doc/share/security/advisories/FreeBSD-SA-99:06.amd.asc

-----BEGIN PGP SIGNED MESSAGE-----

=============================================================================
FreeBSD-SA-99:06                                            Security Advisory
                                                                FreeBSD, Inc.

Topic:          remote amd attack

Category:       core
Module:         kernel
Announced:      1999-09-16
Affects:        FreeBSD 3.2 (and earlier)
		FreeBSD-current before the correction date.
		FreeBSD 3.2-stable before the correction date.
Corrected:      FreeBSD-3.3 RELEASE
		FreeBSD-current as of September 7, 1999
		FreeBSD-3.2-stable as of August 25, 1999
		The FreeBSD-3.3-RC series of releases are not affected.
FreeBSD only:   NO
Bugtraq Id:	614 (variation)
CERT ID:	CA-99.12

Patches:        ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-99:06/

I.   Background

The amd program allows for a very flexible array of remote and local
file systems to be mounted automatically on an as needed basis.  Amd
is an optional untility that system administrators must explicitly
enable.  If amd is not enabled on your system, then your system is not
vulnerable.

II.  Problem Description

There are two buffer overflow vulnerabilities in the the amd daemon.

III. Impact

Remote users could execute arbitrary code as root in the amd daemon
context.

IV.  Workaround

The only way to avoid these problems are to upgrade or not run the amd
daemon.  That leaves disabling the amd deamon as your only workaround.

V.   Solution

Upgrade your system to one that is listed above as having the problem
resolved, or you may patch your present systems.

To patch your present system apply the following patches to amd,
rebuild, install and restart amd (or reboot).

Patches for 3.2-stable and -current systems before the resolution date:

    Index: xutil.c
    ===================================================================
    RCS file: /home/ncvs/src/contrib/amd/libamu/xutil.c,v
    retrieving revision 1.1.1.3
    retrieving revision 1.1.1.3.2.1
    diff -u -r1.1.1.3 -r1.1.1.3.2.1
    --- xutil.c	1999/01/13 19:20:33	1.1.1.3
    +++ xutil.c	1999/08/25 18:59:39	1.1.1.3.2.1
    @@ -272,16 +272,18 @@

     /*
      * Take a log format string and expand occurrences of %m
    - * with the current error code taken from errno.
    + * with the current error code taken from errno.  Make sure
    + * 'e' never gets longer than maxlen characters.
      */
     static void
    -expand_error(char *f, char *e)
    +expand_error(char *f, char *e, int maxlen)
     {
       extern int sys_nerr;
    -  char *p;
    +  char *p, *q;
       int error = errno;
    +  int len = 0;

    -  for (p = f; (*e = *p); e++, p++) {
    +  for (p = f, q = e; (*q = *p) && len < maxlen; len++, q++, p++) {
	 if (p[0] == '%' && p[1] == 'm') {
	   const char *errstr;
	   if (error < 0 || error >= sys_nerr)
    @@ -289,13 +291,15 @@
	   else
	    errstr = sys_errlist[error];
	   if (errstr)
    -	strcpy(e, errstr);
    +	strcpy(q, errstr);
	   else
    -	sprintf(e, "Error %d", error);
    -      e += strlen(e) - 1;
    +	sprintf(q, "Error %d", error);
    +      len += strlen(q) - 1;
    +      q += strlen(q) - 1;
	   p++;
	 }
       }
    +  e[maxlen-1] = '\0';		/* null terminate, to be sure */
     }


    @@ -401,9 +405,15 @@
       checkup_mem();
     #endif /* DEBUG_MEM */

    -  expand_error(fmt, efmt);
    +  expand_error(fmt, efmt, 1024);

    +  /*
    +   * XXX: ptr is 1024 bytes long.  It is possible to write into it
    +   * more than 1024 bytes, if efmt is already large, and vargs expand
    +   * as well.
    +   */
       vsprintf(ptr, efmt, vargs);
    +  msg[1023] = '\0';		/* null terminate, to be sure */

       ptr += strlen(ptr);
       if (ptr[-1] == '\n')
    Index: amq_subr.c
    ===================================================================
    RCS file: /home/imp/FreeBSD/CVS/src/contrib/amd/amd/amq_subr.c,v
    retrieving revision 1.3
    retrieving revision 1.4
    diff -u -r1.3 -r1.4
    --- amq_subr.c	1999/01/13 20:03:54	1.3
    +++ amq_subr.c	1999/09/07 23:07:03	1.4
    @@ -204,11 +204,24 @@
     int *
     amqproc_mount_1_svc(voidp argp, struct svc_req *rqstp)
     {
    -  static int rc;
    -  char *s = *(amq_string *) argp;
    +  static int rc = EINVAL;
    +  char s[AMQ_STRLEN];
       char *cp;
    +  char dq[20];
    +  struct sockaddr_in *sin;
    +
    +  if ((sin = amu_svc_getcaller(rqstp->rq_xprt)) == NULL) {
    +    plog(XLOG_ERROR, "amu_svc_getcaller returned NULL");
    +    return &rc;
    +  }
    +
    +  strncpy(s, *(amq_string *) argp, AMQ_STRLEN-1);
    +  s[AMQ_STRLEN-1] = '\0';	/* null terminate, to be sure */
    +  plog(XLOG_ERROR,
    +       "amq requested mount of %s from %s.%d",
    +       s, inet_dquad(dq, sin->sin_addr.s_addr),
    +       ntohs(sin->sin_port));

    -  plog(XLOG_INFO, "amq requested mount of %s", s);
       /*
	* Minimalist security check.
	*/


=============================================================================
FreeBSD, Inc.

Web Site:                       http://www.freebsd.org/
Confidential contacts:          security-officer@freebsd.org
Security notifications:         security-notifications@freebsd.org
Security public discussion:     freebsd-security@freebsd.org
PGP Key:                ftp://ftp.freebsd.org/pub/FreeBSD/CERT/public_key.asc

Notice: Any patches in this document may not apply cleanly due to
        modifications caused by digital signature or mailer software.
        Please reference the URL listed at the top of this document
        for original copies of all patches if necessary.
=============================================================================

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3ia
Charset: noconv
Comment: Processed by Mailcrypt 3.4, an Emacs/PGP interface

iQCVAwUBN+aDyFUuHi5z0oilAQHyLQP/fohJFzI6h9g8ApbdjQJNu+sunEd7cehd
IWuvFWuiTzRRqfj7tc9+Y7FEleFKv66WM98k9zBHzU8ZVzCQ5jlf1CcM1DegEqKc
i8j71gpoKFQyrxsW3AdR2UESnUxYw8bDvimuVHyCVSvjrpvZ+5b5wXMqbvDNMo5I
UgTaLUhzQEg=
=0ohw
-----END PGP SIGNATURE-----