3571e53040
patches for easier mirroring, to eliminate a special copy, to make www.freebsd.org/security a full copy of security.freebsd.org and be eventually be the same. For now files are just sitting there. The symlinks are missing. Discussed on: www (repository location) Discussed with: simon (so)
163 lines
6.2 KiB
Text
163 lines
6.2 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-01:57 Security Advisory
|
|
FreeBSD, Inc.
|
|
|
|
Topic: sendmail contains local root vulnerability [REVISED]
|
|
|
|
Category: core
|
|
Module: sendmail
|
|
Announced: 2001-08-27
|
|
Revised: 2001-08-30
|
|
Credits: Cade Cairnss <cairnsc@securityfocus.com>
|
|
Affects: FreeBSD 4-STABLE after August 27, 2000 and prior to
|
|
the correction date, FreeBSD 4.1.1-RELEASE,
|
|
4.2-RELEASE, 4.3-RELEASE
|
|
Corrected: 2001-08-21 01:36:37 UTC (FreeBSD 4.3-STABLE)
|
|
2001-08-22 05:34:11 UTC (RELENG_4_3)
|
|
FreeBSD only: NO
|
|
|
|
0. Revision History
|
|
|
|
v1.0 2001-08-27 Initial release
|
|
v1.1 2001-08-30 Update package to remove setuid bit from saved file;
|
|
add non-openssl package; correct typo in package
|
|
instructions; note that $Id: FreeBSD-SA-01:57.sendmail.asc,v 1.2 2001/09/06 21:05:35 kris Exp $ not updated in
|
|
RELENG_4_3.
|
|
|
|
I. Background
|
|
|
|
sendmail is a mail transfer agent.
|
|
|
|
II. Problem Description
|
|
|
|
Sendmail contains an input validation error which may lead to the
|
|
execution of arbitrary code with elevated privileges by local users.
|
|
Due to the improper use of signed integers in code responsible for the
|
|
processing of debugging arguments, a local user may be able to supply
|
|
the signed integer equivalent of a negative value supplied to
|
|
sendmail's "trace vector". This may allow a local user to write data
|
|
anywhere within a certain range of locations in process memory.
|
|
Because the '-d' command-line switch is processed before the program
|
|
drops its elevated privileges, the attacker may be able to cause
|
|
arbitrary code to be executed with root privileges.
|
|
|
|
III. Impact
|
|
|
|
Local users may be able to execute arbitrary code with root privileges.
|
|
|
|
IV. Workaround
|
|
|
|
Do not allow untrusted users to execute the sendmail binary.
|
|
|
|
V. Solution
|
|
|
|
One of the following:
|
|
|
|
1) Upgrade your vulnerable FreeBSD system to 4.3-STABLE or the
|
|
RELENG_4_3 security branch after the respective correction dates.
|
|
|
|
2) FreeBSD 4.x systems after August 27, 2000 and prior to the
|
|
correction date:
|
|
|
|
The following patch has been verified to apply to FreeBSD
|
|
4.1.1-RELEASE, 4.2-RELEASE, 4.3-RELEASE and 4-STABLE dated prior to
|
|
the correction date.
|
|
|
|
Download the patch and the detached PGP signature from the following
|
|
locations, and verify the signature using your PGP utility.
|
|
|
|
# fetch ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-01:57/sendmail.patch
|
|
# fetch ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-01:57/sendmail.patch.asc
|
|
|
|
Execute the following commands as root:
|
|
|
|
# cd /usr/src
|
|
# patch -p < /path/to/patch
|
|
# cd /usr/src/lib/libsmutil
|
|
# make depend && make all
|
|
# cd /usr/src/usr.sbin/sendmail
|
|
# make depend && make all install
|
|
|
|
3) FreeBSD 4.3-RELEASE systems:
|
|
|
|
** NOTE: The initial version of the upgrade package did not remove
|
|
** setuid root privileges from the saved copy of the sendmail binary.
|
|
** To correct this, deinstall the old package using the pkg_delete(1)
|
|
** command and install the corrected package as described below.
|
|
|
|
An experimental upgrade package is available for users who wish to
|
|
provide testing and feedback on the binary upgrade process. This
|
|
package may be installed on FreeBSD 4.3-RELEASE systems only, and is
|
|
intended for use on systems for which source patching is not practical
|
|
or convenient.
