3571e53040
patches for easier mirroring, to eliminate a special copy, to make www.freebsd.org/security a full copy of security.freebsd.org and be eventually be the same. For now files are just sitting there. The symlinks are missing. Discussed on: www (repository location) Discussed with: simon (so)
107 lines
3.5 KiB
Text
107 lines
3.5 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-02:27.rc Security Advisory
|
|
The FreeBSD Project
|
|
|
|
Topic: rc uses file globbing dangerously
|
|
|
|
Category: core
|
|
Module: rc
|
|
Announced: 2002-05-29
|
|
Credits: lumpy <lumpy@the.whole.net>
|
|
Affects: FreeBSD 4.4-RELEASE
|
|
FreeBSD 4.5-RELEASE
|
|
FreeBSD 4-STABLE prior to the correction date
|
|
Corrected: 2002-05-09 17:39:01 UTC (RELENG_4)
|
|
2002-05-09 17:40:27 UTC (RELENG_4_5)
|
|
2002-05-09 17:41:05 UTC (RELENG_4_4)
|
|
FreeBSD only: YES
|
|
|
|
I. Background
|
|
|
|
rc is the system startup script (/etc/rc). It is run when the FreeBSD
|
|
is booted multi-user, and performs a multitude of tasks to bring the
|
|
system up. One of these tasks is to remove lock files left by X
|
|
Windows, as their existence could prevent one from restarting the X
|
|
Windows server.
|
|
|
|
II. Problem Description
|
|
|
|
When removing X Windows lock files, rc uses the rm(1) command and
|
|
shell globbing:
|
|
|
|
rm -f /tmp/.X*-lock /tmp/.X11-unix/*
|
|
|
|
Since /tmp is a world-writable directory, a user may create
|
|
/tmp/.X11-unix as a symbolic link to an arbitrary directory. The next
|
|
time that rc is run (i.e. the next time the system is booted), rc will
|
|
then remove all of the files in that directory.
|
|
|
|
III. Impact
|
|
|
|
Users may remove the contents of arbitrary directories if the
|
|
/tmp/.X11-unix directory does not already exist and the system can
|
|
be enticed to reboot (or the user can wait until the next system
|
|
maintenance window).
|
|
|
|
IV. Workaround
|
|
|
|
Find and remove or comment-out the following line in /etc/rc:
|
|
|
|
rm -f /tmp/.X*-lock /tmp/.X11-unix/*
|
|
|
|
The following command executed as root will do this:
|
|
|
|
/bin/sh -c 'echo -e "/.X11-unix/s/^/#/\nw\nq\n" | /bin/ed -s /etc/rc'
|
|
|
|
V. Solution
|
|
|
|
1) Upgrade your vulnerable system to 4.5-STABLE; or to either of the
|
|
RELENG_4_5 (4.5-RELEASE-p6) or RELENG_4_4 (4.4-RELEASE-p13) security
|
|
branches dated after the respective correction dates.
|
|
|
|
2) To patch your present system:
|
|
|
|
a) Download the relevant patch from the location below, and verify the
|
|
detached PGP signature using your PGP utility.
|
|
|
|
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:27/rc.patch
|
|
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:27/rc.patch.asc
|
|
|
|
b) Execute the following commands as root:
|
|
|
|
# cd /usr/src
|
|
# patch < /path/to/patch
|
|
|
|
c) Install the new rc script:
|
|
|
|
# cd /usr/src/etc
|
|
# install -c -o root -g wheel -m 644 rc /etc/rc
|
|
|
|
VI. Correction details
|
|
|
|
The following list contains the revision numbers of each file that was
|
|
corrected in FreeBSD.
|
|
|
|
Path Revision
|
|
Branch
|
|
- -------------------------------------------------------------------------
|
|
src/etc/rc
|
|
RELENG_4 1.212.2.50
|
|
RELENG_4_5 1.212.2.38.2.1
|
|
RELENG_4_4 1.212.2.34.2.1
|
|
- -------------------------------------------------------------------------
|
|
|
|
VII. References
|
|
|
|
<URL:http://www.freebsd.org/cgi/cvsweb.cgi/src/etc/rc?rev=1.312&content-type=text/x-cvsweb-markup>
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: GnuPG v1.0.7 (FreeBSD)
|
|
|
|
iQCVAwUBPPUdKVUuHi5z0oilAQExLgP/boRbYHYXHXBC9YW1sf6FFFwhaY5iOYeZ
|
|
1JAHA+CZGyOas4RPgIBN6zxVPRX70KOdREp9flkgVvdOvODljk6k6TUjqE4xwTj9
|
|
wi0yS81Hp04uQfx+PwJSLdFvKIR/gr/TMWn1f1KD2Vy3nzZh6IAuCdzcg0z9AKlc
|
|
OQf5FWVpn8s=
|
|
=NaDG
|
|
-----END PGP SIGNATURE-----
|