3571e53040
patches for easier mirroring, to eliminate a special copy, to make www.freebsd.org/security a full copy of security.freebsd.org and be eventually be the same. For now files are just sitting there. The symlinks are missing. Discussed on: www (repository location) Discussed with: simon (so)
145 lines
5.6 KiB
Text
145 lines
5.6 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
Hash: SHA1
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-09:16.rtld Security Advisory
|
|
The FreeBSD Project
|
|
|
|
Topic: Improper environment sanitization in rtld(1)
|
|
|
|
Category: core
|
|
Module: rtld
|
|
Announced: 2009-12-03
|
|
Affects: FreeBSD 7.0 and later.
|
|
Corrected: 2009-12-01 02:59:22 UTC (RELENG_8, 8.0-STABLE)
|
|
2009-12-03 09:18:40 UTC (RELENG_8_0, 8.0-RELEASE-p1)
|
|
2009-12-01 03:00:16 UTC (RELENG_7, 7.2-STABLE)
|
|
2009-12-03 09:18:40 UTC (RELENG_7_2, 7.2-RELEASE-p5)
|
|
2009-12-03 09:18:40 UTC (RELENG_7_1, 7.1-RELEASE-p9)
|
|
CVE Name: CVE-2009-4146, CVE-2009-4147
|
|
|
|
For general information regarding FreeBSD Security Advisories,
|
|
including descriptions of the fields above, security branches, and the
|
|
following sections, please visit <URL:http://security.FreeBSD.org/>.
|
|
|
|
I. Background
|
|
|
|
The run-time link-editor, rtld, links dynamic executable with their
|
|
needed libraries at run-time. It also allows users to explicitly
|
|
load libraries via various LD_ environmental variables.
|
|
|
|
II. Problem Description
|
|
|
|
When running setuid programs rtld will normally remove potentially
|
|
dangerous environment variables. Due to recent changes in FreeBSD
|
|
environment variable handling code, a corrupt environment may
|
|
result in attempts to unset environment variables failing.
|
|
|
|
III. Impact
|
|
|
|
An unprivileged user who can execute programs on a system can gain
|
|
the privileges of any setuid program which he can run. On most
|
|
systems configurations, this will allow a local attacker to execute
|
|
code as the root user.
|
|
|
|
IV. Workaround
|
|
|
|
No workaround is available, but systems without untrusted local users,
|
|
where all the untrusted local users are jailed superusers, and/or where
|
|
untrusted users cannot execute arbitrary code (e.g., due to use of read
|
|
only and noexec mount options) are not affected.
|
|
|
|
Note that "untrusted local users" include users with the ability to
|
|
upload and execute web scripts (CGI, PHP, Python, Perl etc.), as they
|
|
may be able to exploit this issue.
|
|
|
|
V. Solution
|
|
|
|
Perform one of the following:
|
|
|
|
1) Upgrade your vulnerable system to 7-STABLE or 8-STABLE,
|
|
or to the RELENG_8_0, RELENG_7_2, or RELENG_7_1 security branch dated
|
|
after the correction date.
|
|
|
|
2) To patch your present system:
|
|
|
|
The following patches have been verified to apply to FreeBSD 7.1, 7.2,
|
|
and 8.0 systems.
|
|
|
|
a) Download the relevant patch from the location below, and verify the
|
|
detached PGP signature using your PGP utility.
|
|
|
|
[FreeBSD 7.x]
|
|
# fetch http://security.FreeBSD.org/patches/SA-09:16/rtld7.patch
|
|
# fetch http://security.FreeBSD.org/patches/SA-09:16/rtld7.patch.asc
|
|
|
|
[FreeBSD 8.0]
|
|
# fetch http://security.FreeBSD.org/patches/SA-09:16/rtld.patch
|
|
# fetch http://security.FreeBSD.org/patches/SA-09:16/rtld.patch.asc
|
|
|
|
b) Execute the following commands as root:
|
|
|
|
# cd /usr/src
|
|
# patch < /path/to/patch
|
|
# cd /usr/src/libexec/rtld-elf
|
|
# make obj && make depend && make && make install
|
|
|
|
NOTE: On the amd64 platform, the above procedure will not update the
|
|
ld-elf32.so.1 (i386 compatibility) run-time link-editor (rtld). On
|
|
amd64 systems where the i386 rtld are installed, the operating system
|
|
should instead be recompiled as described in
|
|
<URL:http://www.FreeBSD.org/handbook/makeworld.html>
|
|
|
|
VI. Correction details
|
|
|
|
The following list contains the revision numbers of each file that was
|
|
corrected in FreeBSD.
|
|
|
|
CVS:
|
|
|
|
Branch Revision
|
|
Path
|
|
- -------------------------------------------------------------------------
|
|
RELENG_7
|
|
src/libexec/rtld-elf/rtld.c 1.124.2.7
|
|
RELENG_7_2
|
|
src/UPDATING 1.507.2.23.2.8
|
|
src/sys/conf/newvers.sh 1.72.2.11.2.9
|
|
src/libexec/rtld-elf/rtld.c 1.124.2.4.2.2
|
|
RELENG_7_1
|
|
src/UPDATING 1.507.2.13.2.12
|
|
src/sys/conf/newvers.sh 1.72.2.9.2.13
|
|
src/libexec/rtld-elf/rtld.c 1.124.2.3.2.2
|
|
RELENG_8
|
|
src/libexec/rtld-elf/rtld.c 1.139.2.4
|
|
RELENG_8_0
|
|
src/UPDATING 1.632.2.7.2.4
|
|
src/sys/conf/newvers.sh 1.83.2.6.2.4
|
|
src/libexec/rtld-elf/rtld.c 1.139.2.2.2.2
|
|
- -------------------------------------------------------------------------
|
|
|
|
Subversion:
|
|
|
|
Branch/path Revision
|
|
- -------------------------------------------------------------------------
|
|
stable/7/ r199981
|
|
releng/7.2/ r200054
|
|
releng/7.1/ r200054
|
|
stable/8/ r199980
|
|
releng/8.0/ r200054
|
|
- -------------------------------------------------------------------------
|
|
|
|
VII. References
|
|
|
|
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4146
|
|
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4147
|
|
|
|
The latest revision of this advisory is available at
|
|
http://security.FreeBSD.org/advisories/FreeBSD-SA-09:16.rtld.asc
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: GnuPG v1.4.10 (FreeBSD)
|
|
|
|
iEUEARECAAYFAksXg/IACgkQFdaIBMps37KrLwCdH4JsCrvdS1RGoGj7MlNgV3+/
|
|
nhYAliVcz9tL8Ll6pYKpIalR740sZ5s=
|
|
=jK/a
|
|
-----END PGP SIGNATURE-----
|