Skip site navigation (1)Skip section navigation (2)
Date:      Wed, 29 Dec 1999 20:52:38 -0500 (EST)
From:      sk-ports@yin.vegamuse.org
To:        FreeBSD-gnats-submit@freebsd.org
Subject:   ports/15790: Port security fix: sysutils/wmmon
Message-ID:  <199912300152.UAA16703@yang.vegamuse.org>

next in thread | raw e-mail | index | archive | help

>Number:         15790
>Category:       ports
>Synopsis:       Security hole exists where user can obtain kmem group privs
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    freebsd-ports
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Thu Dec 30 18:10:02 PST 1999
>Closed-Date:
>Last-Modified:
>Originator:     Stephen Kiernan
>Release:        FreeBSD 4.0-CURRENT i386
>Organization:
>Environment:
>Description:

The wmmon port allows the user to set commands to be executed on mouse clicks.
Since the porit is installed sgid kmem, this can allow someone to execute
commands with kmem group privs.

>How-To-Repeat:
>Fix:

The following patch is a replacement for a previous patch file.  It fixes
the problem described in the Description by changing the user's euid and
egid to the uid and gid,respectively, once the kvm_open function completes.
begin 644 wmmon-secpatch.tar.gz
M'XL(`'O>13@``^P\_7/;-K+]E?=7P'Y3AY)H?=J.'<6>IK;;\R1Q,K&3]%[B
MX=`D)+&F2`X_)/M2_^]O%PN0($5_I$GO;MZ<IC5)8'>Q6"QV%\`BR_D\"GNQ
MD[DSGM)ST_%^^*Z_0;^_L[7%?F#XZ]>>;'M[NS]D[&E_.!AM[PRW1XS!2[__
M`^M_7S::?WF:.0EC/R11E-T'MYQQ'OPK&/K7_MKM-ENB#G3=;I3X4^,C]]@1
M=V$0V'#P;+C[K+_+!GM[>W_;W-Q4D#6@T<ZS;0G4KO[PFPUWK=&(B4^D`9^@
M#/"V^3?&C,.9$TYY^@S?9=G?.LP8#'O]00]),O,LX_&,A^RESY/0"2V67FW&
M49*E/RWXU)GG*0?.IRU$,]J,"+(L8@E?\"2C-R=@`)?X'G-"CTV3*(]]3V`P
MYDPRGK"KQ=R.8AY._("GS$^9X[K1/`[\=,:]K@0UW^($89,DFC-@:\'9.^Y[
MP%$"CY]2[FQFT69Z==,->288ZF_WAEM_JA]OH0:D#-S_DG#^\]D1V^KVI6@&
