CVE-2008-5103

Root password bypass in VMBuilder 0.9

• CVSS 7.2
• CWE-255
• Authentication, Authorization, and Session Management
• Local

The (1) python-vm-builder and (2) ubuntu-vm-builder implementations in VMBuilder 0.9 in Ubuntu 8.10 omit the -e option when invoking chpasswd with a root:! argument, which configures the root account with a cleartext password of ! (exclamation point) and allows attackers to bypass intended login restrictions.

CVE

CVE-2008-5103

CWE

CWE-255

CVSS base score

7.2

Published

2008-11-17

OWASP

A07 Identification and Authentication Failures

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Authentication, Authorization, and Session Management

Subcategory

Insecure Authentication Mechanisms

Accessibility scope

Local

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update VMBuilder to version 0.9.13 or higher.

import subprocess

def chpasswd(username, password):
    """Vulnerable function that demonstrates the security issue."""
    command = f"echo '{username}:{password}' | chpasswd"
    subprocess.run(command, shell=True, check=True)

chpasswd('root', '!')

import subprocess

def chpasswd(username, password):
    """Secure function that fixes the vulnerability."""
    if any(char in username for char in [';', '&', '|', '`', '>', '<', '$']):
        raise ValueError("Invalid characters in username")
    if any(char in password for char in [';', '&', '|', '`', '>', '<', '$']):
        raise ValueError("Invalid characters in password")

    command = ['chpasswd']
    process = subprocess.run(command, input=f'{username}:{password}\n', text=True, check=True)

chpasswd('root', '!')

@misc{vaitp:cve20085103,
  title        = {{Root password bypass in VMBuilder 0.9}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2008},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2008-5103},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2008-5103/}}
}