[Pkg-shadow-devel] Bug#495831: Entering non-existant username at login prompt causes error message

[Tim Rørstrøm]

Package: login
Version: 1:4.1.1-3
Severity: grave
Tags: security
Justification: user security hole

At the console login prompt, entering a username which does not exist on the system, will immediately show an error message, thus revealing that the username is in fact non-existant on the system. This dramatically reduces the time it would take to brute-force your way into a user's account.

-- System Information:
Debian Release: lenny/sid
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: i386 (i686)

Kernel: Linux 2.6.26.2-core2 (SMP w/2 CPU cores)
Locale: LANG=en_DK.UTF-8, LC_CTYPE=en_DK.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash

Versions of packages login depends on:
ii  libc6                         2.7-13     GNU C Library: Shared libraries
ii  libpam-modules                1.0.1-2    Pluggable Authentication Modules f
ii  libpam-runtime                1.0.1-2    Runtime support for the PAM librar
ii  libpam0g                      1.0.1-2    Pluggable Authentication Modules l

login recommends no packages.

login suggests no packages.

-- no debconf information