M0C2[WTYRV!U:;$1T`>!G)X7Z*&1NY''J93;C.C0#D:8^0$03H!-+L5S>@-@3
M/\VBE/UOE`=.:I%X0O;1"0+'Y1;*74)_C())XH``W5D(8N,)COU@MP>RHEZ]
M"+/(#SD[S8,`,)=.$O]TG6X!I6X8M!`:>'U]_+IW]O'%V][[M^<GKX^!Z^"&
MY;'G8!>7*)2%G_J7`9?P[U,_G+)I$%V"+N`@,X^G;N+'692DI"1>[G)1U:C&
M3X?6[J!4X]V1->CO*3W^'S]T@QR$]GSBAEG0G1U4"O,0A.-1*4BAK.!)$D98
MWF$5A/0F[2T=/ZL3PO+8`>DU560W,4\;&@'5IB;*HL"?^UE:+XU`CP.48+T"
MJ;M1.&DJ]Z[`@F:J9L)L6^J+K73E8)^-^OBKX'I\H2'RT/,G*[3A?Y>D6:_)
M_#E_H,VMU381,X$I?7^KB_F<@TEH&);?8.;]%OB7=>EC^76\,BA8S*\S'B)+
MT)N9$PNFF]1KT-^Q!H.GI8(-1EO68&^D-.R7DU?'1GL2VRBTL5X01([G+*9C
M&G:T8YG1AH?']MGI^U>OQE":9DGN9BS$OL/?3Q=0]P4[[O&)F&KVX>FY80A#
M\(6MVZ#$Z^S6JD#\_/Z7L[<O#H^-@8*ZS"=I#+-[!?3PK8V3TA@6]&(;1VP%
M\,6'XW?O3XV1@G-@_/(P=&#>*MB'5:J@=O[2/CTY9?*W!77JA[2S*SOTPQ46
M$.G-^W.",[99`U:4%]+@0<HKZ$>`?O3NY,.QL:4ZX0&*E_B+U>X"\,>C,V-;
M@UQZ:4&[T,:F+C_7%%H2_/#:1A/XZN3LW-A1--.E@UZK/GX"]NCXP[GQM(2$
M.=@`=XI$C5T%%B+%1B@@9^QI8$!N%>[H]>L7OQF#0K6\^=RYKG<9:Z`,WFY1
M7?TP,^+4_R<O/V;^),.O(`JG1MO-$RF\L@S<3J85(AH-@_AT9TYB@+D%G?UD
MOWUS=O+;T'YU<GIL`W<7-$6<S'<1C6&'XRDX#)@EFX/F2M")HA9F7J_-)GGH
M9CC16;L')8L(HHT\=:;<Q-?66)7%"9"1HUJK.DJ<Y1DTE9K84MO"!FM_&H!M
M/WH`7BH5#8IGELIEM]@??VCEISRC8A*@Z.P<@@%3R)BU$YXY"\</K/)[`J1:
MXV(P41(:?21?DD7)"'&)#HAHTH98+(/63<$PCA*80&):@LT=/Q3]<Y*IJT#@
M??'IH@5&K-&8;H/MW-[3@LY1WQIN#8JPT[C%O[<RVO0G)I#E[I4:E1;,MCX3
M<=,7$;5,Q*`!&+AQ4"*+2>]EDT8Q(0##X-=^9@[HXY9Z:E1[27U`[D4?!0>-
M0?-@9`U'N]0#H")4W/"5\5??7L"%J-:8(?P!.H0Q?@EU-S(^CS\-AKL7`H?*
MVK'"P!EB&."W[-]`E?L6P]=_X*L4OVP%0BM@71AP52EK$CYI*@;O(8IE0]C6
M)`:8"0;8YGHO3B*WE\?"(UAL/5EOC0G&GO.Y'TZB.JPLK@%+QU<'EL4U8)1<
M'1++-#`ADPDS)S'JU1H.>^HZX00*`.C'P`/8#4T88@0K0L"'V:<VC8D;1"E'
M:N-"V>`YB1)F^OO],?.?@^VQS\Y?G-M@24\.C\^@K-/!QH7.[FU;HYTB`'B$
M"H@!G?N7GX87@@6TH!`,&&1)L8#"`&1SX03&):QYU3@U:\=?KQR"WS[&(X?G
MK^R7Q^].QZIT@*588O_\YLTY!A1%KZ`"']'$5'T@H>/PF10UFD#"8K"^V5`@
