3571e53040
patches for easier mirroring, to eliminate a special copy, to make www.freebsd.org/security a full copy of security.freebsd.org and be eventually be the same. For now files are just sitting there. The symlinks are missing. Discussed on: www (repository location) Discussed with: simon (so)
130 lines
4.5 KiB
Text
130 lines
4.5 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-01:42 Security Advisory
|
|
FreeBSD, Inc.
|
|
|
|
Topic: signal handling during exec may allow local root
|
|
compromise
|
|
|
|
Category: core
|
|
Module: kernel
|
|
Announced: 2001-07-10
|
|
Revised: 2001-08-06
|
|
Credits: Georgi Guninski <guninski@guninski.com>
|
|
Affects: All released versions of FreeBSD 4.x,
|
|
FreeBSD 4.3-STABLE prior to the correction date.
|
|
Corrected: 2001-07-09
|
|
FreeBSD only: Yes
|
|
|
|
0. Revision History
|
|
|
|
2001-07-10 v1.0 Initial release
|
|
2001-08-06 v1.1 Binary upgrade package available
|
|
|
|
I. Background
|
|
|
|
When a process forks, it inherits the parent's signals. When the
|
|
process execs, the kernel clears the signal handlers because they are
|
|
not valid in the new address space.
|
|
|
|
II. Problem Description
|
|
|
|
A flaw exists in FreeBSD signal handler clearing that would allow for
|
|
some signal handlers to remain in effect after the exec. Most of the
|
|
signals were cleared, but some signal hanlders were not. This allowed
|
|
an attacker to execute arbitrary code in the context of a setuid
|
|
binary.
|
|
|
|
All versions of 4.x prior to the correction date including and
|
|
4.3-RELEASE are vulnerable to this problem. The problem has been
|
|
corrected by copying the inherited signal handlers and resetting the
|
|
signals instead of sharing the signal handlers.
|
|
|
|
III. Impact
|
|
|
|
Local users may be able to gain increased privileges on the local
|
|
system.
|
|
|
|
IV. Workaround
|
|
|
|
Do not allow untrusted users to gain access to the local system.
|
|
|
|
V. Solution
|
|
|
|
One of the following:
|
|
|
|
1) Upgrade your vulnerable FreeBSD system to 4.3-STABLE after the
|
|
correction date.
|
|
|
|
2) To patch your present system: download the relevant patch from the
|
|
below location, and execute the following commands as root:
|
|
|
|
[FreeBSD 4.1, 4.2, and 4.3 base systems]
|
|
|
|
This patch has been verified to apply to FreeBSD 4.1, 4.2, and 4.3 only.
|
|
It may or may not apply to older releases.
|
|
|
|
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-01:42/signal-4.3.patch
|
|
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-01:42/signal-4.3.patch.asc
|
|
|
|
Verify the detached PGP signature using your PGP utility.
|
|
|
|
# cd /usr/src/sys/kern
|
|
# patch -p < /path/to/patch
|
|
|
|
[ Recompile your kernel as described in
|
|
http://www.freebsd.org/handbook/kernelconfig.html and reboot the
|
|
system ]
|
|
|
|
3) FreeBSD 4.3-RELEASE systems:
|
|
|
|
An experimental upgrade package is available for users who wish to
|
|
provide testing and feedback on the binary upgrade process. This
|
|
package may be installed on FreeBSD 4.3-RELEASE systems only, and is
|
|
intended for use on systems for which source patching is not practical
|
|
or convenient.
|
|
|
|
If you use the upgrade package, feedback (positive or negative) to
|
|
security-officer@FreeBSD.org is requested so we can improve the
|
|
process for future advisories.
|
|
|
|
Since this vulnerability involves the FreeBSD kernel which is often
|
|
locally customized on installed systems, a universal binary upgrade
|
|
package is not feasible. This package includes a patched version of
|
|
the GENERIC kernel which should be suitable for use on many systems.
|
|
Systems requiring a customized kernel must use an alternative
|
|
solution.
|
|
|
|
During the installation procedure, backup copies are made of the files
|
|
which are replaced by the package. These backup copies will be
|
|
reinstalled if the package is removed, reverting the system to a
|
|
pre-patched state.
|
|
|
|
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/packages/SA-01:42/security-patch-signal-01.42.tgz
|
|
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/packages/SA-01:42/security-patch-signal-01.42.tgz.asc
|
|
|
|
Verify the detached PGP signature using your PGP utility.
|
|
|
|
# pkg_add security-patch-signal-01.42.tgz
|
|
|
|
The new kernel is named /kernel.GENERIC to avoid conflict with the
|
|
default kernel name (``/kernel''). To cause the system to boot
|
|
automatically with the new kernel, add the following line to
|
|
/boot/loader.conf:
|
|
|
|
kernel="/kernel.GENERIC"
|
|
|
|
and reboot the system to load the new kernel. The old kernel is still
|
|
available and can be manually loaded in the boot loader in case of
|
|
problems.
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: GnuPG v1.0.6 (FreeBSD)
|
|
Comment: For info see http://www.gnupg.org
|
|
|
|
iQCVAwUBO28Pu1UuHi5z0oilAQHjeAQAmND4sSS6k1RHCz+uHSQb6hrX6vkKDr2M
|
|
/9EMf/S90WFwVfIi7ifEgeY3U6XJpRd2Bdx1rCPOCMdSYkehd+WqVM8ZSgHkbpAL
|
|
vrwS8KHrcC/G7KhCGzH5c6PjZYISdHXi4hWB9aV11zmmJZk3wL5GlIAaH8Dik403
|
|
w2SjxgHHM8w=
|
|
=qVIE
|
|
-----END PGP SIGNATURE-----
|