3571e53040
patches for easier mirroring, to eliminate a special copy, to make www.freebsd.org/security a full copy of security.freebsd.org and be eventually be the same. For now files are just sitting there. The symlinks are missing. Discussed on: www (repository location) Discussed with: simon (so)
118 lines
4.1 KiB
Text
118 lines
4.1 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-96:16 Security Advisory
|
|
Revised: Fri Jul 12 09:32:53 PDT 1996 FreeBSD, Inc.
|
|
|
|
Topic: security vulnerability in rdist
|
|
|
|
Category: core
|
|
Module: rdist
|
|
Announced: 1996-07-12
|
|
Affects: FreeBSD 2.0, 2.0.5, 2.1, 2.1-stable, and 2.2-current
|
|
Corrected: 2.1-stable and 2.2-current as of 1996-07-11
|
|
Source: 4.4BSD (lite)
|
|
FreeBSD only: no
|
|
|
|
Patches: ftp://freebsd.org/pub/CERT/patches/SA-96:16/
|
|
Reference: [8lgm]-Advisory-26.UNIX.rdist.20-3-1996
|
|
|
|
=============================================================================
|
|
|
|
I. Background
|
|
|
|
A bug was found in the BSD rdist utility which can allow
|
|
an unprivileged local user to gain unauthorized access.
|
|
This problem is present in all source code and binary
|
|
distributions of FreeBSD version 2.x released before 1996-07-12.
|
|
|
|
rdist has been the subject of security vulnerabilities in the past.
|
|
This is a newly discovered vulnerability not related to previous
|
|
race conditions fixed in rdist.
|
|
|
|
|
|
II. Problem Description
|
|
|
|
rdist creates an error message based on a user provided string,
|
|
without checking bounds on the buffer used. This buffer is
|
|
on the stack, and can therefore be used to execute arbitrary
|
|
instructions.
|
|
|
|
|
|
III. Impact
|
|
|
|
This vulnerability can allow a local user to obtain superuser
|
|
privileges. It may only be exploited by users with a valid
|
|
account on the local system. It is present in almost all BSD
|
|
derived operating systems with a "setuid" rdist program.
|
|
|
|
|
|
IV. Workaround
|
|
|
|
The rdist program must be setuid root to function properly.
|
|
This vulnerability can be eliminated by making rdist not
|
|
executable by unprivileged users. Since this limits the
|
|
usefulness of the program, a software update is advised.
|
|
|
|
This workaround will work for all versions of FreeBSD affected
|
|
by this problem.
|
|
|
|
As root, execute the commands:
|
|
|
|
# chflags noschg /usr/bin/rdist
|
|
# chmod u-s,go-rx /usr/bin/rdist
|
|
|
|
then verify that the setuid permissions of the files have been
|
|
removed. The permissions array should read "-r-x------" as
|
|
shown here:
|
|
|
|
# ls -l /usr/bin/rdist
|
|
-r-x------ 1 root bin 49152 Jun 16 10:46 rdist
|
|
|
|
|
|
V. Solution(s)
|
|
|
|
Apply the available via FTP from the patch directory noted
|
|
at the top of this message. Recompile, and reinstall the
|
|
rdist program. This patch is known to apply to all
|
|
FreeBSD 2.x systems, it has not been tested with FreeBSD 1.x.
|
|
|
|
The [8lgm] organization correctly points out that this program
|
|
does not have a particularly good security "history." While
|
|
the patch for this vulnerability does solve this particular
|
|
problem, it's not clear if other security issues involving rdist
|
|
will appear in the future.
|
|
|
|
Administrators should consider whether it is appropriate to
|
|
remove the standard rdist program and upgrade to rdist
|
|
version 6, which is available as a FreeBSD port.
|
|
|
|
FreeBSD, Inc. has not replaced the standard BSD rdist with
|
|
the newer code because the new rdist is not protocol-compatible
|
|
with the original version.
|
|
|
|
|
|
=============================================================================
|
|
FreeBSD, Inc.
|
|
|
|
Web Site: http://www.freebsd.org/
|
|
Confidential contacts: security-officer@freebsd.org
|
|
PGP Key: ftp://freebsd.org/pub/CERT/public_key.asc
|
|
Security notifications: security-notifications@freebsd.org
|
|
Security public discussion: security@freebsd.org
|
|
|
|
Notice: Any patches in this document may not apply cleanly due to
|
|
modifications caused by digital signature or mailer software.
|
|
Please reference the URL listed at the top of this document
|
|
for original copies of all patches if necessary.
|
|
=============================================================================
|
|
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: 2.6.2
|
|
|
|
iQCVAwUBMeaC1FUuHi5z0oilAQHtzQP/U1f9y0R+upwCs5IFeBCUBVkFWUeJ/Wwb
|
|
CJPFmsBr54quI6Aie/LXa/Qw8EdrL54GIiNDZYkAzb9XvWOehOsmtoYN4oj0JAbJ
|
|
lesq746xOEfNMtpL866T8dxJRTsK98VMSaZK5IU8fVpVYUURcVDv+y+bqfL72Mst
|
|
3ajof2ieNxE=
|
|
=j2z5
|
|
-----END PGP SIGNATURE-----
|