-----BEGIN PGP SIGNED MESSAGE-----

- ---EXTERNAL RELEASE---EXTERNAL RELEASE---EXTERNAL RELEASE---EXTERNAL RELEASE---

                  =======  ============    ======       ======
                  =======  ==============  =======     =======
                    ===      ===     ====    ======   ======
                    ===      ===========     ======= =======
                    ===      ===========     === ======= ===
                    ===      ===     ====    ===  =====  ===
                  =======  ==============  =====   ===   =====
                  =======  ============    =====    =    =====

                           EMERGENCY RESPONSE SERVICE
      OUTSIDE ADVISORY REDISTRIBUTION

17 July 1996 18:00 GMT                           Number: ERS-OAR-E01-1996:001.1
===============================================================================

The IBM-ERS Outside Advisory Redistribution is designed to provide customers
of the IBM Emergency Response Service with access to the security advisories
sent out by other computer security incident response teams, vendors, and
other groups concerned about security.

IBM makes no representations and assumes no responsibility for the contents or
accuracy of the advisories themselves.

IBM-ERS is forwarding the following information from FreeBSD, Inc.  Contact
information for FreeBSD, Inc. is included in the forwarded text below; please
contact them if you have any questions or need further information.

===============================================================================

********************** FORWARDED INFORMATION STARTS HERE **********************

 FreeBSD-SA-96:15              Security Advisory
                      FreeBSD, Inc.

 Topic:    security compromise from ppp

 Category:  core
 Module:  ppp
 Announced:  1996-06-25
 Affects:  FreeBSD 2.0.5, 2.1, 2.1-stable, and 2.2-current
 Corrected:  2.1-stable and 2.2-current as of 1996-06-10
 FreeBSD only:  unknown

 Patches:  ftp://freebsd.org/pub/CERT/patches/SA-96:15/

 =============================================================================

 I.   Background    

     FreeBSD ships a userland ppp program that can be used by users
     to set up ppp connections.
     This program is also known as ijppp.
     The ppp program has a vulnerability that allows any user to run
     commands under root privileges.

 II.  Problem Description

     The ppp program does not properly manage user privileges, allowing
     users to run any program with root privileges.

 III. Impact

     This vulnerability can only be exploited by users with a valid
     account on the local system to easily obtain superuser access.

 IV. Workaround

     One may simply disable the setuid bit on all copies of the ppp
     program.  This will close the vulnerability but will only allow
     the superuser to set up ppp connections.

     As root, execute the commands:

   # chmod 555 /usr/sbin/ppp

     then verify that the setuid permissions of the files have been
     removed.  The permissions array should read "-r-xr-xr-x" as
     shown here:

   # ls -l /usr/sbin/ppp
   -r-xr-xr-x  1 root  bin  86016 Nov 16  1995 /usr/sbin/ppp

 V. Solution

     Patches are available which eliminate this vulnerability.
     The following patch should be applied to the system sources and
     ppp should be rebuilt and reinstalled. The first patch is against
     the FreeBSD 2.1 and FreeBSD-stable source tree. The second patch
     is for FreeBSD-current (version before 1996-06-10).

     Apply the patch, then (being superuser):
  # cd /usr/src/usr.sbin/ppp
  # make depend
  # make all
  # make install

