-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===============================================================================
>>                                                      CERT-NL, 01-Mar-2000 <<
>> All CERT-NL information has been moved to http://cert.surfnet.nl.  Links  <<
>> to CERT-NL information contained in this advisory are therefore outdated. <<
>>                                                                           <<
>> CERT-NL also has stopped the CERT-CC-Mirror service.  Due to this the     <<
>> links to the CERT-CC mirror are obsolete. Visit the CERT-CC site for the  <<
>> complete CERT-CC advisory texts:                     http://www.cert.org  <<
===============================================================================
===============================================================================
Security Advisory                                                       CERT-NL
===============================================================================
Author/Source : Teun Nijssen                                Index  :    S-97-07
Distribution  : World                                       Page   :          1
Classification: External                                    Version:          1
Subject       : setlocale() buffer overflow                 Date   :  06-feb-97
===============================================================================

By courtesy of the FreeBSD Security Officer we received the following
information.

- -----------------------------------------------------------------------------
FreeBSD-SA-97:01              Security Advisory
Revised: Wed Feb 05 09:58:56 PDT 1997        FreeBSD, Inc.

Topic:    setlocale() bug in all released versions of FreeBSD

Category:  core
Module:    libc
Announced:  1997-02-05
Affects:  FreeBSD 2.1.6 and earlier systems suffer from this
                vulnerability for all binaries due to setlocale() being
                called from crt0.o.

Corrected:  1997-02-05 -stable, 1996-11-27 -current and RELENG_2_2 sources
Source:    FreeBSD specific bug
FreeBSD only:  unknown

Patches:  ftp://freebsd.org/pub/CERT/patches/SA-97:01/

- -----------------------------------------------------------------------------

I.   Background

     The setlocale() call contains a number of potential exploits through
     string overflows during environment variable expansion.  Because
     the 2.1.6 and earlier versions of FreeBSD called setlocale() in
     the C runtime code, the problem is especially acute there in that it
     essentially effects all binaries on the system.

     In FreeBSD 2.2 BETA and later releases, the setlocale() call was
     removed from crt0.c and the exploit closed through additional checks.

     There has also been some confusion over the implications of loading
     locale data by privileged programs.  The facility for a user to supply
     their own (possibly corrupt or abused) locale data to non-privileged
     processes was removed in all releases on 1997-02-04.  This was
     originally a debugging facility that got little use and the user can now
     only direct system binaries to load system administrator sanctioned
     locale files.

     This problem is present in all source code and binary distributions of
     FreeBSD released on or before 1996-11-27.


II.  Problem Description

     The setlocale() library function looks for the environment variable
     "PATH_LOCALE" in the current process's environment, and if it exists,
     later copies the contents of this variable to a stack buffer without
     doing proper bounds checking. If the environment variable was specially
     initialized with the proper amount and type of data prior to running a
     setuid program, it is possible to cause the program to overflow its stack
     and execute arbitrary code which could allow the user to become root.


III. Impact

     Any binary linked on a system with setlocale() built into crt0.c (see
     list of affected releases in section I above) or which calls setlocale()
     directly has the buffer overrun vulnerability.

     If this binary has the setuid or setgid bits set, or is called by
     another setuid/setgid binary (even if that other setuid/setgid binary
     does not have this vulnerability), unauthorized access may be allowed.


IV. Solution(s)

     Recompiling libc with the following patches and then recompiling all
     staticly linked binaries (all in /sbin and /bin as well as chflags,
     gunzip, gzcat, gzip, ld, tar and zcat in /usr/bin) eliminates this
     vulnerability in FreeBSD 2.1.6 and earlier releases:

  However, a full solution may require a re-link of all setuid/setgid
  local binaries or all local binaries likely to be called from another
  setuid/setgid program that were originally linked statically under
  one of the affected OSs.  Dynamically linked executables will benefit
  directly from this patch once libc is rebuilt and reinstalled and
  do not need to be relinked.

     Because of the severity of this security hole, a full update release for
     FreeBSD 2.1.6 will also be released very shortly, that release being
     provisionally assigned the version number of 2.1.7.

     Index: lib/libc/locale/collate.c
     ===================================================================
     RCS file: /home/ncvs/src/lib/libc/locale/collate.c,v
     retrieving revision 1.4.4.2
     diff -c -r1.4.4.2 collate.c
     *** collate.c  1996/06/05 02:47:55  1.4.4.2
     --- collate.c  1997/02/05 10:21:59
     ***************
     *** 64,70 ****
        __collate_load_error = 1;
        if (!encoding)
         return -1;
     !   if (!path_locale && !(path_locale = getenv("PATH_LOCALE")))
         path_locale = _PATH_LOCALE;
        strcpy(buf, path_locale);
        strcat(buf, "/");
     --- 64,70 ----
        __collate_load_error = 1;
        if (!encoding)
         return -1;
     !   if (!path_locale)
         path_locale = _PATH_LOCALE;
        strcpy(buf, path_locale);
        strcat(buf, "/");
     Index: lib/libc/locale/rune.c
     ===================================================================
     RCS file: /home/ncvs/src/lib/libc/locale/rune.c,v
     retrieving revision 1.2.6.3
     diff -c -r1.2.6.3 rune.c
     *** rune.c  1996/06/05 02:47:59  1.2.6.3
     --- rune.c  1997/02/05 10:22:00
     ***************
     *** 71,77 ****
         return(0);
        }

