From owner-freebsd-announce Fri Sep 3 16:56:16 1999 Delivered-To: freebsd-announce@freebsd.org Received: from zippy.cdrom.com (zippy.cdrom.com [204.216.27.228]) by hub.freebsd.org (Postfix) with ESMTP id 1E80B15C99 for ; Fri, 3 Sep 1999 16:56:01 -0700 (PDT) (envelope-from jkh@zippy.cdrom.com) Received: from localhost (jkh@localhost [127.0.0.1]) by zippy.cdrom.com (8.9.3/8.9.3) with ESMTP id QAA67566 for ; Fri, 3 Sep 1999 16:55:47 -0700 (PDT) (envelope-from jkh@zippy.cdrom.com) To: announce@freebsd.org Subject: Final call for registrations: FreeBSDCon '99 Date: Fri, 03 Sep 1999 16:55:47 -0700 Message-ID: <67562.936402947@localhost> From: "Jordan K. Hubbard" Sender: owner-freebsd-announce@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org The 1999 FreeBSDCon event (October 17-23rd) is filling up fast, so please register soon if you want to attend this event! Due to overwhelming demand for Kirk McKusick's BSD Internals tutorial (which sold out several weeks ago), we have also just made arrangements for a "repeat performance" on the 22nd and 23rd of October. People already on the waiting list for the October 17th and 18th sessions will have first option for the second session (upon confirmation), any remaining seats (50 max!) then being assigned on a first come, first served basis. Those attending the full conference will also have priority over those who wish to attend just the tutorial since we're actually trying to keep the two events together, not have people simply bounce in for 2 days and then take off without seeing the rest. In any case, if you want in on this then you're going to have to move fast and I'm not kidding! :) The event is being held at the Berkeley Raddisson Hotel, the new revised schedule being as follows: October 17, 18: 1st Kirk McKusick Internals tutorial October 19, 20, 21: Conference (vendor show, talks, etc). October 22, 23: 2nd Kick McKusick Internals tutorial For further information, please see: http://www.freebsdcon.org Thanks! - Jordan This is the moderated mailing list freebsd-announce. The list contains announcements of new FreeBSD capabilities, important events and project milestones. See also the FreeBSD Web pages at http://www.freebsd.org To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-announce" in the body of the message From owner-freebsd-announce Fri Sep 3 22:29:48 1999 Delivered-To: freebsd-announce@freebsd.org Received: from rover.village.org (rover.village.org [204.144.255.49]) by hub.freebsd.org (Postfix) with ESMTP id 71B601518A; Fri, 3 Sep 1999 22:29:33 -0700 (PDT) (envelope-from imp@harmony.village.org) Received: from harmony.village.org (harmony.village.org [10.0.0.6]) by rover.village.org (8.9.3/8.9.3) with ESMTP id XAA24322; Fri, 3 Sep 1999 23:29:21 -0600 (MDT) (envelope-from imp@harmony.village.org) Received: from harmony.village.org (localhost.village.org [127.0.0.1]) by harmony.village.org (8.9.3/8.8.3) with ESMTP id XAA63474; Fri, 3 Sep 1999 23:29:37 -0600 (MDT) Message-Id: <199909040529.XAA63474@harmony.village.org> From: security-officer@freebsd.org To: freebsd-announce@freebsd.org Cc: security-notifications@freebsd.org Subject: FreeBSD-SA-99:01: BSD File Flags and Programming Techniques Date: Fri, 03 Sep 1999 23:29:36 -0600 Sender: owner-freebsd-announce@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org -----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-99:01 Security Advisory FreeBSD, Inc. Topic: BSD File Flags and Programming Techniques Category: core Module: kernel Announced: 1999-09-04 Affects: FreeBSD 3.2 (and earlier) FreeBSD-current before the correction date. Corrected: FreeBSD-3.3 RELEASE FreeBSD-current as of 1999/08/02 FreeBSD-3.2-stable as of 1999/08/02 FreeBSD-2.2.8-stable as of 1999/08/04 FreeBSD only: NO Patches: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-99:01/ I. Background BSD 4.4 added various flags to files in the file system. These flags control various aspects of which operations are permitted on those files. Historically, root has been been able to do all of these operations so many programs that knew they were running as root didn't check to make sure that these operations succeeded. II. Problem Description A user can set flags and mode on the device which they logged into. Since a bug in login and other similar programs causes the normal chown to fail, this first user will own the terminal of any login. III. Impact Local users can execute a man-in-the-middle attack against any other