duffner said:

> It would be bad, if a non-priviledged user had access to the swap-partition.
> On the two SLOXs I have access to, the swap-partition is only
> group-readable by the "disk" group.

At which point, if you can get access to group "disk", you have probably 0wned
the box completely. So there *is* a privilege escalation issue there.....

--==_Exmh_616922166P
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)
Comment: Exmh version 2.5 07/13/2001

iD8DBQFBN1dRcC3lWbTT17ARAoQPAKC7CiWYpGj7Faqg6K24ov OuK8JpMACgl5NW
Fp4YWbAbtqhZoAv64N0jVwU=
=cB1Z
-----END PGP SIGNATURE-----

--==_Exmh_616922166P--