edit others user crontab, security bug

[Damian Weber]

On Thu, 1 Sep 2016, Edho Arief wrote:

> Date: Thu, 1 Sep 2016 15:43:58
> From: Edho Arief <me at myconan.net>
> To: freebsd-security at freebsd.org
> Subject: Re: edit others user crontab, security bug
> 
> Hi,
> 
> On Thu, Sep 1, 2016, at 21:47, Andrii Kuzik wrote:
> > Probably a lot of freebsd servers affected
> > 
> > Security bug allows to edit other users crontab
> > 
> > root# pw useradd -n www.promspecbud.com  -g nobody -s /bin/sh -d /tmp
> > root# pw useradd -n www.promspecbud.com.other -g nobody -s /bin/sh -d
> > /tmp
> > root# echo @daily doit baby > /tmp/test
> > root# crontab -u www.promspecbud.com.other /tmp/test
> > root# crontab -u www.promspecbud.com -l
> > 
> > =====output =====
> > @daily doit baby
> > =================
> > 
> > root#echo @daily doit baby one more time>> /tmp/test
> > root#sudo -u www.promspecbud.com.other crontab /tmp/test
> > root#sudo -u www.promspecbud.com crontab -l
> > =====output =====
> > @daily doit baby
> > @daily doit baby one more time
> > =================
> > 
> 
> 
> to be more specific, the bug is crontab truncates usernames to 19
> characters as defined in cron.h:
> 
> #define MAX_UNAME       20      /* max length of username, should be
> overkill */
> 
> 
> # pw useradd users12345names67890
> # crontab -u users12345names67890 -l
> crontab: no crontab for users12345names6789
>                                           ^-- cut off

apart from the crontab user length there seem to be quite a 
lot of possible values to choose from (MAXLOGNAME being the
FreeBSD standard, right?)

$ cd /usr/include
$ egrep "^#define.*(USER|LOG)" */*h *.h| grep MAX |grep NAME
bsm/libbsm.h:#define    AU_USER_NAME_MAX        50
netsmb/smb.h:#define SMB_MAXUSERNAMELEN 128
sys/param.h:#define     MAXLOGNAME      33              /* max login name length
 (incl. NUL) */
 sys/sysctl.h:#define    USER_TZNAME_MAX         20      /* int: POSIX2_TZNAME_MA
 X */
 limits.h:#define        _POSIX_LOGIN_NAME_MAX   9
 stdio.h:#define L_cuserid       17      /* size for cuserid(3); MAXLOGNAME, lega
 cy */
 unistd.h:#define        _SC_LOGIN_NAME_MAX      73


--
Damian Weber