-----BEGIN PGP SIGNED MESSAGE----- - ---EXTERNAL RELEASE---EXTERNAL RELEASE---EXTERNAL RELEASE---EXTERNAL RELEASE--- ======= ============ ====== ====== ======= ============== ======= ======= === === ==== ====== ====== === =========== ======= ======= === =========== === ======= === === === ==== === ===== === ======= ============== ===== === ===== ======= ============ ===== = ===== EMERGENCY RESPONSE SERVICE OUTSIDE ADVISORY REDISTRIBUTION 17 July 1996 18:00 GMT Number: ERS-OAR-E01-1996:001.1 =============================================================================== The IBM-ERS Outside Advisory Redistribution is designed to provide customers of the IBM Emergency Response Service with access to the security advisories sent out by other computer security incident response teams, vendors, and other groups concerned about security. IBM makes no representations and assumes no responsibility for the contents or accuracy of the advisories themselves. IBM-ERS is forwarding the following information from FreeBSD, Inc. Contact information for FreeBSD, Inc. is included in the forwarded text below; please contact them if you have any questions or need further information. =============================================================================== ********************** FORWARDED INFORMATION STARTS HERE ********************** FreeBSD-SA-96:15 Security Advisory FreeBSD, Inc. Topic: security compromise from ppp Category: core Module: ppp Announced: 1996-06-25 Affects: FreeBSD 2.0.5, 2.1, 2.1-stable, and 2.2-current Corrected: 2.1-stable and 2.2-current as of 1996-06-10 FreeBSD only: unknown Patches: ftp://freebsd.org/pub/CERT/patches/SA-96:15/ ============================================================================= I. Background FreeBSD ships a userland ppp program that can be used by users to set up ppp connections. This program is also known as ijppp. The ppp program has a vulnerability that allows any user to run commands under root privileges. II. Problem Description The ppp program does not properly manage user privileges, allowing users to run any program with root privileges. III. Impact This vulnerability can only be exploited by users with a valid account on the local system to easily obtain superuser access. IV. Workaround One may simply disable the setuid bit on all copies of the ppp program. This will close the vulnerability but will only allow the superuser to set up ppp connections. As root, execute the commands: # chmod 555 /usr/sbin/ppp then verify that the setuid permissions of the files have been removed. The permissions array should read "-r-xr-xr-x" as shown here: # ls -l /usr/sbin/ppp -r-xr-xr-x 1 root bin 86016 Nov 16 1995 /usr/sbin/ppp V. Solution Patches are available which eliminate this vulnerability. The following patch should be applied to the system sources and ppp should be rebuilt and reinstalled. The first patch is against the FreeBSD 2.1 and FreeBSD-stable source tree. The second patch is for FreeBSD-current (version before 1996-06-10). Apply the patch, then (being superuser): # cd /usr/src/usr.sbin/ppp # make depend # make all # make install Index: command.c =================================================================== RCS file: /home/ncvs/src/usr.sbin/ppp/command.c,v retrieving revision 1.5.4.3 retrieving revision 1.5.4.4 diff -u -r1.5.4.3 -r1.5.4.4 --- command.c 1996/02/05 17:02:52 1.5.4.3 +++ command.c 1996/06/10 09:41:49 1.5.4.4 @@ -17,7 +17,7 @@ * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. * - * $Id: command.c,v 1.5.4.3 1996/02/05 17:02:52 dfr Exp $ + * $Id: command.c,v 1.5.4.4 1996/06/10 09:41:49 ache Exp $ * */ #include @@ -187,9 +187,14 @@ * We are running setuid, we should change to * real user for avoiding security problems. */ - setgid( getgid() ); - setuid( getuid() ); - + if (setgid(getgid()) < 0) { + perror("setgid"); + exit(1); + } + if (setuid(getuid()) < 0) { + perror("setuid"); + exit(1); + } TtyOldMode(); if(argc > 0) execvp(argv[0], argv); Index: chat.c =================================================================== RCS file: /home/ncvs/src/usr.sbin/ppp/chat.c,v retrieving revision 1.4.4.1 retrieving revision 1.4.4.2 diff -u -r1.4.4.1 -r1.4.4.2 --- chat.c 1995/10/06 11:24:31 1.4.4.1 +++ chat.c 1996/06/10 09:41:45 1.4.4.2 @@ -18,7 +18,7 @@ * Columbus, OH 43221 * (614)451-1883 * - * $Id: chat.c,v 1.4.4.1 1995/10/06 11:24:31 davidg Exp $ + * $Id: chat.c,v 1.4.4.2 1996/06/10 09:41:45 ache Exp $ * * TODO: * o Support more UUCP compatible control sequences. @@ -331,6 +331,15 @@ nb = open("/dev/tty", O_RDWR); dup2(nb, 0); LogPrintf(LOG_CHAT, "exec: %s\n", command); + /* switch back to original privileges */ + if (setgid(getgid()) < 0) { + LogPrintf(LOG_CHAT, "setgid: %s\n", strerror(errno)); + exit(1); + } + if (setuid(getuid()) < 0) { + LogPrintf(LOG_CHAT, "setuid: %s\n", strerror(errno)); + exit(1); + } pid = execvp(command, vector); LogPrintf(LOG_CHAT, "execvp failed for (%d/%d): %s\n", pid, errno, command); exit(127); Patch for FreeBSd-current before 1996-06-10: Index: command.c =================================================================== RCS file: /home/ncvs/src/usr.sbin/ppp/command.c,v retrieving revision 