user (including root) when the other users logs in. This give them the ability to snoop and alter all text that the user writes. Results of this include the ability to execute commands as the user, and stealing the user's password (and anything else the users writes over the connection, including passwords for other machines). IV. Workaround None. V. Solution FreeBSD-current Index: kern/vfs_syscalls.c =================================================================== RCS file: /home/imp/FreeBSD/CVS/src/sys/kern/vfs_syscalls.c,v retrieving revision 1.125 retrieving revision 1.128 diff -u -r1.125 -r1.128 --- vfs_syscalls.c 1999/07/29 17:02:56 1.125 +++ vfs_syscalls.c 1999/08/04 04:52:18 1.128 @@ -1892,13 +1892,23 @@ int error; struct vattr vattr; + /* + * Prevent non-root users from setting flags on devices. When + * a device is reused, users can retain ownership of the device + * if they are allowed to set flags and programs assume that + * chown can't fail when done as root. + */ + if ((vp->v_type == VCHR || vp->v_type == VBLK) && + ((error = suser_xxx(p->p_ucred, p, PRISON_ROOT)) != 0)) + return (error); + VOP_LEASE(vp, p, p->p_ucred, LEASE_WRITE); vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, p); VATTR_NULL(&vattr); vattr.va_flags = flags; error = VOP_SETATTR(vp, &vattr, p->p_ucred, p); VOP_UNLOCK(vp, 0, p); - return error; + return (error); } /* FreeBSD-3.2-stable Index: kern/vfs_syscalls.c =================================================================== RCS file: /home/imp/FreeBSD/CVS/src/sys/kern/vfs_syscalls.c,v retrieving revision 1.112.2.3 retrieving revision 1.112.2.5 diff -u -r1.112.2.3 -r1.112.2.5 --- vfs_syscalls.c 1999/07/30 01:07:23 1.112.2.3 +++ vfs_syscalls.c 1999/08/11 21:39:50 1.112.2.5 @@ -1839,13 +1839,23 @@ int error; struct vattr vattr; + /* + * Prevent non-root users from setting flags on devices. When + * a device is reused, users can retain ownership of the device + * if they are allowed to set flags and programs assume that + * chown can't fail when done as root. + */ + if ((vp->v_type == VCHR || vp->v_type == VBLK) && + ((error = suser(p->p_ucred, &p->p_acflag)) != 0)) + return (error); + VOP_LEASE(vp, p, p->p_ucred, LEASE_WRITE); vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, p); VATTR_NULL(&vattr); vattr.va_flags = flags; error = VOP_SETATTR(vp, &vattr, p->p_ucred, p); VOP_UNLOCK(vp, 0, p); - return error; + return (error); } /* FreeBSD 2.2.8-stable: Index: kern/vfs_syscalls.c =================================================================== RCS file: /home/imp/FreeBSD/CVS/src/sys/kern/vfs_syscalls.c,v retrieving revision 1.51.2.7 retrieving revision 1.51.2.8 diff -u -r1.51.2.7 -r1.51.2.8 --- vfs_syscalls.c 1998/07/03 03:50:31 1.51.2.7 +++ vfs_syscalls.c 1999/08/04 18:58:56 1.51.2.8 @@ -1439,6 +1439,17 @@ if (error) return (error); vp = nd.ni_vp; + if ((error = VOP_GETATTR(vp, &vattr, p->p_ucred, p))) + return (error); + /* + * Prevent non-root users from setting flags on devices. When + * a device is reused, users can retain ownership of the device + * if they are allowed to set flags and programs assume that + * chown can't fail when done as root. + */ + if ((vp->v_type == VCHR || vp->v_type == VBLK) && + ((error = suser(p->p_ucred, &p->p_acflag)) != 0)) + return (error); LEASE_CHECK(vp, p, p->p_ucred, LEASE_WRITE); VOP_LOCK(vp); VATTR_NULL(&vattr); VI. Credits Theo de Raadt came up with the firewalling solution presented here. lumpy@blue.9mm.com brought this problem to light. ============================================================================= FreeBSD, Inc. Web Site: http://www.freebsd.org/ Confidential contacts: security-officer@freebsd.org Security notifications: security-notifications@freebsd.org Security public discussion: freebsd-security@freebsd.org PGP Key: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/public_key.asc Notice: Any patches in this document may not apply cleanly due to modifications caused by digital signature or mailer software. Please reference the URL listed at the top of this document for original copies of all patches if necessary. ============================================================================= -----BEGIN PGP SIGNATURE----- Version: 2.6.3ia Charset: noconv Comment: Processed by Mailcrypt 3.4, an Emacs/PGP interface iQCVAwUBN9CAHFUuHi5z0oilAQEJPwP/XhzCOs4ipJkZIPWlSDvsvPLcJWXzb3HK Fs8gLV3CPnW7YdSpveosI3hBY9WNCVAFx9WkM5+n+FBSRfbRzFJkkblN85ZCz7pI +RXg6Sv5vuzy6SRxMRK2vu1FXuwZevVQaMq4ANUXpdo5MyUE8rMGb9PLWdxOxdf5 