Bug 10441 - accidental full text password expose to local users possible
Summary: accidental full text password expose to local users possible
Status: NEW
Alias: None
Product: Busybox
Classification: Unclassified
Component: Other (show other bugs)
Version: 1.26.x
Hardware: All Linux
: P5 normal
Target Milestone: ---
Assignee: unassigned
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-10-22 16:17 UTC by surae
Modified: 2017-10-22 16:36 UTC (History)
2 users (show)

See Also:
Host:
Target:
Build:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description surae 2017-10-22 16:17:39 UTC
busybox's getty takes supplies typed username as arg to busibox's login process, which itself asks for username again in case of auth failure, for 3 times! Then if username typed first was erroneus it is kept for the session time

root      2170  0.0  0.0   1528     4 tty1     Ss   16:04   0:00 /bin/login -- adsfasdfasdf

Once I've accidentally typed password instead of login on console getty prompt it exposes my whole password to local users for entire session period!

It is bad for security!

Should we remove username prompt from login.c, or make it check if username supplied by getty was non-existent?
Comment 1 surae 2017-10-22 16:36:56 UTC
loginutils/login.c:522:
...
auth_failed:                                                                 
                opt &= ~LOGIN_OPT_f;                                          
                bb_do_delay(LOGIN_FAIL_DELAY);                                      
                /* TODO: doesn't sound like correct English phrase to me */   
                puts("Login incorrect");                                           
                if (++count == 3) {                                            
                        syslog(LOG_WARNING, "invalid password for '%s'%s",          
                                                username, fromhost);            
                                                                                   
                        if (ENABLE_FEATURE_CLEAN_UP)                          
                                free(fromhost);                               
                                                                              
                        return EXIT_FAILURE;                                  
                }                                                             
                username[0] = '\0';                                                 
        } /* while (1) */               
...

I guess, where is no sense in "if (++count == 3) { " on string 527. It saves no resource and used extrimely rare, afaik.