1.17 retrieving revision 1.18 diff -u -r1.17 -r1.18 --- command.c 1996/05/11 20:48:22 1.17 +++ command.c 1996/06/09 20:40:58 1.18 @@ -17,7 +17,7 @@ * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. * - * $Id: command.c,v 1.17 1996/05/11 20:48:22 phk Exp $ + * $Id: command.c,v 1.18 1996/06/09 20:40:58 ache Exp $ * */ #include @@ -190,9 +190,14 @@ * We are running setuid, we should change to * real user for avoiding security problems. */ - setgid( getgid() ); - setuid( getuid() ); - + if (setgid(getgid()) < 0) { + perror("setgid"); + exit(1); + } + if (setuid(getuid()) < 0) { + perror("setuid"); + exit(1); + } TtyOldMode(); if(argc > 0) execvp(argv[0], argv); Index: chat.c =================================================================== RCS file: /home/ncvs/src/usr.sbin/ppp/chat.c,v retrieving revision 1.10 retrieving revision 1.11 diff -u -r1.10 -r1.11 --- chat.c 1996/05/11 20:48:20 1.10 +++ chat.c 1996/06/09 20:40:56 1.11 @@ -18,7 +18,7 @@ * Columbus, OH 43221 * (614)451-1883 * - * $Id: chat.c,v 1.10 1996/05/11 20:48:20 phk Exp $ + * $Id: chat.c,v 1.11 1996/06/09 20:40:56 ache Exp $ * * TODO: * o Support more UUCP compatible control sequences. @@ -393,6 +393,15 @@ nb = open("/dev/tty", O_RDWR); dup2(nb, 0); LogPrintf(LOG_CHAT_BIT, "exec: %s\n", command); + /* switch back to original privileges */ + if (setgid(getgid()) < 0) { + LogPrintf(LOG_CHAT_BIT, "setgid: %s\n", strerror(errno)); + exit(1); + } + if (setuid(getuid()) < 0) { + LogPrintf(LOG_CHAT_BIT, "setuid: %s\n", strerror(errno)); + exit(1); + } pid = execvp(command, vector); LogPrintf(LOG_CHAT_BIT, "execvp failed for (%d/%d): %s\n", pid, errno, command); exit(127); ============================================================================= FreeBSD, Inc. Web Site: http://www.freebsd.org/ Confidential contacts: security-officer@freebsd.org PGP Key: ftp://freebsd.org/pub/CERT/public_key.asc Security notifications: security-notifications@freebsd.org Security public discussion: security@freebsd.org Notice: Any patches in this document may not apply cleanly due to modifications caused by digital signature or mailer software. Please reference the URL listed at the top of this document for original copies of all patches if necessary. *********************** FORWARDED INFORMATION ENDS HERE *********************** =============================================================================== IBM's Internet Emergency Response Service (IBM-ERS) is a subscription-based Internet security response service that includes computer security incident response and management, regular electronic verification of your Internet gateway(s), and security vulnerability alerts similar to this one that are tailored to your specific computing environment. By acting as an extension of your own internal security staff, IBM-ERS's team of Internet security experts helps you quickly detect and respond to attacks and exposures across your Internet connection(s). As a part of IBM's Business Recovery Services organization, the IBM Internet Emergency Response Service is a component of IBM's SecureWay(tm) line of security products and services. From hardware to software to consulting, SecureWay solutions can give you the assurance and expertise you need to protect your valuable business resources. To find out more about the IBM Internet Emergency Response Service, send an electronic mail message to ers-sales@vnet.ibm.com, or call 1-800-742-2493 (Prompt 4). IBM-ERS maintains a site on the World Wide Web at http://www.ers.ibm.com/. Visit the site for information about the service, copies of security alerts, team contact information, and other items. IBM-ERS uses Pretty Good Privacy* (PGP*) as the digital signature mechanism for security vulnerability alerts and other distributed information. The IBM-ERS PGP public key is available from http://www.ers.ibm.com/team-info/pgpkey.html. "Pretty Good Privacy" and "PGP" are trademarks of Philip Zimmerman. IBM-ERS is a Member Team of the Forum of Incident Response and Security Teams (FIRST), a global organization established to foster cooperation and response coordination among computer security teams worldwide. The information in this document is provided as a service to customers of the IBM Emergency Response Service. Neither International Business Machines Corporation, Integrated Systems Solutions Corporation, nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process contained herein, or represents that its use would not infringe any privately owned rights. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation or favoring by IBM or its subsidiaries. The views and opinions of authors expressed herein do not necessarily state or reflect those of IBM or its subsidiaries, and may not be used for advertising or product endorsement purposes. - ---EXTERNAL RELEASE---EXTERNAL RELEASE---EXTERNAL RELEASE---EXTERNAL RELEASE--- -----BEGIN PGP SIGNATURE----- Version: 2.7.1 iQCVAwUBMe1Ai/WDLGpfj4rlAQFwXAP/bEdJy5GeY3aIKCkcQWMDWu8AI/yh0yfR xayLi82U5wQq+0tk4pYAiE/HkXaU2vwc5h+PuaCwUQhmmiNDw1U13Azijd/AU5Q5 iISRfgtB2VC0smaXHrL+MJPNitzppuaWTqF3vLSp1UW8foMUi035i2upOvaRDKea jKgHARMxILA= =VIyX -----END PGP SIGNATURE-----