Sensitive data printed out

Function prints sensitive data

Description

This defect occurs when print functions such as stdout or stderr print sensitive information.

The checker considers the following as sensitive information:

• Return values of password manipulation functions such as getpw, getpwnam or getpwuid.

• Input values of functions such as the Windows^®-specific function LogonUser.

Risk

Printing sensitive information, such as passwords or user information, allows an attacker additional access to the information.

Fix

One fix for this defect is to not print out sensitive information.

If you are saving your logfile to an external file, set the file permissions so that attackers cannot access the logfile information.

Examples

Printing Passwords

#include <sys/types.h>
#include <pwd.h>
#include <stdio.h>
#include <string.h>
#include <unistd.h>

extern void verify_null(const char* buf);
void bug_sensitivedataprint(const char * my_user) {
    struct passwd* result, pwd;
    long bufsize = sysconf(_SC_GETPW_R_SIZE_MAX);
    char buf[1024] = "";
    getpwnam_r(my_user, &pwd, buf, bufsize, &result);
    puts("Name\n");
    puts(pwd.pw_name);
    puts("PassWord\n");
    puts(pwd.pw_passwd);
    memset(buf, 0, sizeof(buf));
    verify_null(buf);
}

In this example, Bug Finder flags puts for printing out the password pwd.pw_passwd.

Correction — Obfuscate the Password

One possible correction is to obfuscate the password information so that the information is not visible.

#include <sys/types.h>
#include <pwd.h>
#include <stdio.h>
#include <string.h>
#include <unistd.h>

extern void verify_null(const char* buf);

void sensitivedataprint(const char * my_user) {
    struct passwd* result, pwd;
    long bufsize = sysconf(_SC_GETPW_R_SIZE_MAX);
    char buf[1024] = "";
    getpwnam_r(my_user, &pwd, buf, bufsize, &result);
    puts("Name\n");
    puts(pwd.pw_name);
    puts("PassWord\n");
    puts("XXXXXXXX\n"); 
    memset(buf, 0, sizeof(buf));
    verify_null(buf);
}

Result Information

Group: Security

Language: C | C++

Default: Off

Command-Line Syntax: SENSITIVE_DATA_PRINT

Impact: Medium

CWE ID: 532, 534, 535