what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

S-92-11.asc

S-92-11.asc
Posted Jan 10, 2000

Subject SunOS Environment Variables and setuid/

systems | solaris
SHA-256 | c31ddc78a36769971f25dd35e4f5e374bf4f250ba8e73589d42825b0525956ef

S-92-11.asc

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===============================================================================
>> CERT-NL, 01-Mar-2000 <<
>> All CERT-NL information has been moved to http://cert.surfnet.nl. Links <<
>> to CERT-NL information contained in this advisory are therefore outdated. <<
>> <<
>> CERT-NL also has stopped the CERT-CC-Mirror service. Due to this the <<
>> links to the CERT-CC mirror are obsolete. Visit the CERT-CC site for the <<
>> complete CERT-CC advisory texts: http://www.cert.org <<
===============================================================================
===============================================================================
Security Advisory CERT-NL
===============================================================================
Author/Source : CERT-NL Index : S-92-11
Distribution : SURFnet Constituency Page : 1
Classification: External Version: final
Subject : SunOS Environment Variables and setuid/
setgid Vulnerability Date : 27-may-92
===============================================================================


CERT-NL (SURFnet Computer Emergency Response Team) has received
information concerning a security problem in SunOS Environment Variables and
setuid/setgid.

CERT-NL wishes to thank CERT/CC for bringing this to our attention.


===========================================================================
CA-92:11 CERT Advisory
May 27, 1992
SunOS Environment Variables and setuid/setgid Vulnerability
- ---------------------------------------------------------------------------

The Computer Emergency Response Team/Coordination Center (CERT/CC) has
received information concerning a vulnerability involving environment
variables and setuid/setgid programs under Sun Microsystems Computer
Corporation SunOS. This vulnerability exists on all Sun architectures
running SunOS 4.0 and higher.

In-house and third-party software can also be impacted by this
vulnerability. For example, the current versions of rnews, sudo,
smount, and npasswd are known to be vulnerable under SunOS. See the
Description section of this advisory for details of how to identify
software which may be vulnerable.

The workaround detailed in this advisory can be used to protect
vulnerable software on SunOS operating system versions for which
patches are unavailable, or for local or third party software which
may be vulnerable.

Sun has provided patches for SunOS 4.1, 4.1.1, and 4.1.2 programs
which are known to be impacted by this vulnerability. They are
available through your local Sun Answer Center as well as through
anonymous ftp from the ftp.uu.net (137.39.1.9) system in the
/systems/sun/sun-dist directory.

Fix PatchID Filename Checksum
login and su 100630-01 100630-01.tar.Z 36269 39
sendmail 100377-04 100377-04.tar.Z 14692 311

Note: PatchID 100630-01 contains the international version of
/usr/bin/login. PatchID 100631-01 contains the domestic version
of /usr/bin/login and is only available from Sun Answer Centers for
sites that use the US Encryption Kit.

Please note that Sun will occasionally update patch files. If you
find that the checksum is different please contact Sun or the CERT/CC
for verification.

- ---------------------------------------------------------------------------

I. Description

A security vulnerability exists if a set-user-id program changes
its real and effective user ids to be the same (but not to the
invoker's id), and subsequently causes a dynamically-linked program
to be exec'd. A similar vulnerability exists for set-group-id programs.

In particular, SunOS /usr/lib/sendmail, /usr/bin/login,
/usr/bin/su, and /usr/5bin/su are vulnerable to this problem.

II. Impact

Local users can gain unauthorized privileged access to the system.

III. Solution

A. Obtain and install the patches from Sun or from ftp.uu.net following
the provided instructions.

B. The following workaround can be used to protect vulnerable binaries
for which patches are unavailable for your SunOS version,
or for local or third party software which may be vulnerable.
The example given is a workaround for /usr/lib/sendmail.

1. As root, rename the existing version of /usr/lib/sendmail
and modify the permissions to prevent misuse.

# mv /usr/lib/sendmail /usr/lib/sendmail.dist
# chmod 755 /usr/lib/sendmail.dist

2. In an empty temporary directory, create a file wrapper.c
containing the following C program source (remember to
strip any leading white-space characters from the #define lines).