     !   if (!PathLocale && !(PathLocale = getenv("PATH_LOCALE")))
         PathLocale = _PATH_LOCALE;

        (void) strcpy(name, PathLocale);
     --- 71,77 ----
         return(0);
        }

     !   if (!PathLocale)
         PathLocale = _PATH_LOCALE;

        (void) strcpy(name, PathLocale);
     Index: lib/libc/locale/setlocale.c
     ===================================================================
     RCS file: /home/ncvs/src/lib/libc/locale/setlocale.c,v
     retrieving revision 1.3.4.2.2.1
     diff -c -r1.3.4.2.2.1 setlocale.c
     *** setlocale.c  1996/06/05 02:48:03  1.3.4.2.2.1
     --- setlocale.c  1997/02/05 10:22:00
     ***************
     *** 58,64 ****
        int found, i, len;
        char *env, *r;

     !   if (!PathLocale && !(PathLocale = getenv("PATH_LOCALE")))
         PathLocale = _PATH_LOCALE;

        if (category < 0 || category >= _LC_LAST)
     --- 58,64 ----
        int found, i, len;
        char *env, *r;

     !   if (!PathLocale)
         PathLocale = _PATH_LOCALE;

        if (category < 0 || category >= _LC_LAST)
     Index: lib/libc/locale/startup_setlocale.c
     ===================================================================
     RCS file: /home/ncvs/src/lib/libc/locale/Attic/startup_setlocale.c,v
     retrieving revision 1.2.4.2
     diff -c -r1.2.4.2 startup_setlocale.c
     *** startup_setlocale.c  1995/08/28 05:06:50  1.2.4.2
     --- startup_setlocale.c  1997/02/05 10:22:00
     ***************
     *** 23,29 ****
        int found, i, len;
        char *env, *r;

     !   if (!PathLocale && !(PathLocale = getenv("PATH_LOCALE")))
         PathLocale = _PATH_LOCALE;

        if (category < 0 || category >= _LC_LAST)
     --- 23,29 ----
        int found, i, len;
        char *env, *r;

     !   if (!PathLocale)
         PathLocale = _PATH_LOCALE;

        if (category < 0 || category >= _LC_LAST)

=============================================================================
CERT-NL is the Computer Emergency Response Team for SURFnet customers. SURFnet
is the Dutch network for educational, research and related institutes. CERT-NL
is a member of the Forum of Incident Response and Security Teams (FIRST).

All CERT-NL material is available under:
  http://cert.surfnet.nl/

In case of computer or network security problems please contact your local
CERT/security-team or CERT-NL  (if your institute is NOT a SURFnet customer
please address the appropriate (local) CERT/security-team).

CERT-NL is one/two hour(s) ahead of UTC (GMT) in winter/summer,
i.e. UTC+0100 in winter and UTC+0200 in summer (DST).

   Email:     cert-nl@surfnet.nl     ATTENDED REGULARLY ALL DAYS
   Phone:     +31 302 305 305        BUSINESS HOURS ONLY
   Fax:       +31 302 305 329        BUSINESS HOURS ONLY
   Snailmail: SURFnet bv
              Attn. CERT-NL
              P.O. Box 19035
              NL - 3501 DA  UTRECHT
              The Netherlands

NOODGEVALLEN:    06 22 92 35 64      ALTIJD BEREIKBAAR
EMERGENCIES : +31 6 22 92 35 64      ATTENDED AT ALL TIMES
CERT-NL'S EMERGENCY PHONENUMBER IS ONLY TO BE USED IN CASE OF EMERGENCIES:
THE SURFNET HELPDESK OPERATING THE EMERGENCY NUMBER HAS A *FIXED*
PROCEDURE FOR DEALING WITH YOUR ALERT AND WILL IN REGULAR CASES RELAY IT
TO CERT-NL IN AN APPROPRIATE MANNER. CERT-NL WILL THEN CONTACT YOU.
===============================================================================

-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.1i

iQA/AwUBOL6ISTSYjBqwfc9jEQKnpACg4ExaMzx/Hm7qlUXbYmO+sqKIn90AnibJ
uXJjcQNGuoVATWgwi4E0YEIf
=0U2q
-----END PGP SIGNATURE-----