Date: Sat, 2 Aug 1997 21:53:52 -0600 (MDT) From: Marc Slemko <marcs@znep.com> To: freebsd-security@FreeBSD.ORG Subject: Re: Vulnerability in 4.4BSD rfork() implementation Message-ID: <Pine.BSF.3.95.970802214104.12645Y-100000@alive.znep.com> In-Reply-To: <199708030102.UAA20008@enteract.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sat, 2 Aug 1997, Thomas H. Ptacek wrote: > ---------------------------------------------------------------------------- > > OpenBSD Security Advisory > > August 2, 1997 > > Vulnerability in rfork() System Call > > ---------------------------------------------------------------------------- > > SYNOPSIS > > A vulnerability in certain 4.4BSD kernels allows processes to gain > access to restricted resources by manipulating the file descriptor > tables of SUID and SGID executables. Applications of this vulnerability > will allow users to gain root access. > > ---------------------------------------------------------------------------- > > AFFECTED SYSTEMS > > It is believed that all 4.4BSD operating systems implementing the > rfork() system call are currently vulnerable to this problem. These > operating systems include OpenBSD 2.1 and FreeBSD 3.0. The OpenBSD > project has resolved this problem in OpenBSD-current. Since this wasn't entirely clear on some of the FreeBSD aspects, a few comments... First, this is a real hole. Earlier today it took me only a few minutes to make a program to add another uid 0 to your passwd file to give you root access. With the skeleton code posted in this advisory, it is even easier. Secondly, FreeBSD 2.2 (probably any version of 2.2-current starting around 1996/02/23) and 3.0 are both vulnerable. 2.1 and earlier are not. Third, I would recommend the use of the loadable module included in the advisory to close the hole temporarily until there is a FreeBSD advisory or patch. While the supplied patch for kern_exec looks fine, using the module is easier and saves you having to do things twice when an official patch comes out. Few things (very few...) use rfork() so it shouldn't hurt much. To use the loadable module, unarchive the shell archive included in the origial post, type "make", then do something like: modload -e disable_rfork disable_rfork.o as root. You should get a kernel message that the rfork() call is disabled. You should probably make it load at boot to prevent someone from deliberately crashing the system to remove the protection.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.3.95.970802214104.12645Y-100000>