3571e53040
patches for easier mirroring, to eliminate a special copy, to make www.freebsd.org/security a full copy of security.freebsd.org and be eventually be the same. For now files are just sitting there. The symlinks are missing. Discussed on: www (repository location) Discussed with: simon (so)
129 lines
4.7 KiB
Text
129 lines
4.7 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-02:41.smrsh Security Advisory
|
|
The FreeBSD Project
|
|
|
|
Topic: smrsh restrictions can be bypassed [REVISED]
|
|
|
|
Category: core
|
|
Module: contrib_sendmail
|
|
Announced: 2002-11-15
|
|
Credits: zen-parse <zen-parse@gmx.net>,
|
|
Pedram Amini <pamini@idefense.com>,
|
|
iDEFENSE <URL:http://www.idefense.com/>
|
|
Affects: All releases prior to FreeBSD 4.7-RELEASE
|
|
Corrected: 2002-10-08 00:53:31 UTC (RELENG_4)
|
|
2002-10-08 00:57:20 UTC (RELENG_4_7)
|
|
2002-10-26 21:11:30 UTC (RELENG_4_6)
|
|
2002-10-26 21:10:59 UTC (RELENG_4_5)
|
|
2002-10-26 21:10:22 UTC (RELENG_4_4)
|
|
2002-10-26 21:08:42 UTC (RELENG_4_3)
|
|
FreeBSD only: NO
|
|
|
|
0. Revision History
|
|
|
|
v1.0 2002-11-12 Initial release.
|
|
v1.1 2002-11-15 Correct patch instructions. Update workaround.
|
|
Add CVE reference.
|
|
|
|
I. Background
|
|
|
|
The sendmail Restricted Shell command (smrsh) is intended as a
|
|
replacement for the system shell (/bin/sh) for use by sendmail. It
|
|
limits the set of programs that can be executed through sendmail to
|
|
those in a single directory, and limits shell built-in commands.
|
|
|
|
II. Problem Description
|
|
|
|
Errors in smrsh's handling of command arguments with "||" or spaces
|
|
may allow the execution of commands outside of those in its target
|
|
directory. Since command arguments may be specified in local users'
|
|
`.forward' files, the smrsh restrictions may be bypassed using such
|
|
files that are specially crafted.
|
|
|
|
III. Impact
|
|
|
|
Users with a local account and the ability to create or modify their
|
|
`.forward' files can circumvent the smrsh restrictions. This is
|
|
mostly of consequence to systems which have local users that are not
|
|
normally allowed access to a login shell, as such users may abuse this
|
|
bug in order to execute arbitrary commands with normal privileges.
|
|
|
|
IV. Workaround
|
|
|
|
[The workaround described in revision 1.0 of this advisory was
|
|
effective, but disabled more functionality than was necessary.]
|
|
|
|
Disable sendmail delivery to programs. To do so, add the following line
|
|
to the sendmail.mc file, regenerate the sendmail.cf configuration file,
|
|
and restart sendmail.
|
|
|
|
MODIFY_MAILER_FLAGS(`LOCAL', `-|')
|
|
|
|
V. Solution
|
|
|
|
1) Upgrade your vulnerable system to 4.7-STABLE; or to the RELENG_4_7,
|
|
RELENG_4_6, RELENG_4_5, RELENG_4_4, or RELENG_4_3 security branch
|
|
dated after the correction date.
|
|
|
|
2) To patch your present system:
|
|
|
|
The following patch has been verified to apply to FreeBSD 4.4, FreeBSD
|
|
4.5, and FreeBSD 4.6 systems.
|
|
|
|
a) Download the relevant patch from the location below, and verify the
|
|
detached PGP signature using your PGP utility.
|
|
|
|
[For FreeBSD 4.6 systems]
|
|
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:41/smrsh.patch
|
|
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:41/smrsh.patch.asc
|
|
|
|
[For FreeBSD 4.3, 4.4, and 4.5 systems]
|
|
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:41/smrsh2.patch
|
|
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:41/smrsh2.patch.asc
|
|
|
|
b) Execute the following commands as root:
|
|
|
|
# cd /usr/src
|
|
# patch < /path/to/patch
|
|
|
|
[The following two steps apply only to FreeBSD 4.6 systems.]
|
|
# cd /usr/src/lib/libsm
|
|
# make depend && make
|
|
|
|
# cd /usr/src/lib/libsmutil
|
|
# make depend && make
|
|
# cd /usr/src/libexec/smrsh
|
|
# make depend && make && make install
|
|
|
|
VI. Correction details
|
|
|
|
The following list contains the revision numbers of each file that was
|
|
corrected in FreeBSD.
|
|
|
|
Path Revision
|
|
Branch
|
|
- -------------------------------------------------------------------------
|
|
src/contrib/sendmail/smrsh/smrsh.c
|
|
RELENG_4 1.3.6.9
|
|
RELENG_4_7 1.3.6.8.2.1
|
|
RELENG_4_6 1.3.6.6.2.1
|
|
RELENG_4_5 1.3.6.5.4.1
|
|
RELENG_4_4 1.3.6.5.2.1
|
|
RELENG_4_3 1.3.6.4.2.1
|
|
- -------------------------------------------------------------------------
|
|
|
|
VII. References
|
|
|
|
<URL:http://www.idefense.com/advisory/10.01.02.txt>
|
|
<URL:http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1165>
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: GnuPG v1.2.1 (FreeBSD)
|
|
|
|
iQCUAwUBPdUXEVUuHi5z0oilAQEIAQP49AjM5zG8qH0/XzOFA2IDBp5djGIs3H1R
|
|
2demoBwF4W71AiUXURZvMwNpqV6+gRenCaOAzMis2pyOkW9aheT+eGoL4YWjQR/E
|
|
aQsuX0j3XgXEVss+wQ9DPgkS+IyiYkPMrjpCNJbkQHuhwAQJj9VXrs0pbvl5NQLv
|
|
JUcPZ70k3Q==
|
|
=k1dg
|
|
-----END PGP SIGNATURE-----
|