From owner-freebsd-security-notifications Sat Feb 19 22:42:34 2000 Delivered-To: freebsd-security-notifications@freebsd.org Received: from freefall.freebsd.org (freefall.FreeBSD.ORG [204.216.27.21]) by hub.freebsd.org (Postfix) with ESMTP id 5426437BE84; Sat, 19 Feb 2000 22:42:28 -0800 (PST) (envelope-from security-officer@freebsd.org) Received: (from kris@localhost) by freefall.freebsd.org (8.9.3/8.9.2) id WAA10401; Sat, 19 Feb 2000 22:42:28 -0800 (PST) (envelope-from security-officer@freebsd.org) Date: Sat, 19 Feb 2000 22:42:28 -0800 (PST) Message-Id: <200002200642.WAA10401@freefall.freebsd.org> X-Authentication-Warning: freefall.freebsd.org: kris set sender to security-officer@freebsd.org using -f From: FreeBSD Security Officer Subject: FreeBSD Security Advisory: FreeBSD-SA-00:03.asmon From: FreeBSD Security Officer Sender: owner-freebsd-security-notifications@FreeBSD.ORG Precedence: bulk Reply-To: postmaster@freebsd.org X-Loop: FreeBSD.org -----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:03 Security Advisory FreeBSD, Inc. Topic: Asmon/Ascpu ports fail to drop privileges Category: ports Module: asmon/ascpu Announced: 2000-02-19 Affects: Ports collection before the correction date. Corrected: 2000-01-29 FreeBSD only: yes I. Background Two optional third-party ports distributed with FreeBSD can be used to execute commands with elevated privileges, specifically setgid kmem privileges. This may lead to a local root compromise. II. Problem Description Asmon and ascpu allow users to execute arbitrary commands as part of a user configuration file. Both applications are Linux-centric as distributed by the vendor and require patching to run under FreeBSD (specifically, using the kvm interface and setgid kmem privileges to obtain system statistics); this patching was the source of the present security problem. This is a similar flaw to one found in the wmmon port, which was corrected on 1999/12/31. Note that neither utility is installed by default, nor are they "part of FreeBSD" as such: they are part of the FreeBSD ports collection, which contains over 3100 third-party applications in a ready-to-install format. FreeBSD makes no claim about the security of these third-party applications, although an effort is underway to provide a security audit of the most security-critical ports. III. Impact If you have not chosen to install the asmon or ascpu ports/packages, then your system is not vulnerable. If you have, then local users can obtain setgid kmem rights, which allows them to manipulate kernel memory, and thereby compromise root. IV. Workaround Remove the asmon and ascpu ports/packages, if you have installed them. V. Solution One of the following: 1) Upgrade your entire ports collection and rebuild the asmon and/or ascpu ports. 2) Reinstall a new package obtained from: ftp://ftp.freebsd.org/pub/FreeBSD/ports/packages/sysutils/asmon-0.60.tgz ftp://ftp.freebsd.org/pub/FreeBSD/ports/packages/sysutils/ascpu-1.8.tgz after the correction date. At the time of advisory release, the asmon package was not available - you may need to use one of the other methods to update the software. 3) download a new port skeleton for the asmon and/or ascpu ports from: http://www.freebsd.org/ports/ and use it to rebuild one or both ports. 4) Use the portcheckout utility to automate option (3) above. The portcheckout port is available in /usr/ports/devel/portcheckout or the package can be obtained from: ftp://ftp.freebsd.org/pub/FreeBSD/ports/packages/devel/portcheckout-2.0.tgz -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBOK+LsFUuHi5z0oilAQHRZAP+MC3e3NhGNTDhiL/GAQjewUS8c16ClPhj WruCd5Tu1WJA2Em8Q19Ui7vrLRLQ9aXzTocUOBd6x6/zqpM3lS1aJMwvV9BkZ59G ONh6aiM7FbWPKukW1YThKDn0Vjtc5JaDHsbJ4dVHQh/IMqZD8hqocLG4AjJDxnLj qlRyhiCr/lA= =l1gj -----END PGP SIGNATURE----- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security-notifications" in the body of the message From owner-freebsd-security-notifications Sat Feb 19 22:45:54 2000 Delivered-To: freebsd-security-notifications@freebsd.org Received: from freefall.freebsd.org (freefall.FreeBSD.ORG [204.216.27.21]) by hub.freebsd.org (Postfix) with ESMTP id 1FF6437BDF9; Sat, 19 Feb 2000 22:45:46 -0800 (PST) (envelope-from security-officer@freebsd.org) Received: (from kris@localhost) by freefall.freebsd.org (8.9.3/8.9.2) id WAA10607; Sat, 19 Feb 2000 22:45:45 -0800 (PST) (envelope-from security-officer@freebsd.org) Date: