Created attachment 569 [details] Change start_pam(user) to start_pam(authctxt) Guilty. Slightly different patch attached. Note that this is a NULL pointer dereference and is *not* considered to be a security vulnerability.
Sigh. I had already written the following announcement when the bug was opened and I was just about to send it to openssh-unix-dev (which seems to be bouncing postings right now...) I'm sorry to report that there is a bug in the PAM code in OpenSSH 3.8p1, and sorrier to say that I put it there. This is a NULL pointer dereference and is *not* considered to be a security vulnerability. When sshd is configured --with-pam, run with UsePAM=yes, PasswordAuthentication=yes, and a user with an expired password successfully authenticates via password without trying keyboard-interactive first, sshd will attempt to dereference a NULL pointer and segfault. In such a case, the user's session will be immediately terminated. If UsePAM=no (the default), or UsePAM=yes and PasswordAuthentication=no (recomended in the sshd_config man page) then this problem will not occur. The attached patch fixes this. Please test it, we would like to release a 3.8p2 soon containing this and a few other fixes. My apologies to anyone inconvenienced by this.
if you don't authenticate via pam/keyboard-interactive, then when do_pam_account figures out your password is expired and calls pam_password_change_required, the latter will probably segfault when it dereferences the uninitialized int *force_pwchange. this is b/c, if you don't authenticate using the PRIVSEP(sshpam_device), sshpam_init_ctx is never called, so force_pwchange isn't properly initialized i'll attach a workaround patch, but not without serious misgivings about how crappy it is, so it won't hurt my feelings if you come up with a much better fix all in all, though, 3.8p1 does password-changing and chauthtok-ing much better than it's predecessor, so thanks again for the great work --buck
Created attachment 568 [details] referenced patch
A fix for this (id #596) has been committed, tomorrow's snapshot will have it. Please test it and re-open this bug if there are any problems with it.
This will be fixed in 3.8.1p1.
Closed with release of portable OpenSSH 3.8.1p1