3571e53040
patches for easier mirroring, to eliminate a special copy, to make www.freebsd.org/security a full copy of security.freebsd.org and be eventually be the same. For now files are just sitting there. The symlinks are missing. Discussed on: www (repository location) Discussed with: simon (so)
104 lines
3.3 KiB
Text
104 lines
3.3 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-01:11 Security Advisory
|
|
FreeBSD, Inc.
|
|
|
|
Topic: inetd ident server allows remote users to partially
|
|
read arbitrary wheel-accessible files [REVISED]
|
|
|
|
Category: core
|
|
Module: inetd
|
|
Announced: 2001-01-29
|
|
Revised: 2001-01-29
|
|
Credits: dynamo <dynamo@ime.net>
|
|
Affects: FreeBSD 3.x (all releases)
|
|
FreeBSD 4.x (all releases)
|
|
Corrected: 2000-11-25 (FreeBSD 4.2-STABLE)
|
|
2001-01-26 (FreeBSD 3.5-STABLE)
|
|
FreeBSD only: Yes
|
|
|
|
0. Revision History
|
|
|
|
v1.0 2001-01-29 Initial release
|
|
v1.1 2001-01-29 Correctly credit original problem reporter
|
|
|
|
I. Background
|
|
|
|
The inetd ident server is an implementation of the RFC1413
|
|
identification server which returns the local username of the
|
|
user connecting to a remote service.
|
|
|
|
II. Problem Description
|
|
|
|
During internal auditing, the internal ident server in inetd was found
|
|
to incorrectly set group privileges according to the user. Due to
|
|
ident using root's group permissions, users may read the first 16
|
|
(excluding initial whitespace) bytes of wheel-accessible files.
|
|
|
|
All released versions of FreeBSD prior to the correction date
|
|
including FreeBSD 3.5.1 and FreeBSD 4.2 are vulnerable.
|
|
|
|
III. Impact
|
|
|
|
Users can read the first 16 bytes of wheel-accessible files.
|
|
|
|
To determine which may be potentially read, execute the following
|
|
command as root:
|
|
|
|
# find / -group wheel \( -perm -40 -a \! -perm +4 \) -ls
|
|
|
|
The inetd internal ident server is not enabled by default. If you
|
|
have not enabled the ident portion of inetd, you are not vulnerable.
|
|
|
|
IV. Workaround
|
|
|
|
Disable the internal ident server, if enabled: comment out all lines
|
|
beginning with "auth" in /etc/inetd.conf, then restart inetd by
|
|
sending it a SIGHUP:
|
|
|
|
# killall -HUP inetd
|
|
|
|
V. Solution
|
|
|
|
One of the following:
|
|
|
|
Upgrade the vulnerable FreeBSD system to 3.5-STABLE or 4.2-STABLE
|
|
after the correction date.
|
|
|
|
To patch your present system: download the relevant patch from the
|
|
below location, and execute the following commands as root:
|
|
|
|
[FreeBSD 4.2 base system]
|
|
|
|
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-01:11/inetd-4.2.patch
|
|
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-01:11/inetd-4.2.patch.asc
|
|
|
|
Verify the detached PGP signature using your PGP utility.
|
|
|
|
# cd /usr/src/usr.sbin/inetd
|
|
# patch -p < /path/to/patch
|
|
# make depend && make all install
|
|
# killall -HUP inetd
|
|
|
|
[FreeBSD 3.5.1 base system]
|
|
|
|
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-01:11/inetd-3.5.1.patch
|
|
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-01:11/inetd-3.5.1.patch.asc
|
|
|
|
Verify the detached PGP signature using your PGP utility.
|
|
|
|
# cd /usr/src/usr.sbin/inetd
|
|
# patch -p < /path/to/patch
|
|
# make depend && make all install
|
|
# killall -HUP inetd
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: GnuPG v1.0.4 (FreeBSD)
|
|
Comment: For info see http://www.gnupg.org
|
|
|
|
iQCVAwUBOnXa9FUuHi5z0oilAQGoPQP+ItWj4ScnyoBGBQw/CMLQN0XHWcEaT777
|
|
dY8IL6U6NeSI0g/XAk5mVk2a0AExqimkhZFtaphg49y8XwjgbWGqtWHh0YMHa4k3
|
|
ILtpOKQpDiGRda15FQUX+Pij8m3T1UdOmFQgCw2hFWnLh3eSgye7thHJzBjUlxCM
|
|
WI5aiOcdOk4=
|
|
=aAJS
|
|
-----END PGP SIGNATURE-----
|