uw-imap: authentication bypass

Posted Feb 3, 2005 6:29 UTC (Thu) by bradfitz (subscriber, #4378) [Link]

-static int md5try = 3;
+static int md5try = MAXLOGINTRIALS;

char *auth_md5_server (authresponse_t responder,int argc,char *argv[])
{
@@ -153,7 +153,7 @@
/* get password */
if (p = auth_md5_pwd ((authuser && *authuser) ? authuser : user)) {
pl = strlen (p);
- u = (md5try && strcmp (hash,hmac_md5 (chal,cl,p,pl))) ? NIL : user;
+ u = (md5try && !strcmp (hash,hmac_md5 (chal,cl,p,pl))) ? user : NIL;
memset (p,0,pl); /* erase sensitive information */
fs_give ((void **) &p); /* flush erased password */
/* now log in for real */
...
if(...) {
md5try--
}

Before the logic looks like:

If (you have login attempts remaining AND your password is wrong), THEN treat as no user, ELSE load your user.

So the way you beat it was by using up all your login attempts, and then the last one would work.