74 lines
3.7 KiB
Diff
74 lines
3.7 KiB
Diff
# UNDF: UNDF-2026-000001180
|
|
# UNDF: UNDF-2026-XXXXXXXXX
|
|
--- a/yabause/src/netlink.c
|
|
+++ b/yabause/src/netlink.c
|
|
@@ -579,10 +579,11 @@ static void NetlinkWriteByte(u32 addr, u8 val)
|
|
else if (NetlinkArea->connectstatus == NL_CONNECTSTATUS_LOGIN1 &&
|
|
NetlinkArea->modemstate == NL_MODEMSTATE_DATA &&
|
|
val == 0x0D)
|
|
{
|
|
// Internet login name
|
|
NetlinkArea->connectstatus = NL_CONNECTSTATUS_LOGIN2;
|
|
- NETLINK_LOG("login response: %s", NetlinkArea->inbuffer+NetlinkArea->inbufferstart);
|
|
+ /* Do not log the login name verbatim — credentials in cleartext (CWE-312). */
|
|
+ NETLINK_LOG("login response: [REDACTED %d bytes]", (int)strlen(NetlinkArea->inbuffer+NetlinkArea->inbufferstart));
|
|
NetlinkDoATResponse("\r\npassword:");
|
|
NetlinkUpdateReceivedDataInt();
|
|
}
|
|
@@ -588,8 +589,9 @@ static void NetlinkWriteByte(u32 addr, u8 val)
|
|
else if (NetlinkArea->connectstatus == NL_CONNECTSTATUS_LOGIN2 &&
|
|
NetlinkArea->modemstate == NL_MODEMSTATE_DATA &&
|
|
val == 0x0D)
|
|
{
|
|
// Internet password
|
|
NetlinkArea->connectstatus = NL_CONNECTSTATUS_LOGIN3;
|
|
- NETLINK_LOG("password response: %s", NetlinkArea->inbuffer+NetlinkArea->inbufferstart);
|
|
+ /* Do not log the password verbatim — credentials in cleartext (CWE-312). */
|
|
+ NETLINK_LOG("password response: [REDACTED %d bytes]", (int)strlen(NetlinkArea->inbuffer+NetlinkArea->inbufferstart));
|
|
NetlinkDoATResponse("\r\n$");
|
|
NetlinkUpdateReceivedDataInt();
|
|
}
|
|
|
|
# Defect: yabause-0001
|
|
# MOAD: 0004 (CWE-312 — Cleartext Storage of Sensitive Information)
|
|
# File: yabause/src/netlink.c
|
|
# Function: NetlinkWriteByte
|
|
# Lines: 582, 592
|
|
#
|
|
# Description:
|
|
# The Sega Saturn NetLink modem emulation (yabause/src/netlink.c) handles
|
|
# Saturn online dial-up sessions. During the PPP/shell login handshake the
|
|
# emulator exchanges a username and password with the remote server on behalf
|
|
# of the emulated Saturn game.
|
|
#
|
|
# When NETLINK_DEBUG is defined at compile time, two NETLINK_LOG calls write
|
|
# the authentication credentials verbatim into the debug log:
|
|
#
|
|
# Line 582: NETLINK_LOG("login response: %s", inbuffer+inbufferstart)
|
|
# -- logs the Saturn internet login name as a cleartext string
|
|
#
|
|
# Line 592: NETLINK_LOG("password response: %s", inbuffer+inbufferstart)
|
|
# -- logs the Saturn internet password as a cleartext string
|
|
#
|
|
# NETLINK_LOG expands to DebugPrintf(MainLog, ...) which writes to MainLog
|
|
# (a persistent file-backed debug log, see debug.h). Any log file or terminal
|
|
# session that captures NETLINK_DEBUG output will contain the plaintext
|
|
# username and password used to authenticate the Saturn session.
|
|
#
|
|
# Severity: MEDIUM
|
|
# - Requires NETLINK_DEBUG compile-time flag (debug/developer builds)
|
|
# - Exposes Saturn internet credentials (ISP username + password) in cleartext
|
|
# - Credentials could authenticate a real ISP account if a user tests with
|
|
# real legacy credentials (e.g. Sega Net, NetLink ISP accounts)
|
|
# - Log files written to disk may persist and be included in crash reports
|
|
#
|
|
# Fix:
|
|
# Replace the verbatim credential string with a redacted placeholder that
|
|
# preserves the diagnostic byte-count without exposing credential content.
|
|
# The fix applies to both the login name log (line 582) and the password
|
|
# log (line 592).
|
|
#
|
|
# References:
|
|
# - CWE-312: Cleartext Storage of Sensitive Information
|
|
# - NETLINK_LOG macro: yabause/src/debug.h line 65
|
|
# - NL_CONNECTSTATUS states: yabause/src/netlink.h lines 45-47
|