From owner-freebsd-security-notifications Fri May 17 17:07:44 1996 Return-Path: owner-security-notifications Received: (from root@localhost) by freefall.freebsd.org (8.7.3/8.7.3) id RAA03161 for security-notifications-outgoing; Fri, 17 May 1996 17:07:44 -0700 (PDT) Received: (from root@localhost) by freefall.freebsd.org (8.7.3/8.7.3) id RAA03132; Fri, 17 May 1996 17:06:53 -0700 (PDT) Message-Id: <199605180006.RAA03132@freefall.freebsd.org> To: freebsd-security-notifications@freebsd.org, freebsd-announce@freebsd.org cc: freebsd-security@freebsd.org From: FreeBSD Security Officer Reply-To: security-officer@freebsd.org Subject: FreeBSD Security Advisory: FreeBSD-SA-96:09.vfsload Date: Fri, 17 May 1996 16:30:52 -0700 Sender: owner-security-notifications@freebsd.org X-Loop: FreeBSD.org Precedence: bulk -----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-96:09 Security Advisory The FreeBSD Project, Inc. Topic: unauthorized access via mount_union / mount_msdos (vfsload) Category: core Module: libc Announced: 1996-05-17 Affects: FreeBSD 2.0, 2.0.5, 2.1, 2.1-stable, and 2.2-current Corrected: 1996-05-17 2.1-stable and 2.2-current sources Source: FreeBSD native bug FreeBSD only: yes Patches: ftp://freebsd.org/pub/CERT/patches/SA-96:09/ ============================================================================= I. Background A bug was found in the vfsload(3) library call that affects all versions of FreeBSD from 2.0 through 2.2-CURRENT that caused a system vulnerability. This problem is present in all source code and binary distributions of FreeBSD version 2.x released before 1996-05-18. The FreeBSD project is aware of active exploits of this vulnerability. All FreeBSD users are encouraged to use the workaround provided until they can update their operating system to a version with this vulnerability fixed. II. Problem Description The mount_union and mount_msdos programs invoke another system utility in an insecure fashion while setuid root. III. Impact The problem could allow local users to gain unauthorized permissions. This vulnerability can only be exploited by users with a valid account on the local system. IV. Solution(s) Update operating system sources and binaries to FreeBSD 2.1-stable or FreeBSD 2.2-current as distributed later than 1996-05-18 or if you are currently running 2.1 or later, you may apply the solution patches available at the URL listed at the top of this message. The OS updates fix the actual problem in the vfsload(3) library routine. Once the vfsload() library routine is fixed, the workaround listed below is not necessary to solve this problem. However, an additional stability problem has come to light (ref. FreeBSD SA-96:10) so the FreeBSD project suggests using both the setuid workaround and the solution for best results. V. Workaround This vulnerability can quickly and easily be limited by removing the setuid permission bit from the mount_union and mount_msdos program. This workaround will work for all versions of FreeBSD affected by this problem. As root, execute the command: % chmod u-s /sbin/mount_union /sbin/mount_msdos then verify that the setuid permissions of the files have been removed. The permissions array should read "-r-xr-xr-x" as shown here: % ls -l /sbin/mount_union /sbin/mount_msdos -r-xr-xr-x 1 root bin 151552 Apr 26 04:41 /sbin/mount_msdos -r-xr-xr-x 1 root bin 53248 Apr 26 04:40 /sbin/mount_union In addition to changing the permissions on the executable files, if you have the source code installed, we suggest patching the sources so that mount_union will not be installed with the setuid bit set: *** /usr/src/sbin/mount_union/Makefile Sun Nov 20 14:47:52 1994 - --- /usr/src/sbin/mount_union/Makefile Fri May 17 10:36:09 1996 *************** *** 8,14 **** CFLAGS+= -I${.CURDIR}/../../sys -I${MOUNT} .PATH: ${MOUNT} - - BINOWN= root - - BINMODE=4555 - - .include - --- 8,11 ---- *** /usr/src/sbin/i386/mount_msdos/Makefile Sun Dec 4 00:01:24 1994 - --- /usr/src/sbin/i386/mount_msdos/Makefile Fri May 17 11:31:57 1996 *************** *** 6,14 **** SRCS= mount_msdos.c getmntopts.c MAN8= mount_msdos.8 - - BINOWN= root - - BINMODE= 4555 - - MOUNT= ${.CURDIR}/../../mount CFLAGS+= -I${MOUNT} .PATH: ${MOUNT} - --- 6,11 ---- ============================================================================= The FreeBSD Project, Inc. Web Site: http://www.freebsd.com/ Confidential contacts: security-officer@freebsd.org PGP Key: ftp://freebsd.org/pub/CERT/public_key.asc Security notifications: security-notifications@freebsd.org Security public discussion: security@freebsd.org Notice: Any patches in this document may not apply cleanly due to modifications caused by digital signature or mailer software. Please reference the URL listed at the top of this document for original copies of all patches if necessary. ============================================================================= -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMZ0Fz1UuHi5z0oilAQFAjQQAgiZcuB/l7nS18BhaFNayfI4ergVd2KAy