what you don't know can hurt you

FreeBSD Security Advisory - Chrooted ftpd Code Execution

FreeBSD Security Advisory - Chrooted ftpd Code Execution
Posted Dec 27, 2011
Site security.freebsd.org

FreeBSD Security Advisory - The nsdispatch API has no mechanism to alert it to whether it is operating within a chroot environment in which the standard paths for configuration files and shared libraries may be untrustworthy. The FreeBSD ftpd daemon can be configured to use chroot, and also uses the nsdispatch API.

tags | advisory
systems | freebsd
MD5 | 07e28abb4e87d4c9ebb11746c5dc884f

FreeBSD Security Advisory - Chrooted ftpd Code Execution

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=============================================================================
FreeBSD-SA-11:07.chroot Security Advisory
The FreeBSD Project

Topic: Code execution via chrooted ftpd

Category: core
Module: libc
Announced: 2011-12-23
Affects: All supported versions of FreeBSD.
Corrected: 2011-12-23 15:00:37 UTC (RELENG_7, 7.4-STABLE)
2011-12-23 15:00:37 UTC (RELENG_7_4, 7.4-RELEASE-p5)
2011-12-23 15:00:37 UTC (RELENG_7_3, 7.3-RELEASE-p9)
2011-12-23 15:00:37 UTC (RELENG_8, 8.2-STABLE)
2011-12-23 15:00:37 UTC (RELENG_8_2, 8.2-RELEASE-p5)
2011-12-23 15:00:37 UTC (RELENG_8_1, 8.1-RELEASE-p7)
2011-12-23 15:00:37 UTC (RELENG_9, 9.0-STABLE)
2011-12-23 15:00:37 UTC (RELENG_9_0, 9.0-RELEASE)

For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:http://security.FreeBSD.org/>.

I. Background

Chroot is an operation that changes the apparent root directory for the
current process and its children. The chroot(2) system call is widely
used in many applications as a measure of limiting a process's access to
the file system, as part of implementing privilege separation.

The nsdispatch(3) API implementation has a feature to reload its
configuration on demand. This feature may also load shared libraries
and run code provided by the library when requested by the configuration
file.

II. Problem Description

The nsdispatch(3) API has no mechanism to alert it to whether it is
operating within a chroot environment in which the standard paths for
configuration files and shared libraries may be untrustworthy.

The FreeBSD ftpd(8) daemon can be configured to use chroot(2), and
also uses the nsdispatch(3) API.

III. Impact

If ftpd is configured to place a user in a chroot environment, then an
attacker who can log in as that user may be able to run arbitrary code
with elevated ("root") privileges.

IV. Workaround

Don't use ftpd with the chroot option.

V. Solution

Perform one of the following:

1) Upgrade your vulnerable system to 7-STABLE or 8-STABLE, or to
the RELENG_8_2, RELENG_8_1, RELENG_7_4, or RELENG_7_3 security
branch dated after the correction date.

2) To update your vulnerable system via a source code patch:

The following patches have been verified to apply to FreeBSD 7.4, 7.3,
8.2 and 8.1 systems.

a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.

[FreeBSD 7.3 and 7.4]
# fetch http://security.FreeBSD.org/patches/SA-11:07/chroot7.patch
# fetch http://security.FreeBSD.org/patches/SA-11:07/chroot7.patch.asc

[FreeBSD 8.1 and 8.2]
# fetch http://security.FreeBSD.org/patches/SA-11:07/chroot8.patch
# fetch http://security.FreeBSD.org/patches/SA-11:07/chroot8.patch.asc

b) Execute the following commands as root:

# cd /usr/src
# patch < /path/to/patch

c) Recompile the operating system as described in
<URL: http://www.freebsd.org/handbook/makeworld.html> and reboot the
system.