M\(I(EHB*+-9OK>UO#EIL8P,QT=\7Q+K9PDYA?;L&K+=P/.X;YZH$"JA-5J?6
M@9A%H-Q*98ME5Z8\B\%/X)<I%1:5A)P>2;\9E(H/!OB"L)V.A#PXV!^T!'<0
MMH/AR6G\)<7-?0@WQ_=RH(2)<>3^/@JLQ61,65DIFR1+_>\;^]W1F]-7_[`8
M&<=R9'1B7YBRJ<JDKE<(/V,_II_#]9(($\95+)C@0XD0O,U'_B3A+)V"J[@"
M0]%EOX+/AZ4@.MI%VD6?(]M/>090YI0>,+!B?(&5&,A&B;E.`.OW-'8R84MJ
M+\>%_Q2;RF9@6J"]+(IJK>746GY7:]/\GM:4Q)0QDM^V".)%C06A?`MCX;Z"
M,2J!?CL,8C68!NJ4"15HB,-@+"HW#T([=$!9@;4GG_M/QEC?Z;""G'"-$A"7
MEVQ_7SA&JE1ND57'4#3^C)W=S"^C@#WY,7W"PB@#TYN'GAA2K64YA\24,`SX
M\U"\+Z!E7$>*&^9S],:DMQ2@"R"4%RQU^A==R?N:+BB#0B^AS0EWO$*@G[28
M'E'!4.9@,TR*.UH;LFU+&2#YW5(]H78E@P=ZBT89M0+GKA,$D6O6R:&1+&D9
M6E#[:)S+?_(D,C7,*B!K,\6S0KD5DA.Q.!6L#NSK*/2S*,%-E!\]#']\%_J'
M=LJ!J'?A9S==&EN-]%T+&7TH:TV3'N`@*K&MA%ZZCDD;@2537+,G<L;(GMU^
MM>-MC,6V=JSASJ"(Q7"`WYW\^O=S^\7A^<F;TQ9+_.DLLQT1_J-KRA(OCZLP
M8X7Y^N3HZ-5Q@3KW/?#@*[A5*.4KH=*-;TP,ZT`./9ZY/1%>)JX,=&(G2;F=
MN&A")1C%GU?\)BW(Q#1Q>+@PU__^YO6Q1*Y0C\LR)RM:['YM<\;];'<G_C7W
M'L\\0V(0=I//Q1F!83LX?&4!``9CI]'3@37:ZQ>QT[]OR"J=J@Y9X]B("&9U
M@(3WD)X39XQ<7[\[Q+!?'QAR%;!:RN;*N0-_`02]$-5VE"$@/"P8T$PAZP8X
M`#\G*R,)R*F$?&%UA0UT.*&<GQF.E\3!<#E=E]P5NF341GAE@&F^@[G`NF(*
MK]$4-NZ7IM2D/Z<R3;-^:W?+VMK5UI`[L"3;&9;Q>)IM'B29C0$X4!6/38:%
M^(K6=ZR@5($$DRMR#"?.9SSA3U+F0+`2709\SK"`+?ULQH3C29F;1"GN72,&
MQ*BX(3]WKFG]+0;XTDD2GR?LDKO1'.USR*=.AH$)\*F0H#R%V!0D<>D'B$6G
M'FD$SI]BX\L<5M@2_I)G5!OD0L=#SCVQ27XIMLW]:<@];9^,-CR40.1*2RQ4
MI$3PM2(15:#@[AZ%O3UK>VND;&^QKR(V^D53N&8TQ0L,*&NGF<7TKR&%[\6:
M6%L20U$>4F=(G*AZ@`U@W$.!3";@LBSPNJ`RGIJ@`'3GTM1BY1J6]'<YPZ,&
M<P*S.94V#1JOP.GQ'4Q5^$]9RM=\_FR]54XU6HUJE0P6I4W_KUN$(8=G0U-5
MJ_A"*=7@2``;2@(;A0@V2`9JCNJJ#TL-M9HP*BH`JPR)WU$27($ID7L]C%P@
M$KO2YGV#3,Z63GRW4$1M*07LZ[#:]6'1>-F9X9V]&3:Q6C):V4FZO4,_TV5<
MT<^[%5(J6,KYE5DJB(7KO[/CXY?VV?'Y=]"JKY;@';KS5<KPH/1*`?;:W_?W
M&6C^T49_*E@!>^.[J5']H0W[`^`^?^>V>^0Y1B-K=_>I\AS?9,2J%DM.,#UX
