diff options
author | Colin Watson <cjwatson@debian.org> | 2004-11-28 17:59:30 +0000 |
---|---|---|
committer | Colin Watson <cjwatson@debian.org> | 2004-11-28 17:59:30 +0000 |
commit | 1153b38f4612d93ca7f8dfa6756d6ed64338b281 (patch) | |
tree | da18bcd670178ec2edd1b4b221a0f72f7eb76e76 /auth2-chall.c | |
parent | c4945711e5b64f37ab1f5bb4538fd74595820edf (diff) |
Merge from HEAD:
Fix timing information leak allowing discovery of invalid usernames in PAM
keyboard-interactive authentication (backported from a patch by Darren
Tucker; closes: #281595).
Diffstat (limited to 'auth2-chall.c')
-rw-r--r-- | auth2-chall.c | 11 |
1 files changed, 4 insertions, 7 deletions
diff --git a/auth2-chall.c b/auth2-chall.c index aacbf0bcc..0f08b05c6 100644 --- a/auth2-chall.c +++ b/auth2-chall.c | |||
@@ -275,12 +275,9 @@ input_userauth_info_response(int type, u_int32_t seq, void *ctxt) | |||
275 | } | 275 | } |
276 | packet_check_eom(); | 276 | packet_check_eom(); |
277 | 277 | ||
278 | if (authctxt->valid) { | 278 | res = kbdintctxt->device->respond(kbdintctxt->ctxt, nresp, response); |
279 | res = kbdintctxt->device->respond(kbdintctxt->ctxt, | 279 | if (!authctxt->valid) |
280 | nresp, response); | 280 | res = 1; /* keep going if login invalid */ |
281 | } else { | ||
282 | res = -1; | ||
283 | } | ||
284 | 281 | ||
285 | for (i = 0; i < nresp; i++) { | 282 | for (i = 0; i < nresp; i++) { |
286 | memset(response[i], 'r', strlen(response[i])); | 283 | memset(response[i], 'r', strlen(response[i])); |
@@ -292,7 +289,7 @@ input_userauth_info_response(int type, u_int32_t seq, void *ctxt) | |||
292 | switch (res) { | 289 | switch (res) { |
293 | case 0: | 290 | case 0: |
294 | /* Success! */ | 291 | /* Success! */ |
295 | authenticated = 1; | 292 | authenticated = authctxt->valid ? 1 : 0; |
296 | break; | 293 | break; |
297 | case 1: | 294 | case 1: |
298 | /* Authentication needs further interaction */ | 295 | /* Authentication needs further interaction */ |