     Index: command.c
     ===================================================================
     RCS file: /home/ncvs/src/usr.sbin/ppp/command.c,v
     retrieving revision 1.5.4.3
     retrieving revision 1.5.4.4
     diff -u -r1.5.4.3 -r1.5.4.4
     --- command.c  1996/02/05 17:02:52  1.5.4.3
     +++ command.c  1996/06/10 09:41:49  1.5.4.4
     @@ -17,7 +17,7 @@
       * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
       * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
       *
     - * $Id: command.c,v 1.5.4.3 1996/02/05 17:02:52 dfr Exp $
     + * $Id: command.c,v 1.5.4.4 1996/06/10 09:41:49 ache Exp $
       *
       */
      #include <sys/types.h>
     @@ -187,9 +187,14 @@
            * We are running setuid, we should change to
            * real user for avoiding security problems.
            */
     -     setgid( getgid() );
     -     setuid( getuid() );
     -
     +     if (setgid(getgid()) < 0) {
     +  perror("setgid");
     +  exit(1);
     +     }
     +     if (setuid(getuid()) < 0) {
     +  perror("setuid");
     +  exit(1);
     +     }
           TtyOldMode();
           if(argc > 0)
             execvp(argv[0], argv);
     Index: chat.c
     ===================================================================
     RCS file: /home/ncvs/src/usr.sbin/ppp/chat.c,v
     retrieving revision 1.4.4.1
     retrieving revision 1.4.4.2
     diff -u -r1.4.4.1 -r1.4.4.2
     --- chat.c  1995/10/06 11:24:31  1.4.4.1
     +++ chat.c  1996/06/10 09:41:45  1.4.4.2
     @@ -18,7 +18,7 @@
       *    Columbus, OH  43221
       *    (614)451-1883
       *
     - * $Id: chat.c,v 1.4.4.1 1995/10/06 11:24:31 davidg Exp $
     + * $Id: chat.c,v 1.4.4.2 1996/06/10 09:41:45 ache Exp $
       *
       *  TODO:
       *  o Support more UUCP compatible control sequences.
     @@ -331,6 +331,15 @@
          nb = open("/dev/tty", O_RDWR);
          dup2(nb, 0);
      LogPrintf(LOG_CHAT, "exec: %s\n", command);
     +    /* switch back to original privileges */
     +    if (setgid(getgid()) < 0) {
     +      LogPrintf(LOG_CHAT, "setgid: %s\n", strerror(errno));
     +      exit(1);
     +    }
     +    if (setuid(getuid()) < 0) {
     +      LogPrintf(LOG_CHAT, "setuid: %s\n", strerror(errno));
     +      exit(1);
     +    }
          pid = execvp(command, vector);
          LogPrintf(LOG_CHAT, "execvp failed for (%d/%d): %s\n", pid, errno, command);
          exit(127);


     Patch for FreeBSd-current before 1996-06-10:


     Index: command.c
     ===================================================================
     RCS file: /home/ncvs/src/usr.sbin/ppp/command.c,v
     retrieving revision 1.17
     retrieving revision 1.18
     diff -u -r1.17 -r1.18
     --- command.c  1996/05/11 20:48:22  1.17
     +++ command.c  1996/06/09 20:40:58  1.18
     @@ -17,7 +17,7 @@
       * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
       * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
       *
     - * $Id: command.c,v 1.17 1996/05/11 20:48:22 phk Exp $
     + * $Id: command.c,v 1.18 1996/06/09 20:40:58 ache Exp $
       *
       */
      #include <sys/types.h>
     @@ -190,9 +190,14 @@
            * We are running setuid, we should change to
            * real user for avoiding security problems.
            */
     -     setgid( getgid() );
     -     setuid( getuid() );
     -
     +     if (setgid(getgid()) < 0) {
     +  perror("setgid");
     +  exit(1);
     +     }
     +     if (setuid(getuid()) < 0) {
     +  perror("setuid");
     +  exit(1);
     +     }
           TtyOldMode();
           if(argc > 0)
             execvp(argv[0], argv);
     Index: chat.c
     ===================================================================
     RCS file: /home/ncvs/src/usr.sbin/ppp/chat.c,v
     retrieving revision 1.10
     retrieving revision 1.11
     diff -u -r1.10 -r1.11
     --- chat.c  1996/05/11 20:48:20  1.10
     +++ chat.c  1996/06/09 20:40:56  1.11
     @@ -18,7 +18,7 @@
       *    Columbus, OH  43221
       *    (614)451-1883
       *
     - * $Id: chat.c,v 1.10 1996/05/11 20:48:20 phk Exp $
     + * $Id: chat.c,v 1.11 1996/06/09 20:40:56 ache Exp $
       *
       *  TODO:
       *  o Support more UUCP compatible control sequences.
     @@ -393,6 +393,15 @@
          nb = open("/dev/tty", O_RDWR);
          dup2(nb, 0);
      LogPrintf(LOG_CHAT_BIT, "exec: %s\n", command);
     +    /* switch back to original privileges */
     +    if (setgid(getgid()) < 0) {
     +      LogPrintf(LOG_CHAT_BIT, "setgid: %s\n", strerror(errno));
     +      exit(1);
     +    }
     +    if (setuid(getuid()) < 0) {
     +      LogPrintf(LOG_CHAT_BIT, "setuid: %s\n", strerror(errno));
     +      exit(1);
     +    }
          pid = execvp(command, vector);
          LogPrintf(LOG_CHAT_BIT, "execvp failed for (%d/%d): %s\n", pid, errno, command);
          exit(127);

 =============================================================================
 FreeBSD, Inc.

