Home » File Formats » File_Passwd » Bug #3784

[2005-03-12 02:06 UTC] pear_php at ibink dot com

Description:
------------
strstr is used when looking for the password record of a particular user rather than a check that makes sure the user name is an exact match. As a result, you can be authenticated with a substring of your actual user name. In addition, if a users name is a substring of another user farther up in the password file, the will never be able to log in.

Reproduce code:
---------------
Case 1:
1) Add user 'billybob' to a password file
2) Authenticate 'billy' using the password for 'billybob'

Case 2:
1) Add user 'billy' to the same password file use in case 1 but with a different password.
2) Try to log in as 'billy'

The bug is in the _auth($file, $id) function inside /File/Passwd/Common.php....

while ($line = fgets($fh)) {
! if (strstr($line, $id)) {
File_Passwd_Common::_close($fh);
return trim($line);
}
}

Should be:

while ($line = fgets($fh)) {
! if (preg_match("/^$id:/", $line)) {
File_Passwd_Common::_close($fh);
return trim($line);
}
}

Expected result:
----------------
Case 1:
* You should not be able to log in as 'billy'

Case 2:
* You should be able to log in as 'billy'

Actual result:
--------------
use of strstr hides 'billy' record and allows for false logins.