From owner-freebsd-security@FreeBSD.ORG Tue Aug 10 09:45:37 2010 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id C77C5106567A for ; Tue, 10 Aug 2010 09:45:37 +0000 (UTC) (envelope-from przemyslaw@frasunek.com) Received: from lagoon.freebsd.lublin.pl (lagoon.freebsd.lublin.pl [IPv6:2001:1a68:2:2::3]) by mx1.freebsd.org (Postfix) with ESMTP id 3FF218FC2A for ; Tue, 10 Aug 2010 09:45:37 +0000 (UTC) Received: from [193.138.118.100] (ip-193-138-118-100.nette.pl [193.138.118.100]) by lagoon.freebsd.lublin.pl (Postfix) with ESMTPSA id C1DD8239466 for ; Tue, 10 Aug 2010 11:44:50 +0200 (CEST) Message-ID: <4C611FA9.6070409@frasunek.com> Date: Tue, 10 Aug 2010 11:45:13 +0200 From: Przemyslaw Frasunek User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.2.8) Gecko/20100802 Thunderbird/3.1.2 MIME-Version: 1.0 To: freebsd-security@freebsd.org References: In-Reply-To: X-Enigmail-Version: 1.1.1 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: Re: ~/.login_conf mechanism is flawed X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 10 Aug 2010 09:45:37 -0000 > What I found especially worrying is that this user-supplied untrustable > file is being parsed and processed by various daemons and other > login mechanisms BEFORE permanently dropping root privileges. Unless > there is a very strong reason, which I am overlooking, to do so, I > find this design very flawed. This seems to be incorrect for both ftpd and sshd on 6.4-RELEASE. 41673 sshd CALL setuid(0xbb8) 41673 sshd RET setuid 0 41673 sshd CALL seteuid(0xbb8) 41673 sshd RET seteuid 0 41673 sshd NAMI "/home/venglin/.login_conf" 41673 sshd NAMI "/home/venglin/.login_conf.db" 41673 sshd NAMI "/home/venglin/.login_conf.db" 41513 ftpd CALL seteuid(0xbb8) 41513 ftpd RET seteuid 0 41513 ftpd NAMI "/home/venglin/.login_conf" 41513 ftpd NAMI "/home/venglin/.login_conf.db" 41513 ftpd NAMI "/home/venglin/.login_conf.db" Back in 2001 I found a very similar vulnerability in 4.4-RELEASE, which allowed to read any file in system with root privileges: http://marc.info/?l=bugtraq&m=100101802423376&w=2 Since then, elevated privileges are dropped before parsing login_conf. -- * Fido: 2:480/124 ** WWW: http://www.frasunek.com ** NICHDL: PMF9-RIPE * * Jabber ID: venglin@nette.pl ** PGP ID: 2578FCAD ** HAM-RADIO: SQ5JIV *