3) To update your vulnerable system via a binary patch:

Systems running 7.4-RELEASE, 7.3-RELEASE, 8.2-RELEASE, or 8.1-RELEASE on
the i386 or amd64 platforms can be updated via the freebsd-update(8)
utility:

# freebsd-update fetch
# freebsd-update install

4) This update adds a new API, __FreeBSD_libc_enter_restricted_mode()
to the C library, which completely disables loading of shared libraries
upon return. Applications doing chroot(2) jails need to be updated
to call this API explicitly right after the chroot(2) operation as a
safety measure.

VI. Correction details

The following list contains the revision numbers of each file that was
corrected in FreeBSD.

CVS:

Branch Revision
Path
- -------------------------------------------------------------------------
RELENG_7
src/include/unistd.h 1.80.2.4
src/lib/libc/include/libc_private.h 1.17.2.4
src/lib/libc/Versions.def 1.3.2.3
src/lib/libc/net/nsdispatch.c 1.14.2.3
src/lib/libc/gen/Symbol.map 1.6.2.7
src/lib/libc/gen/Makefile.inc 1.128.2.6
src/lib/libc/gen/libc_dlopen.c 1.2.2.2
src/libexec/ftpd/popen.c 1.26.10.2
src/libexec/ftpd/ftpd.c 1.212.2.2
RELENG_7_4
src/UPDATING 1.507.2.36.2.7
src/sys/conf/newvers.sh 1.72.2.18.2.10
src/include/unistd.h 1.80.2.3.4.2
src/lib/libc/include/libc_private.h 1.17.2.3.4.2
src/lib/libc/Versions.def 1.3.2.2.4.2
src/lib/libc/net/nsdispatch.c 1.14.2.2.2.2
src/lib/libc/gen/Symbol.map 1.6.2.6.4.2
src/lib/libc/gen/Makefile.inc 1.128.2.5.4.2
src/lib/libc/gen/libc_dlopen.c 1.2.4.2
src/libexec/ftpd/popen.c 1.26.10.1.2.2
src/libexec/ftpd/ftpd.c 1.212.2.1.6.2
RELENG_7_3
src/UPDATING 1.507.2.34.2.11
src/sys/conf/newvers.sh 1.72.2.16.2.13
src/include/unistd.h 1.80.2.3.2.2
src/lib/libc/include/libc_private.h 1.17.2.3.2.2
src/lib/libc/Versions.def 1.3.2.2.2.2
src/lib/libc/net/nsdispatch.c 1.14.2.1.6.2
src/lib/libc/gen/Symbol.map 1.6.2.6.2.2
src/lib/libc/gen/Makefile.inc 1.128.2.5.2.2
src/lib/libc/gen/libc_dlopen.c 1.1.2.1
src/libexec/ftpd/popen.c 1.26.24.2
src/libexec/ftpd/ftpd.c 1.212.2.1.4.2
RELENG_8
src/include/unistd.h 1.95.2.2
src/lib/libc/include/libc_private.h 1.20.2.3
src/lib/libc/Versions.def 1.8.2.3
src/lib/libc/net/nsdispatch.c 1.18.2.3
src/lib/libc/gen/Symbol.map 1.21.2.6
src/lib/libc/gen/Makefile.inc 1.144.2.7
src/lib/libc/gen/libc_dlopen.c 1.1.4.2
src/libexec/ftpd/popen.c 1.26.22.3
src/libexec/ftpd/ftpd.c 1.214.2.3
RELENG_8_2
src/UPDATING 1.632.2.19.2.7
src/sys/conf/newvers.sh 1.83.2.12.2.10
src/include/unistd.h 1.95.2.1.6.2
src/lib/libc/include/libc_private.h 1.20.2.2.4.2
src/lib/libc/Versions.def 1.8.2.2.4.2
src/lib/libc/net/nsdispatch.c 1.18.2.2.2.2
src/lib/libc/gen/Symbol.map 1.21.2.5.2.2
src/lib/libc/gen/Makefile.inc 1.144.2.6.2.2
src/lib/libc/gen/libc_dlopen.c 1.2.8.2
src/libexec/ftpd/popen.c 1.26.22.2.4.2
src/libexec/ftpd/ftpd.c 1.214.2.1.6.2
RELENG_8_1
src/UPDATING 1.632.2.14.2.10
src/sys/conf/newvers.sh 1.83.2.10.2.11
src/include/unistd.h 1.95.2.1.4.2
src/lib/libc/include/libc_private.h 1.20.2.2.2.2
src/lib/libc/Versions.def 1.8.2.2.2.2
src/lib/libc/net/nsdispatch.c 1.18.2.1.4.2
src/lib/libc/gen/Symbol.map 1.21.2.3.2.2
src/lib/libc/gen/Makefile.inc 1.144.2.4.2.2
src/lib/libc/gen/libc_dlopen.c 1.2.10.2
src/libexec/ftpd/popen.c 1.26.22.2.2.2
src/libexec/ftpd/ftpd.c 1.214.2.1.4.2
RELENG_9
src/include/unistd.h 1.101.2.2
src/lib/libc/include/libc_private.h 1.26.2.2
src/lib/libc/Versions.def 1.9.2.2
src/lib/libc/net/nsdispatch.c 1.19.2.2
src/lib/libc/gen/Symbol.map 1.38.2.2
src/lib/libc/gen/Makefile.inc 1.159.2.2
src/lib/libc/gen/libc_dlopen.c 1.1.6.2
src/lib/libc/iconv/citrus_module.c 1.1.2.2
src/libexec/ftpd/popen.c 1.27.2.2
src/libexec/ftpd/ftpd.c 1.220.2.2
RELENG_9_0
src/include/unistd.h 1.101.2.1.2.2
src/lib/libc/include/libc_private.h 1.26.2.1.2.2
src/lib/libc/Versions.def 1.9.2.1.2.2
src/lib/libc/net/nsdispatch.c 1.19.2.1.2.2
src/lib/libc/gen/Symbol.map 1.38.2.1.2.2
src/lib/libc/gen/Makefile.inc 1.159.2.1.2.2
src/lib/libc/gen/libc_dlopen.c 1.2.6.2
src/lib/libc/iconv/citrus_module.c 1.1.2.1.2.2
src/libexec/ftpd/popen.c 1.27.2.1.2.2
src/libexec/ftpd/ftpd.c 1.220.2.1.2.2
- -------------------------------------------------------------------------