M^$]>L?^Y->T#"SEM;W[B@Z*+[1?;BT*Y\R1795#MX1Z''UKT$N79N"`A5LWR
MX`_6]O-RV4P16=,R\?#TO&F!"-C%@@O>6ZW]??U+[C=)J]M(6)VT-5$O3++:
M_Z)OK96B1%MY5F,59*2[L%$(M@NK<G33"JU'01\Z;@&T]!,)U&+/GS-U$%.E
M*UT^88CUH")<05%8PB859RS/*VMD0PZ2/G:RD(Y<RM);]:(O%RL49$?+MC;+
MLYVF[NCM5'&Q;%,[^VG"+OC1SX]J'(QK,-16O:FZL$S9I8.^.*\Q%9OJNZ;W
M^_M]??"-XA3G,>ZP[O=P_:`YR$VFUZ[V?74*#O1=!D.:_&]QF_^U<E]OY>XU
M=$K-OJ.1^_+?N?[OG^L/!&ZK]CNKSO-OG.;:\GU-[6H_D-L`ZX`V_&'MXN19
M;#&6&6C7(H%O!$\_A96OS%<3R^<I)I7A#BF4(3:&P41KF?BPG@TQ3^TE7\!0
MO7)F_(8]OYH'/R71U95SE7=A/=J=.MT\/>@*I)[DES9:C+,/+]Z9"R=I`?=G
MY^].3G\57[B&AV4Q\.AR,`2Q(U)]"%NAOOSU^-STO6N+"0SZ?4:Y8,V`JC:@
MKIA0"`<AOVJR52,F42!:AS!@GDY;-9)#M",`HLW;$K9&:V@ZGI?<0:S!)IBY
M+3:1!5J+\,3>%/S](M&,A&=Y$C(\(6-?\T-L^;NM\?D.9-C(Z?=B5.MV94N:
M_ON:7`@`%],1<?(4U]$"3&V(WYNLME:<T6)WL$5\P6?E<(.L\`QZRY.Q:FL6
M<##Z(EM'/,!O@@_`;)L"Q(<"'TI#6NB',3[UDV%*"0)WNQ2EM,8((O>*=O7:
M,4\`@+9.A'Q9G"4Z`9%=QY`SP3!C=QWG#(>U#@O,F9<PE<`D"0B#O])"NPZE
M3A!6H22'^H@:PLH88!H.,4H%3XA61AS+L3E/,6DG[=)9'R8/NS.Q[2:2)BV)
MF&91C'4>[KBAJ4GFCM@K$VFS8N34(0FFOA*2U#<\G^FR\QF8L!BSE&%D@#D(
M+E+VY-+Q&*HL?#R16`5']-VC;A;AP-))0F1"+;#5A%#ES\LX`F<66"R'X88B
M&'D%0C2Q%A'79+%R*_)S<U/F-=3B(S+WZ^=1Q.8YB$J($1<HNH0J`NEV\:Q(
MNB$ZATL#SF-S1&7*`(@7DIDZ;1?%)4/8&X^[T`HHB4MC"2USC@+%)&65E%4:
M]$=,03STE$=*RI&(`MP2D]/18@,+3T(I44BEBS1%CAH1-@$[P+VR[ZM]PV=A
M66!(U5,VV[U*EW8694Y`<Q#]7[42B\:*"D[O)F3P[@JNL"G"3:GL/VE'RA!Y
MC;[OZNAI1",LTD&):<SA?*BG6IM'QQ^4U2(852?R!Z4A*VL&II;\B.&--`=E
M4"H+P/2O%RF1>I+(4L1]5;/7DD<?Q`?.<B(&=@27T_MT]@%AF%).DPPBDB(G
M<"<%`M2HB$-T$J=*""!<);(BF4RIO=9O3.2$7H-I4QUFXGU=YG26@AJ:!+14
MTJWV"E#:)0Y3:0["+&).0SFJ*K4AE$I%L?F<SU.>23&(G<H[>WZ_`]3\`=EL
MC$?EN'638&8K8Z\V/R68/`]36JQ5BM&7M<7Y,F8U@5VRV&6491&L84)^G=G"
MQ3V6/RE6V3Z,`GJ[4N\T_Z-T#\#6:]D))0W2VH>)E`I<\638&Q`5HH.8;*@B
