3571e53040
patches for easier mirroring, to eliminate a special copy, to make www.freebsd.org/security a full copy of security.freebsd.org and be eventually be the same. For now files are just sitting there. The symlinks are missing. Discussed on: www (repository location) Discussed with: simon (so)
157 lines
5.5 KiB
Text
157 lines
5.5 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-00:17 Security Advisory
|
|
FreeBSD, Inc.
|
|
|
|
Topic: Buffer overflow in libmytinfo may yield increased
|
|
privileges with third-party software.
|
|
|
|
Category: core
|
|
Module: libmytinfo
|
|
Announced: 2000-05-09
|
|
Affects: FreeBSD 3.x before the correction date.
|
|
Corrected: 2000-04-25
|
|
FreeBSD only: Yes
|
|
|
|
Patches: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-00:17/libmytinfo.patch
|
|
|
|
I. Background
|
|
|
|
libmytinfo is part of ncurses, a text-mode display library.
|
|
|
|
II. Problem Description
|
|
|
|
libmytinfo allows users to specify an alternate termcap file or entry
|
|
via the TERMCAP environment variable, however this is not handled
|
|
securely and contains a overflowable buffer inside the library.
|
|
|
|
This is a security vulnerability for binaries which are linked against
|
|
libmytinfo and which are setuid or setgid (i.e. run with elevated
|
|
privileges). It may also be a vulnerability in other more obscure
|
|
situations where a user can exert control over the environment with
|
|
which an ncurses binary is run by another user.
|
|
|
|
FreeBSD 3.x and earlier versions use a very old, customized version of
|
|
ncurses which is difficult to update without breaking
|
|
backwards-compatibility. The update was made for FreeBSD 4.0, but it
|
|
is unlikely that 3.x will be updated. However, the ncurses source is
|
|
currently being audited for further vulnerabilities.
|
|
|
|
III. Impact
|
|
|
|
Certain setuid/setgid third-party software (including FreeBSD
|
|
ports/packages) may be vulnerable to a local exploit yielding
|
|
privileged resources, such as network sockets, privileged filesystem
|
|
access, or outright privileged shell access (including root access).
|
|
|
|
No program in the FreeBSD base system is believed to be vulnerable to
|
|
the bug.
|
|
|
|
FreeBSD 4.0 and above are NOT vulnerable to this problem.
|
|
|
|
IV. Workaround
|
|
|
|
Remove any setuid or setgid binary which is linked against libmytinfo
|
|
(including statically linked), or remove set[ug]id privileges from the
|
|
file as appropriate.
|
|
|
|
The following instructions will identify the binaries installed on the
|
|
system which are candidates for removal or removal of file
|
|
permissions. Since there may be other as yet undiscovered
|
|
vulnerabilities in libmytinfo it may be wise to perform this audit
|
|
regardless of whether or not you upgrade your system as described in
|
|
section V below. In particular, see the note regarding static linking
|
|
in section V.
|
|
|
|
Of course, it is possible that some of the identified files may be
|
|
required for the correct operation of your local system, in which case
|
|
there is no clear workaround except for limiting the set of users who
|
|
may run the binaries, by an appropriate use of user groups and
|
|
removing the "o+x" file permission bit.
|
|
|
|
1) Download the 'libfind.sh' script from
|
|
|
|
ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-00:17/libfind.sh
|
|
|
|
e.g. with the fetch(1) command:
|
|
|
|
# fetch ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-00:17/libfind.sh
|
|
Receiving libfind.sh (460 bytes): 100%
|
|
460 bytes transferred in 0.0 seconds (394.69 Kbytes/s)
|
|
#
|
|
|
|
2) Verify the md5 checksum and compare to the value below:
|
|
|
|
# /sbin/md5 libfind.sh
|
|
MD5 (libfind.sh) = 59dceaa76d6440c58471354a10a8fb0b
|
|
|
|
3) Run the libfind script against your system:
|
|
|
|
# sh libfind.sh /
|
|
|
|
This will scan your entire system for setuid or setgid binaries which
|
|
are linked against libmytinfo. Each returned binary should be examined
|
|
(e.g. with 'ls -l' and/or other tools) to determine what security risk
|
|
it poses to your local environment, e.g. whether it can be run by
|
|
arbitrary local users who may be able to exploit it to gain
|
|
privileges.
|
|
|
|
4) Remove the binaries, or reduce their file permissions, as appropriate.
|
|
|
|
V. Solution
|
|
|
|
Upgrade your FreeBSD 3.x system to 3.4-STABLE after the correction
|
|
date, or patch your present system source code and rebuild. Then run
|
|
the libfind script as instructed in section IV and identify any
|
|
statically-linked binaries (those reported as "STATIC" by the
|
|
libfind script). These should either be removed, recompiled, or have
|
|
privileges restricted to secure them against this vulnerability (since
|
|
statically-linked binaries will not be affected by recompiling the
|
|
shared libmytinfo library).
|
|
|
|
To patch your present system: save the patch below into a file, and
|
|
execute the following commands as root:
|
|
|
|
cd /usr/src/lib/libmytinfo
|
|
patch < /path/to/patch/file
|
|
make all
|
|
make install
|
|
|
|
Patches for 3.x systems before the resolution date:
|
|
|
|
Index: findterm.c
|
|
===================================================================
|
|
RCS file: /usr/cvs/src/lib/libmytinfo/Attic/findterm.c,v
|
|
retrieving revision 1.3
|
|
diff -u -r1.3 findterm.c
|
|
--- findterm.c 1997/08/13 01:21:36 1.3
|
|
+++ findterm.c 2000/04/25 16:58:19
|
|
@@ -242,7 +242,7 @@
|
|
} else {
|
|
s = path->file;
|
|
d = buf;
|
|
- while(*s != '\0' && *s != ':')
|
|
+ while(*s != '\0' && *s != ':' && d - buf < MAX_LINE - 1)
|
|
*d++ = *s++;
|
|
*d = '\0';
|
|
if (_tmatch(buf, name)) {
|
|
@@ -259,7 +259,7 @@
|
|
} else {
|
|
s = path->file;
|
|
d = buf;
|
|
- while(*s != '\0' && *s != ',')
|
|
+ while(*s != '\0' && *s != ',' && d - buf < MAX_LINE - 1)
|
|
*d++ = *s++;
|
|
*d = '\0';
|
|
if (_tmatch(buf, name)) {
|
|
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: 2.6.2
|
|
|
|
iQCVAwUBORc3NFUuHi5z0oilAQGcaAP6Ar4+mNTHR/qXUJ+MFIVy+AQHFDwpYq5f
|
|
KgBpCRzgKVZs/zfsQ+LwC1vCHzusftTK0lEd//2pfGZHt3ln0eD1s6qt+Q6+ZJBE
|
|
MYYiXvqoBL1ob2Ahts6uEUs/vbMb4bCbEmMCn4ad2iU+neKH9a81Lk3frIaJjAVK
|
|
8/6vW7wH9W4=
|
|
=NDsR
|
|
-----END PGP SIGNATURE-----
|