Subversion:

Branch/path Revision
- -------------------------------------------------------------------------
stable/7/ r228843
releng/7.4/ r228843
releng/7.3/ r228843
stable/8/ r228843
releng/8.2/ r228843
releng/8.1/ r228843
stable/9/ r228843
releng/9.0/ r228843
- -------------------------------------------------------------------------

VII. References

The latest revision of this advisory is available at
http://security.FreeBSD.org/advisories/FreeBSD-SA-11:07.chroot.asc
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.18 (FreeBSD)

iEYEARECAAYFAk70nOoACgkQFdaIBMps37ILmgCgjVxRH+NsPpnXOVdwWmuxlSDp
h9wAniE0tokORcqQlFJim5Pc1Z65ybwl
=45yE
-----END PGP SIGNATURE-----

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

July 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    34 Files
  • 2
    Jul 2nd
    15 Files
  • 3
    Jul 3rd
    9 Files
  • 4
    Jul 4th
    8 Files
  • 5
    Jul 5th
    2 Files
  • 6
    Jul 6th
    3 Files
  • 7
    Jul 7th
    1 Files
  • 8
    Jul 8th
    15 Files
  • 9
    Jul 9th
    15 Files
  • 10
    Jul 10th
    20 Files
  • 11
    Jul 11th
    17 Files
  • 12
    Jul 12th
    16 Files
  • 13
    Jul 13th
    2 Files
  • 14
    Jul 14th
    1 Files
  • 15
    Jul 15th
    20 Files
  • 16
    Jul 16th
    27 Files
  • 17
    Jul 17th
    7 Files
  • 18
    Jul 18th
    5 Files
  • 19
    Jul 19th
    12 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close