M[:'^:35XSZE<;-`H=O;Q%H=(51+0\CA00)"+1/]S5LYL\%@I<")4PYFCQJ-C
MQ*L!_C1/P!AY?GI%C@HP%8%?P*WZ:)H#[BQD=*Z<@24HB.4$S7$9;RA<T&S-
MLHCSJN)BBL2")HD*CB414=A$J\1`"'$7!2CAPD%D[9"MD[!UWL^%XX=FT)F@
MS(B1WR,_!,_N_0X?N"3'&B)@*4Q_&E*^!/449)QC<@1&%C*T6#JAN)]T!;Z/
M98GC7FF]SC`\T`,+F$>2E(4Y2$'`?L\QUG(P!2E2F-!!(`2A'G"<)RD/%KSH
M4T^-K9PE./8]*76(C*42R))B45G.$#1S9J$J$JJGFV9ARX#)3V:=V(_2,%R`
MTA&D3K@MN5":J`X*E!*O@JKC@PY[9)L(:*QJ>T<E1]\[[1&YM$MJ2B%78^U6
M`,$(;6D"4KGNM]2H0?$['?5?BM2[#8KA-XJ0FU*)(68'J*(0.K@]&(H:%1Y0
M)$]6N:-27<0G\R%$(3$422X=F2)P35']-:T"B"F<]QU2I:,H?`)&B..-,E8>
MG8A8.09CXE.V.R@31'U"#<,H4\@W/&.7'!;=8CM8W,I:^(Z8RU%H[K;DE3I*
M",?7:Y6ML/SD7W0A4@DO@ZN4\JJO9>_D0/L75"S#'\+<+/L!JB7DT>G0%TFI
M(R'+;%PZ@Q=GWB*S3]PAP]V,HG?0K92Z`5X.K46E#S@/F8=2DC3PG%P<DT=@
M;!(ZQA<!5]HE".QM0WS78S2<6LQ&!EI5R)X2]"95TDACM@3X\;$P0=(/WYF.
MOQ+MEO('.#^L!])A)*-Y%KDN6!/9`1E_@WB9Q)8+&X9Y^BW3-+THA_"O)=CN
M,?5)[.-=IWZWC\DG_>YVF08O*/V_._^K%>`WV][:MK:WMU12@]CZKK(G]UEA
M+#%)4NTP^*EZ\XHWW*R36^.,DK;]L=HBJ"4[B**V=C^@G457/,3$PG7V.8-@
M751-@LC)C$F9L@VV%'VL'^T7N=_`"AD;<15R=\_:W=M1QYM_27<$(W0[[-/H
MHBR2%\L^';Y]C_E\QV<7C^.[<5BV=ZSMO6&1Y]>6QV4%ME@(06P6NO/8+#JS
M[L;YNL5&Q39L<8`O,BQ63^_O.[X7^[.5,X'JX3VVI>WWQI3>!>,H`6A$BQU>
MF-6#;G=DL2U<=M!6L+)9%'Y@V9H,[0VCDB0Y*AR&W/356J,CE5IK!@PDFEDG
MBP*S2/HJ-HT?0E?RKJ)K^\BU2Q_51)S*M0\A2UFBKF.HNQRJ')/4)ICA($^"
MI'+()%ES@-:13:J7-^[0`+\7%1I`:ZB_5`E0J^W$C];%B4!#W1+KOE9+MIJU
M8.N;M8!)+6"UTS_1,P0^8,54;96OT$S;2POQWY*MV=NU!H/^L,C"^[.3]#_^
M$''E%/%QQX@/G2/>D\Y`EW:;3ONDE2W6I_);._4K2LKTAKOS&^C6;U-#9.&+
M=NA3:T85Z"=>3=/6+$,.X3+Z%Q"&_')V^.+5<:NXWV*4JEZ&RH4CJ:L]2<Y'
M<8*D3HXP?59JNG)"_D5YLG:K\4<:6KHJ@5W"WE;MI#)X7V=V[KXV7%R4_IY*
MW_D+E+Y34_K.8Y2^<[_2=TJEO^.FQ\>CLP9-+*]J%%<:RBTMNF^QOZ\N8K0K
MY5JSJPLQ>2%97XGI-K-LMECDD&9T6.5%/NEQ6UV"EB<#M9\?XC&H5ZP2%:C:
M!,4OW*6&'R7KW@\#O(Z+I63S+\0<ZY5;.O?C3*-,8DDN16#8#,I#GHC-D0<9
