CVE-2004-2392

An attacker can cause a denial of service (crash or disk consumption) by triggering read failures in libuser. For example, if a read from /dev/urandom fails, the salt buffer is treated as valid and may be mostly zeros, weakening cryptographic operations. More critically, the read() return value is stored in an unsigned variable, so a failure returning -1 becomes 4294967295, causing write() to output that many bytes and exhaust disk space [ref_id=1]. The advisory notes these bugs were found during code review and the exact attack vectors are not fully specified.

The advisory [ref_id=1] identifies multiple programming bugs across libuser 0.51.7, including failures in reading config data, reading /dev/urandom for salt generation, unlock operations passing a structure by value to a variadic function, and read() return values stored in an unsigned variable that could cause massive writes. The patch also addresses NULL pointer passes to fclose() in many places.

The patch (applied in libuser-0.51.10-1) fixes each bug identified in the code review [ref_id=1]. It adds proper error checking after read() calls so that buffers are only used when reads succeed, changes the read return variable to a signed type so that -1 is not misinterpreted as a huge positive value, corrects the variadic function call to pass a pointer instead of a struct by value, and adds NULL checks before calling fclose(). The maintainer also fixed additional leaks and properly initialized struct lu_error with a message, and handled the other lu_make_crypted() call in modules/ldap.c to prevent empty passwords when /dev/urandom is unavailable [ref_id=1].