s6zlG0oFyvI= =CqoX -----END PGP SIGNATURE----- This is the moderated mailing list freebsd-announce. The list contains announcements of new FreeBSD capabilities, important events and project milestones. See also the FreeBSD Web pages at http://www.freebsd.org To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-announce" in the body of the message From owner-freebsd-announce Fri Sep 3 22:44:11 1999 Delivered-To: freebsd-announce@freebsd.org Received: from rover.village.org (rover.village.org [204.144.255.49]) by hub.freebsd.org (Postfix) with ESMTP id B45E014DEF; Fri, 3 Sep 1999 22:43:55 -0700 (PDT) (envelope-from imp@harmony.village.org) Received: from harmony.village.org (harmony.village.org [10.0.0.6]) by rover.village.org (8.9.3/8.9.3) with ESMTP id XAA24408; Fri, 3 Sep 1999 23:43:06 -0600 (MDT) (envelope-from imp@harmony.village.org) Received: from harmony.village.org (localhost.village.org [127.0.0.1]) by harmony.village.org (8.9.3/8.8.3) with ESMTP id XAA63557; Fri, 3 Sep 1999 23:43:21 -0600 (MDT) Message-Id: <199909040543.XAA63557@harmony.village.org> From: security-officer@freebsd.org To: freebsd-announce@freebsd.org Cc: security-notifications@freebsd.org Subject: FreeBSD-SA-99:02: Profiling Across Exec Calls Date: Fri, 03 Sep 1999 23:43:21 -0600 Sender: owner-freebsd-announce@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org -----BEGIN POP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-99:02 Security Advisory FreeBSD, Inc. Topic: Profiling Across Exec Calls Category: core Module: kernel Announced: 1999-09-04 Affects: FreeBSD 3.2 (and earlier) FreeBSD-current before the correction date. Corrected: FreeBSD-3.3 RELEASE FreeBSD-current as of August 11, 1999 FreeBSD-3.2-stable as of August 22, 1999 FreeBSD only: No Patches: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-99:02/ I. Background FreeBSD provides a mechanism to profile a running executable to aid in performance tuning. This can be accomplished via a kernel mechanism to statistically sample the program counter of the program under profile. II. Problem Description A flaw exists in the implementation which allows an attacker to cause arbitrary locations in program executed by the attacker. III. Impact No attacks against using this vulnerability this are known at this time. An attacker could theoretically gain root access from a carefully crafted attack. IV. Workaround Since profiling is done in the kernel via the profil(2) system call, one must patch the kernel so no workaround is possible. V. Solution Apply the following patch. It will apply to both FreeBSD-current before the resolution date and to 3.2-stable before the resolution date. Index: kern_exec.c =================================================================== RCS file: /home/imp/FreeBSD/CVS/src/sys/kern/kern_exec.c,v retrieving revision 1.99 retrieving revision 1.100 diff -u -r1.99 -r1.100 --- kern_exec.c 1999/04/27 11:15:55 1.99 +++ kern_exec.c 1999/08/11 20:35:38 1.100 @@ -228,6 +228,9 @@ fdfree(p); p->p_fd = tmp; } + + /* Stop profiling */ + stopprofclock(p); /* close files on exec */ fdcloseexec(p); ============================================================================= FreeBSD, Inc. Web Site: http://www.freebsd.org/ Confidential contacts: security-officer@freebsd.org Security notifications: security-notifications@freebsd.org Security public discussion: freebsd-security@freebsd.org PGP Key: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/public_key.asc Notice: Any patches in this document may not apply cleanly due to modifications caused by digital signature or mailer software. Please reference the URL listed at the top of this document for original copies of all patches if necessary. ============================================================================= -----BEGIN PGP SIGNATURE----- Version: 2.6.3ia Charset: noconv Comment: Processed by Mailcrypt 3.4, an Emacs/PGP interface iQCVAwUBN9Cut1UuHi5z0oilAQE7IgP/Rg5oAQkmI/Wzcp5x3xWlomDAQQJFVlXp 7X9q6yux0Gx2fLU+1TcPS+dD6S7UOcDBgMMHXGqVNDnGJZSoRDIe7pNioZ/ZHVbT uh51tJBHscumrvgU2HbHcgtxLmmzlwWByf2J6UKWMLlZXWy9ieZRVTug7Zl977OM NXmKDU2au/Y= =RCXc -----END PGP SIGNATURE----- This is the moderated mailing list freebsd-announce. The list contains announcements of new FreeBSD capabilities, important events and project milestones. See also the FreeBSD Web pages at http://www.freebsd.org To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-announce" in the body of the message