/* Start of C program source */

/* Change the next line to reflect the full pathname
of the file to be protected by the wrapper code */

#define COMMAND "/usr/lib/sendmail.dist"
#define VAR_NAME "LD_"

main(argc,argv,envp)
int argc;
char **argv;
char **envp;
{
register char **cpp;
register char **xpp;
register char *cp;

for (cpp = envp; cp = *cpp;) {
if (strncmp(cp, VAR_NAME, strlen(VAR_NAME))==0) {
for (xpp = cpp; xpp[0] = xpp[1]; xpp++);
/* void */ ;
}
else {
cpp++;
}
}

execv(COMMAND, argv);
perror(COMMAND);
exit(1);
}
/* End of C program source */

3. As root, compile the C program source for the wrapper and
install the resulting binary.

# make wrapper
# mv ./wrapper /usr/lib/sendmail
# chown root /usr/lib/sendmail
# chmod 4711 /usr/lib/sendmail

4. Steps 1 through 3 should be repeated for other vulnerable
programs with the appropriate substitution of pathnames and file
names. The "COMMAND" C preprocessor variable within the C program
source should also be changed to reflect the appropriate renamed
system binary.

- ---------------------------------------------------------------------------
The CERT/CC wishes to thank the following for their assistance: CIAC,
PCERT, and in particular Wietse Venema of Eindhoven University, The
Netherlands, for his support in the analysis of and a workaround for
this problem. We also wish to thank Sun Microsystems Computer
Corporation for their prompt response to this vulnerability.
- ---------------------------------------------------------------------------

If you believe that your system has been compromised, contact CERT/CC or
your representative in FIRST (Forum of Incident Response and Security Teams).

Internet E-mail: cert@cert.org
Telephone: 412-268-7090 (24-hour hotline)
CERT/CC personnel answer 7:30 a.m.-6:00 p.m. EST(GMT-5)/EDT(GMT-4),
on call for emergencies during other hours.

Computer Emergency Response Team/Coordination Center (CERT/CC)
Software Engineering Institute
Carnegie Mellon University
Pittsburgh, PA 15213-3890

Past advisories, information about FIRST representatives, and other
information related to computer security are available for anonymous ftp
from cert.org (192.88.209.5).

==============================================================================
CERT-NL is the Computer Emergency Response Team for SURFnet customers. SURFnet
is the Dutch network for educational, research and related institutes. CERT-NL
is a member of the Forum of Incident Response and Security Teams (FIRST).

All CERT-NL material is available under:
http://cert.surfnet.nl/

In case of computer or network security problems please contact your local
CERT/security-team or CERT-NL (if your institute is NOT a SURFnet customer
please address the appropriate (local) CERT/security-team).

CERT-NL is one/two hour(s) ahead of UTC (GMT) in winter/summer,
i.e. UTC+0100 in winter and UTC+0200 in summer (DST).

Email: cert-nl@surfnet.nl ATTENDED REGULARLY ALL DAYS
Phone: +31 302 305 305 BUSINESS HOURS ONLY
Fax: +31 302 305 329 BUSINESS HOURS ONLY
Snailmail: SURFnet bv
Attn. CERT-NL
P.O. Box 19035
NL - 3501 DA UTRECHT
The Netherlands

NOODGEVALLEN: 06 22 92 35 64 ALTIJD BEREIKBAAR
EMERGENCIES : +31 6 22 92 35 64 ATTENDED AT ALL TIMES
CERT-NL'S EMERGENCY PHONENUMBER IS ONLY TO BE USED IN CASE OF EMERGENCIES:
THE SURFNET HELPDESK OPERATING THE EMERGENCY NUMBER HAS A *FIXED*
PROCEDURE FOR DEALING WITH YOUR ALERT AND WILL IN REGULAR CASES RELAY IT
TO CERT-NL IN AN APPROPRIATE MANNER. CERT-NL WILL THEN CONTACT YOU.
===============================================================================

-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.1i

iQA/AwUBOL6V9zSYjBqwfc9jEQJSYACg5d6WHg0zsol4rsNfXDznX+ifLREAn1PM
q3r++F2qECFI85eA9fTcbmDq
=F5nq
-----END PGP SIGNATURE-----
Login or Register to add favorites

File Archive:

April 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    10 Files
  • 2
    Apr 2nd
    26 Files
  • 3
    Apr 3rd
    40 Files
  • 4
    Apr 4th
    6 Files
  • 5
    Apr 5th
    26 Files
  • 6
    Apr 6th
    0 Files
  • 7
    Apr 7th
    0 Files
  • 8
    Apr 8th
    22 Files
  • 9
    Apr 9th
    14 Files
  • 10
    Apr 10th
    10 Files
  • 11
    Apr 11th
    13 Files
  • 12
    Apr 12th
    14 Files
  • 13
    Apr 13th
    0 Files
  • 14
    Apr 14th
    0 Files
  • 15
    Apr 15th
    30 Files
  • 16
    Apr 16th
    10 Files
  • 17
    Apr 17th
    22 Files
  • 18
    Apr 18th
    45 Files
  • 19
    Apr 19th
    8 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    11 Files
  • 23
    Apr 23rd
    68 Files
  • 24
    Apr 24th
    23 Files
  • 25
    Apr 25th
    16 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close