MR>>VW'"RTYB[_L37!7$_8LH#[F:X7?Y86%P7/P0-?BZ=14O9U\&C.)G3O].D
MCZ`8%G4;6=0+Z'8)JOX-"!T:!%&RRD1D+K\K"&(R-/S:[4*(2JP/C151MZM#
M)J>\R=:4;M*_52,G!EUD8AN@::7KR9.6NFY=`*"Z-D`0$'QW/7FKV-1$@"7%
M?GUMYU76ERUA"]]$18:%BN6"J?J>KXZC(Y0,W(]!2"O#@URKR_62624N,GCZ
M=0NCV*:6WJ_>WVRNW2O\KI'4"CDJ5%[X*SV,Q-+]C.YCRW[*!NI*2V>3A>-@
MFN>@?VM$\QRHI5WZ-T:LPO>7*BFKBG']RJ;>O#]O:BO*L_]KYUIZHX:!\#G_
M(E1BQ58!-G1W"VW%!;AQ@UM516P34`K[4+,KZ*'_'<^,[1D[WE>%Q&6^RVZ<
M\2.>5S*V9VMGN'/I^-YZKX&^?6BX]R;(92RRCUXVZ$`1RZXEF#=S.!#F%#>I
MX,]BW0V$#IN<;;H'=^X:*/TUR[)]DS86QOF5P2!_`0X)O1%VG=/;A/FQTL8N
MB)=#H`U7/I2ZP1;-C@+'^_*]M'041[=M"AKK%*4N!;8PD'VRH';8;+#-]$DG
M%5R"'_+\`[X/>F:XR.5_,3:W/B.KXR,4N?4MA?1)AG^QS0FKICQPD7_\8CZ)
M/W_Z\+4B6R"\8E"]S/>H;M)("9$CUQ3(4-;];LW8^]+@SC?[=_];B(J6%ZQI
MA[&"/QUP[B.^I)@1UCB0,_MY$U)N9]0N5H4T$=_"FY*)CG.>(FG?Y60_U<HG
M#7TFO\189F1__]SH[[3[QW=XB.GO=RFM_W%];G<`V1$^()-N($-/8.UXSQMD
M1SB$K.<37$/^_B&N`2`.FQG4S?=OFU_KB_1M\2AJAOU4D'=G(7>SQ25P"!#Y
M$1*((G;L_1;%"1U1%+0I2&19_+K`VG[?_&@[V/&'6^5YCS:Z!PH:P5+\HH/#
M,-6JN8?4+4NWJR(B_#E#"D=OYFV6JK*I3&?3<;6FQ<!J]K#&C0]XX3MS!;3.
MF^P/I9@:WT*`=<488*<LCY&.K$MMD2W"S"_GJ\VZJ1K,<!-J3I%'FA78=<PN
M4M-6?OB](BF%_Y!0Q)&QE<?YA]`(Z]!UO;AYM5IV;3Q*RM!EQ]9A@C0RA*&2
M7-?MC;16H&EL;7:1R6F(6Y`\2]YB#J9KBFTA?"\6G;AJ0@1CFD#8XIM]28AK
M]^0B'T;I7:1/M@&JI(BRBWV,@_T4P_.!IY*W;?AO?Q%[H*]_6M0.RL4&BB<L
M'"07^]Z=%]/11!PL!X$,<@-0@ABWHF.36+@C24:0,-SH5Q=&818-25=Z.HC8
M;B5[X\G,"$Y\]@*[MGYVZ1=!RG)T7I1E.1$G2O>/?K%G^$4^\4/KT8:/L),T
M?`PB33U)BBO3L[?%="RR19?E&!9\)IPQVD7(*%,9I2FK;4J%UZ>92UQS8K>3
M/*_1/^(_?&ND/2^F:'AI\Q:LVC_FS1"U`;0<HW&4L0QWUK4D2AC*O8,UL;LK
K4]O\4`CW?V?P5B@4"H5"H5`H%`J%0J%0*!0*A4*A4"@8?P&$34JX`'@``+LK
`
end

>Release-Note:
>Audit-Trail:
>Unformatted:


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-ports" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199912300152.UAA16703>