Date: Sun, 3 Aug 1997 01:07:27 -0400 (EDT) From: Nathan Dorfman <nathan@senate.org> To: marcs@znep.com (Marc Slemko) Cc: freebsd-security@FreeBSD.ORG Subject: Re: Vulnerability in 4.4BSD rfork() implementation Message-ID: <199708030507.BAA15769@limbo.senate.org> In-Reply-To: <Pine.BSF.3.95.970802214104.12645Y-100000@alive.znep.com> from Marc Slemko at "Aug 2, 97 09:53:52 pm"
next in thread | previous in thread | raw e-mail | index | archive | help
> On Sat, 2 Aug 1997, Thomas H. Ptacek wrote: > > > ---------------------------------------------------------------------------- > > > > OpenBSD Security Advisory > > > > August 2, 1997 > > > > Vulnerability in rfork() System Call > > > > ---------------------------------------------------------------------------- > > > > SYNOPSIS > > > > A vulnerability in certain 4.4BSD kernels allows processes to gain > > access to restricted resources by manipulating the file descriptor > > tables of SUID and SGID executables. Applications of this vulnerability > > will allow users to gain root access. > > > > ---------------------------------------------------------------------------- > > > > AFFECTED SYSTEMS > > > > It is believed that all 4.4BSD operating systems implementing the > > rfork() system call are currently vulnerable to this problem. These > > operating systems include OpenBSD 2.1 and FreeBSD 3.0. The OpenBSD > > project has resolved this problem in OpenBSD-current. > > Since this wasn't entirely clear on some of the FreeBSD aspects, a few > comments... > > First, this is a real hole. Earlier today it took me only a few minutes > to make a program to add another uid 0 to your passwd file to give you > root access. With the skeleton code posted in this advisory, it is even > easier. > > Secondly, FreeBSD 2.2 (probably any version of 2.2-current starting > around 1996/02/23) and 3.0 are both vulnerable. 2.1 and earlier are not. I compiled and ran the two tests below on a 3.0-CURRENT system (cvsuped and compiled Tue Jul 29 21:37:02 EDT 1997. It failed to create a /VULNERABLE.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199708030507.BAA15769>