Sat, 19 Feb 2000 22:45:45 -0800 (PST) Message-Id: <200002200645.WAA10607@freefall.freebsd.org> X-Authentication-Warning: freefall.freebsd.org: kris set sender to security-officer@freebsd.org using -f From: FreeBSD Security Officer Subject: FreeBSD Security Advisory: FreeBSD-SA-00:04.delegate From: FreeBSD Security Officer Sender: owner-freebsd-security-notifications@FreeBSD.ORG Precedence: bulk Reply-To: postmaster@freebsd.org X-Loop: FreeBSD.org -----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:04 Security Advisory FreeBSD, Inc. Topic: Delegate port contains numerous buffer overflows Category: ports Module: delegate Announced: 2000-02-19 Affects: Ports collection before the correction date. Corrected: 2000-02-02 FreeBSD only: NO I. Background An optional third-party port distributed with FreeBSD contains numerous remotely-exploitable buffer overflows which allow an attacker to execute arbitrary commands on the local system, typically as the 'nobody' user. II. Problem Description Delegate is a versatile application-level proxy. Unfortunately it is written in a very insecure style, with potentially dozens of different exploitable buffer overflows (including several demonstrated ones), each of which could allow an attacker to execute arbitrary code on the delegate server. This code will run as the user ID of the 'delegated' process, typically 'nobody' in the recommended configuration, but this still represents a security risk as the attacker may be able to mount a local attack to further upgrade his or her access privileges. Note that the delegate utility is not installed by default, nor is it "part of FreeBSD" as such: it is part of the FreeBSD ports collection, which contains over 3100 third-party applications in a ready-to-install format. FreeBSD makes no claim about the security of these third-party applications, although an effort is underway to provide a security audit of the most security-critical ports. III. Impact If you have not chosen to install the delegate port/package, then your system is not vulnerable. If you have, then local or remote users who can connect to the delegate port(s), or malicious servers which a user accesses using the delegate proxy, can potentially execute arbitrary code on your system in any number of ways. IV. Workaround Remove the delegate port/package, if you have installed it. V. Solution Unfortunately no simple fix is available - the problems with the delegate software are too endemic to be fixed by a simple patch. It is hoped the software authors will take security to heart and correct the security problems in a future version, although user caution is advised given the current state of the code. Depending on your local setup and your security threat model, using a firewall/packet filter such as ipfw(8) or ipf(8) to prevent remote users from connecting to the delegate port(s) may be enough to meet your security needs. Note that this will not prevent legitimate proxy users from attacking the delegate server, although this may not be an issue if they have a shell account on the machine anyway. Note also that this does not prevent "passive" exploits in which a user is convinced through other means into visiting a malicious server using the proxy, which may be able to compromise it by sending back invalid data. Several flaws of this type have been discovered during a brief survey of the code. If you are running FreeBSD 4.0, a possible solution might be to confine the delegate process inside a "jail" (see the jail(8) manpage). A properly configured jail will isolate the contents in their own separate "virtual machine", which can be suitably secured so that an attacker who gains control of a process running inside the jail cannot escape and gain access to the rest of the machine. Note that this is different from a traditional chroot(8), since it does not just attempt to isolate processes inside portions of the filesystem. This solution is not possible under standard FreeBSD 3.x or earlier. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBOK+NTVUuHi5z0oilAQGGnAP+NOxAOVpEUpyR0iQwNjA1Je7B4M5gOxzc NwqQKp7WBm/IzzIW23KvyPcbTld83+m2tnhdNW3srh8ESSYDaa/hhmG2AtR0LYEL H2EWTIBcPBhidquX+ihKGTSaMnMjYpmp6GVGSsBqcNFXAPGHiJ6BbsEg2k6rJSLz wgL0NJ+qkCI= =ZhXO -----END PGP SIGNATURE----- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security-notifications" in the body of the message