 Web Site:      http://www.freebsd.org/
 Confidential contacts:    security-officer@freebsd.org
 PGP Key:      ftp://freebsd.org/pub/CERT/public_key.asc
 Security notifications:  security-notifications@freebsd.org
 Security public discussion:  security@freebsd.org

 Notice: Any patches in this document may not apply cleanly due to
         modifications caused by digital signature or mailer software.
         Please reference the URL listed at the top of this document
         for original copies of all patches if necessary.
*********************** FORWARDED INFORMATION ENDS HERE ***********************

===============================================================================

IBM's Internet Emergency Response Service (IBM-ERS) is a subscription-based
Internet security response service that includes computer security incident
response and management, regular electronic verification of your Internet
gateway(s), and security vulnerability alerts similar to this one that are
tailored to your specific computing environment.  By acting as an extension
of your own internal security staff, IBM-ERS's team of Internet security
experts helps you quickly detect and respond to attacks and exposures across
your Internet connection(s).

As a part of IBM's Business Recovery Services organization, the IBM Internet
Emergency Response Service is a component of IBM's SecureWay(tm) line of
security products and services.  From hardware to software to consulting,
SecureWay solutions can give you the assurance and expertise you need to
protect your valuable business resources.  To find out more about the IBM
Internet Emergency Response Service, send an electronic mail message to
ers-sales@vnet.ibm.com, or call 1-800-742-2493 (Prompt 4).

IBM-ERS maintains a site on the World Wide Web at http://www.ers.ibm.com/.
Visit the site for information about the service, copies of security alerts,
team contact information, and other items.

IBM-ERS uses Pretty Good Privacy* (PGP*) as the digital signature mechanism for
security vulnerability alerts and other distributed information.  The IBM-ERS
PGP public key is available from http://www.ers.ibm.com/team-info/pgpkey.html.
"Pretty Good Privacy" and "PGP" are trademarks of Philip Zimmerman.

IBM-ERS is a Member Team of the Forum of Incident Response and Security Teams
(FIRST), a global organization established to foster cooperation and response
coordination among computer security teams worldwide.

The information in this document is provided as a service to customers of
the IBM Emergency Response Service.  Neither International Business Machines
Corporation, Integrated Systems Solutions Corporation, nor any of their
employees, makes any warranty, express or implied, or assumes any legal
liability or responsibility for the accuracy, completeness, or usefulness of
any information, apparatus, product, or process contained herein, or
represents that its use would not infringe any privately owned rights.
Reference herein to any specific commercial products, process, or service by
trade name, trademark, manufacturer, or otherwise, does not necessarily
constitute or imply its endorsement, recommendation or favoring by IBM or
its subsidiaries.  The views and opinions of authors expressed herein do not
necessarily state or reflect those of IBM or its subsidiaries, and may not be
used for advertising or product endorsement purposes.

- ---EXTERNAL RELEASE---EXTERNAL RELEASE---EXTERNAL RELEASE---EXTERNAL RELEASE---

-----BEGIN PGP SIGNATURE-----
Version: 2.7.1

iQCVAwUBMe1Ai/WDLGpfj4rlAQFwXAP/bEdJy5GeY3aIKCkcQWMDWu8AI/yh0yfR
xayLi82U5wQq+0tk4pYAiE/HkXaU2vwc5h+PuaCwUQhmmiNDw1U13Azijd/AU5Q5
iISRfgtB2VC0smaXHrL+MJPNitzppuaWTqF3vLSp1UW8foMUi035i2upOvaRDKea
jKgHARMxILA=
=VIyX
-----END PGP SIGNATURE-----