Bug 140451 (IT_53724) - passwd segfaults with certain UIDs
Summary: passwd segfaults with certain UIDs
Alias: IT_53724
Product: Red Hat Enterprise Linux 4
Classification: Red Hat
Component: pam
Version: 4.0
Hardware: All
OS: Linux
Target Milestone: ---
: ---
Assignee: Tomas Mraz
QA Contact: David Lawrence
Depends On:
Blocks: 137160
TreeView+ depends on / blocked
Reported: 2004-11-22 22:09 UTC by Johnray Fuller
Modified: 2007-11-30 22:07 UTC (History)
2 users (show)

Clone Of:
Last Closed: 2005-06-09 10:29:11 UTC

Attachments (Terms of Use)
Attaching strace of failure... (18.76 KB, text/plain)
2004-11-22 22:18 UTC, Johnray Fuller
no flags Details

External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2005:091 normal SHIPPED_LIVE pam bug fix update 2005-06-08 04:00:00 UTC

Description Johnray Fuller 2004-11-22 22:09:23 UTC
Description of problem:

For some reason when I have a brand new minimal rhel4 system
installed, if I manually add a user with the following /etc/passwd entry:
and have /etc/shadow set to:

Trying to run passwd as root for this user generates a segfault.

Adding the user "test" with uid "02070" doesn't seem to cause this

Version-Release number of selected component (if applicable):


Comment 2 Johnray Fuller 2004-11-22 22:18:29 UTC
Created attachment 107251 [details]
Attaching strace of failure...

strace of the following command:

passwd juan


Comment 3 Johnray Fuller 2004-11-22 22:20:10 UTC
This is from Beta I.


Comment 4 Jindrich Novy 2004-11-23 08:53:26 UTC
Hello Johnray,

I was able to reproduce the bug. The SIGSEGV occurs when passwd calls
pam_sm_chauthtok() from pam_unix.so module. Thus the bug is likely not
in passwd but pam.

Reassigning to pam.

Comment 5 Tomas Mraz 2004-11-23 10:15:35 UTC
This is a bug in parsing passwd file entry in pam_unix module. It
parses the numbers as octals if they begin with 0.

Workaround is to remove the leading 0 in the line:

Comment 17 Jay Turner 2005-04-05 11:07:13 UTC
All is well with pam-0.77-66.4 which is included in the U1-candidate trees. 
Moving to PROD_READY.

Comment 18 Tim Powers 2005-06-09 10:29:11 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.


Note You need to log in before you can comment on or make changes to this bug.