0001250: Authentication bypass in Director when allowing client and director initiated connections

ID	Project	Category	View Status	Date Submitted	Last Update

0001250	bareos-core	General	public	2020-06-09 15:47	2020-07-09 22:46

Reporter	arogge	Assigned To	franku
Priority	normal	Severity	major	Reproducibility	always
Status	closed	Resolution	fixed
Fixed in Version	19.2.9

Summary	0001250: Authentication bypass in Director when allowing client and director initiated connections
Description	Bareos allows a malicious client to communicate with the director without knowledge of the shared secret if the director allows client initiated connection and connects to the client itself. The malicious client can replay the Bareos director's cram-md5 challenge to the director itself leading to the director responding to the replayed challenge. The response obtained is then a valid reply to the directors original challenge.
Additional Information	See also: https://github.com/bareos/bareos/security/advisories/GHSA-vqpj-2vhj-h752
Tags	No tags attached.

bareos: master 93f2db64 2020-06-07 19:32 franku Ported: N/A Details Diff	cram-md5: do not accept challenge if own resource name is used Fixes 0001250: Authentication bypass in Director use the unified-resource-name for the cram challenge i.e. auth cram-md5 <1001326377.1591525437@R_CLIENT::backup-bareos-test-fd>	Affected Issues 0001250
	mod - core/src/lib/cram_md5.cc	Diff File
	mod - core/src/lib/cram_md5.h	Diff File
	mod - core/src/lib/util.cc	Diff File
	mod - core/src/lib/util.h	Diff File
	mod - core/src/tests/bsock_test_connection_setup.cc	Diff File
bareos: bareos-19.2 27ed33ed 2020-06-07 19:32 franku Ported: N/A Details Diff	cram-md5: do not accept challenge if own resource name is used Fixes 0001250: Authentication bypass in Director use the unified-resource-name for the cram challenge i.e. auth cram-md5 <1001326377.1591525437@R_CLIENT::backup-bareos-test-fd>	Affected Issues 0001250
	mod - core/src/lib/cram_md5.cc	Diff File
	mod - core/src/lib/cram_md5.h	Diff File
	mod - core/src/lib/util.cc	Diff File
	mod - core/src/lib/util.h	Diff File
	mod - core/src/tests/bsock_test_connection_setup.cc	Diff File

Date Modified	Username	Field	Change
2020-06-09 15:47	arogge	New Issue
2020-06-09 17:33	arogge	Assigned To	=> franku
2020-06-09 17:33	arogge	Status	new => assigned
2020-06-09 17:33	arogge	Status	assigned => confirmed
2020-07-01 14:22	franku	Changeset attached	=> bareos master 93f2db64
2020-07-01 14:22	franku	Note Added: 0004017
2020-07-01 14:22	franku	Status	confirmed => resolved
2020-07-01 14:22	franku	Resolution	open => fixed
2020-07-01 15:22	franku	Changeset attached	=> bareos bareos-19.2 27ed33ed
2020-07-01 15:22	franku	Note Added: 0004018
2020-07-08 11:21	arogge	Relationship added	related to 0001230
2020-07-09 22:45	arogge	Status	resolved => new
2020-07-09 22:45	arogge	Resolution	fixed => reopened
2020-07-09 22:46	arogge	Status	new => closed
2020-07-09 22:46	arogge	Resolution	reopened => fixed
2020-07-09 22:46	arogge	Fixed in Version	=> 19.2.9
2020-07-09 22:46	arogge	View Status	private => public

franku 2020-07-01 14:22 administrator ~0004017	Fix committed to bareos master branch with changesetid 13503.

franku 2020-07-01 15:22 administrator ~0004018	Fix committed to bareos bareos-19.2 branch with changesetid 13522.