-----BEGIN PGP SIGNED MESSAGE-----

=============================================================================
FreeBSD-SA-96:01              Security Advisory
Revised: Wed May 22 00:18:51 PDT 1996        FreeBSD, Inc.

Topic:    sliplogin unauthorized access vulnerability

Category:  core
Module:    sliplogin
Announced:  1996-04-21
Affects:  FreeBSD 2.0.5 and 2.1.0 systems where sliplogin may
    be invoked as a user shell (in /etc/passwd entries).
Corrected:  1996-04-21 -stable and -current sources
Source:    Generic BSD bug
FreeBSD only:  no

Reference:  AUSCERT Advisory correspondence

Patches:  ftp://freebsd.org/pub/CERT/patches/SA-96:01/

=============================================================================

I.   Background    

     A bug was found in the sliplogin program.  The program did
     not properly restrict the environment used when invoking
     child processes.  This problem is present in all source code
     and binary distributions of FreeBSD version 2.0.5 and 2.1
     released before 1996-04-21.


II.  Problem Description

     The sliplogin program is used to allow a remote user to dial
     into a FreeBSD system and start a SLIP connection.  The sliplogin
     program is typically used as replacement user "shell" in this
     application.  The sliplogin program invokes a child process that
     may be compromised through the passing of certain environment
     variables.


III. Impact

     The problem could allow local users to gain unauthorized access
     to a system or provide unauthorized access to remote users.
     This problem is only exploitable on systems where the sliplogin
     program has been configured to be invoked at login time (e.g. as
     a user shell in /etc/passwd entries).

IV. Solution(s)

     The following patch to sliplogin.c eliminates this vulnerability.

    *** sliplogin.c  1996/01/06 07:19:55  1.3.4.1
    --- sliplogin.c  1996/04/24 20:20:00  1.3.4.2
    ***************
    *** 88,93 ****
    --- 88,100 ----
      #include <signal.h>
      #include "pathnames.h"
      
    + extern char **environ;
    + 
    + static char *restricted_environ[] = {
    +   "PATH=" _PATH_STDPATH,
    +   NULL
    + };
    + 
      int  unit;
      int  slip_mode;
      speed_t speed;
    ***************
    *** 123,128 ****
    --- 130,137 ----
      char user[16];
      char buf[128];
      int i, j, n;
    + 
    +   environ = restricted_environ; /* minimal protection for system() */
      
      (void)strcpy(loginname, name);
      if ((fp = fopen(_PATH_ACCESS, "r")) == NULL) {


V. Workaround

     This vulnerability can quickly and easily be limited by disabling
     any account that has sliplogin as the user shell in /etc/passwd or
     by disabling access to the sliplogin command.

     As root, execute the command:

    # chmod 000 /usr/sbin/mount_union

     then verify that all access permission to the file has been
     disabled.  The permissions array should read "----------" as
     shown here:

     # ls -l /usr/sbin/sliplogin
     ----------  1 root  bin  16384 Apr 26 04:47 /usr/sbin/sliplogin


=============================================================================
FreeBSD, Inc.

Web Site:      http://www.freebsd.org/
Confidential contacts:    security-officer@freebsd.org
PGP Key:      ftp://freebsd.org/pub/CERT/public_key.asc
Security notifications:    security-notifications@freebsd.org
Security public discussion:  security@freebsd.org

Notice: Any patches in this document may not apply cleanly due to
  modifications caused by digital signature or mailer software.
  Please reference the URL listed at the top of this document
  for original copies of all patches if necessary.
=============================================================================

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMaLAiVUuHi5z0oilAQFjMQQAlBJ/nnV0+FpmAdxkn1e3wr97oXPoGLfz
hKbTHbQACcsYAJBZXItC8gGxwbDze0H06PidR81anVOch8pkthRbam6rYNWUsAwZ
2PyWy7Q8pmeBz0vVhUYKQgLFWFzSdibvPJQjNA53uUvKymJHvEUeDj8MigQdxcvh
2MkW1XGtVyQ=
=8oT/
-----END PGP SIGNATURE-----