Va+hrzVvQ/AzC4Jdm5xY/86muOxf4ZgIT/gu1217Jwd/Lt+6CuP0FKYX8Bw1ml9x I9x9G3bII80OrGdrJKsgvTszaPhHJxEoAwAOFB8huA+mL9hyIGDlOBumWnvEPzVh nHd155oPg6k= =TPYT -----END PGP SIGNATURE----- From owner-freebsd-security-notifications Fri May 17 17:08:55 1996 Return-Path: owner-security-notifications Received: (from root@localhost) by freefall.freebsd.org (8.7.3/8.7.3) id RAA03354 for security-notifications-outgoing; Fri, 17 May 1996 17:08:55 -0700 (PDT) Received: (from root@localhost) by freefall.freebsd.org (8.7.3/8.7.3) id RAA03326; Fri, 17 May 1996 17:08:07 -0700 (PDT) Message-Id: <199605180008.RAA03326@freefall.freebsd.org> To: freebsd-security-notifications@freebsd.org, freebsd-announce@freebsd.org cc: security@freebsd.org From: FreeBSD Security Officer Reply-To: security-officer@freebsd.org Subject: FreeBSD Security Advisory: FreeBSD-SA-96:10.mount_union Date: Fri, 17 May 1996 16:35:40 -0700 Sender: owner-security-notifications@freebsd.org X-Loop: FreeBSD.org Precedence: bulk This is the second of two related security advisory notices. -----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-96:10 Security Advisory The FreeBSD Project, Inc. Topic: system stability compromise via mount_union program Category: core Module: unionfs Announced: 1996-05-17 Affects: FreeBSD 2.0, 2.0.5, 2.1, 2.1-stable, and 2.2-current Corrected: (workaround) 2.1-stable and 2.2-current as of 1996-05-17 Source: 4.4BSD (lite) FreeBSD only: no Patches: ftp://freebsd.org/pub/CERT/patches/SA-96:10/ ============================================================================= I. Background A bug was found in the union file system code which can allow an unprivileged local user to compromise system stability. This problem is present in all source code and binary distributions of FreeBSD version 2.x released before 1996-05-18. All FreeBSD users are encouraged to use the workaround provided until the FreeBSD Project distributes a full solution. II. Problem Description The union filesystem code had problems with certain mount ordering problems. By executing a certain sequence of mount_union commands, an unprivileged local user may cause a system reload. NOTE: This is a different problem than the one discussed in FreeBSD SA-96:09. The workaround for this vulnerability is similar to the one discussed in 96:09, but the proper solution for the unauthorized access problem in 96:09 does not address this vulnerability. III. Impact The problem could allow local users to compromise system stability. This vulnerability can only be exploited by users with a valid account on the local system. IV. Solution(s) The FreeBSD project is currently developing a solution to this problem, however the proper solution will not be available until a future FreeBSD release. We do not anticipate releasing patches for previous versions of FreeBSD due to the extensive nature of this fix. This security advisory will be updated as new information is made available. V. Workaround This vulnerability can quickly and easily be limited by removing the setuid permission bit from the mount_union program. This workaround will work for all versions of FreeBSD affected by this problem. As root, execute the command: % chmod u-s /sbin/mount_union then verify that the setuid permissions of the files have been removed. The permissions array should read "-r-xr-xr-x" as shown here: % ls -l /sbin/mount_union -r-xr-xr-x 1 root bin 53248 Apr 26 04:40 /sbin/mount_union In addition to changing the permissions on the executable files, if you have the source code installed, we suggest patching the sources so that mount_union will not be installed with the setuid bit set: *** /usr/src/sbin/mount_union/Makefile Sun Nov 20 14:47:52 1994 - --- /usr/src/sbin/mount_union/Makefile Fri May 17 10:36:09 1996 *************** *** 8,14 **** CFLAGS+= -I${.CURDIR}/../../sys -I${MOUNT} .PATH: ${MOUNT} - - BINOWN= root - - BINMODE=4555 - - .include - --- 8,11 ---- ============================================================================= The FreeBSD Project, Inc. Web Site: http://www.freebsd.com/ Confidential contacts: security-officer@freebsd.org PGP Key: ftp://freebsd.org/pub/CERT/public_key.asc Security notifications: security-notifications@freebsd.org Security public discussion: security@freebsd.org Notice: Any patches in this document may not apply cleanly due to modifications caused by digital signature or mailer software. Please reference the URL listed at the top of this document for original copies of all patches if necessary. ============================================================================= -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMZ0F01UuHi5z0oilAQGkkwP+K9KvfKokYwpfhdUBR1c9nitAHGFMl2db rzD3pl8E82fB6sluXZ8cpDToGgvN5I7bM5lEXeXOPhfIplYVihsJeWUjVPhbF20q pgfcINcYuSLcG0cLRd+ZxZjVbtC21yU44aHOEOiWMb7X79E8y9UKOVkkGcDllt0T ckaAX8totZY= =5/DV -----END PGP SIGNATURE-----