|
|
|
|
If you use the upgrade package, feedback (positive or negative) to
|
|
security-officer@FreeBSD.org is requested so we can improve the
|
|
process for future advisories.
|
|
|
|
During the installation procedure, backup copies are made of the
|
|
files which are replaced by the package. These backup copies will
|
|
be reinstalled if the package is removed, reverting the system to a
|
|
pre-patched state.
|
|
|
|
Two versions of the package are available, depending on whether or not
|
|
OpenSSL is installed. If the file /usr/lib/libcrypto.so exists on the
|
|
local system, follow the directions in section 1a) below, otherwise
|
|
follow the directions in section 1b). After adding the package,
|
|
proceed with the instructions in section 2).
|
|
|
|
1a) If crypto is installed:
|
|
|
|
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/packages/SA-01:57/security-patch-sendmail-crypto-01.57.tgz
|
|
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/packages/SA-01:57/security-patch-sendmail-crypto-01.57.tgz.asc
|
|
|
|
Verify the detached PGP signature using your PGP utility.
|
|
|
|
# pkg_add security-patch-sendmail-crypto-01.57.tgz
|
|
|
|
1b) If crypto is not installed:
|
|
|
|
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/packages/SA-01:57/security-patch-sendmail-nocrypto-01.57.tgz
|
|
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/packages/SA-01:57/security-patch-sendmail-nocrypto-01.57.tgz.asc
|
|
|
|
Verify the detached PGP signature using your PGP utility.
|
|
|
|
# pkg_add security-patch-sendmail-nocrypto-01.57.tgz
|
|
|
|
2) Restart sendmail after applying the patch by executing the following
|
|
commands as root:
|
|
|
|
# killall sendmail
|
|
# /usr/sbin/sendmail -bd -q30m
|
|
|
|
The flags to sendmail may need to be adjusted as required for the
|
|
local system configuration.
|
|
|
|
VI. Correction details
|
|
|
|
The following is the sendmail $Id: FreeBSD-SA-01:57.sendmail.asc,v 1.2 2001/09/06 21:05:35 kris Exp $ revision number of the file that
|
|
was corrected for the supported branches of FreeBSD. The $Id: FreeBSD-SA-01:57.sendmail.asc,v 1.2 2001/09/06 21:05:35 kris Exp $
|
|
revision number of the installed source can be examined using the
|
|
ident(1) command. Note that the $Id: FreeBSD-SA-01:57.sendmail.asc,v 1.2 2001/09/06 21:05:35 kris Exp $ tag was not updated on the
|
|
RELENG_4_3 branch because a newer vendor release of sendmail was not
|
|
imported, instead only this vulnerability was patched.
|
|
|
|
Revision Path
|
|
8.20.22.4 src/contrib/sendmail/src/trace.c
|
|
|
|
VII. References
|
|
|
|
<URL:http://www.securityfocus.com/bid/3163>
|
|
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: GnuPG v1.0.6 (FreeBSD)
|
|
Comment: For info see http://www.gnupg.org
|
|
|
|
iQCVAwUBO46RWlUuHi5z0oilAQH+VwP+MBpBopVejzWdHAjm0cEslleHZThEjja4
|
|
qNd28CAQOy5KAdDcP61pqT2LcxlFUXyjRPjcVo6eqGaO63Lz3Ov2nnm3LPfcyR18
|
|
PQaQkezGxTIfORuXxZiNA4EI51zjoquIRVWwMJaR1Azx+vf/u9XPIDVKA7rkL3df
|
|
wvTf9D4V7ZU=
|
|
=L1XV
|
|
-----END PGP SIGNATURE-----
|