----------------------------------------------------------------------------
                             
                                     OpenBSD Security Advisory
                     
                                          October 3, 2000

                     Format string vulnerability in libutil pw_error(3) function

             ----------------------------------------------------------------------------

             SYNOPSIS

             A format string vulnerability present in the pw_error() function of
             OpenBSD 2.7's libutil library can yield localhost users root access through
             the setuid /usr/bin/chpass utility. This particular vulnerability was
             repaired three months ago on June 30th in OpenBSD-current during a complete
             source tree audit for format string problems.

             OpenBSD developers became aware of an exploit circulating for the chpass(1)
             program on the evening of October 2, 2000.

             ----------------------------------------------------------------------------

             AFFECTED SYSTEMS

             This vulnerability affects OpenBSD versions through 2.7. FreeBSD 4.0 is
             vulnerable, but patches have been backported, and FreeBSD versions 4.1 and
             4.1.1 are safe. Bill Sommerfield committed a fix to NetBSD today shortly
             after we notified him of the problem.

             OpenBSD users running -current (2.8-beta) with a system dated July 1st
             or thereafter are safe.

             ----------------------------------------------------------------------------

             DETAILS

             In recent months a myriad of "format string" vulnerabilities have been
             discovered in a number of software packages. In response to this threat,
             the OpenBSD team immediately began a complete source tree audit, identifying
             and fixing dozens of these format bugs. While most of the issues were
             harmless, a few such as the bug in xlock and one in the OpenBSD ftpd daemon
             raised the red flag and patches were released to correct these problems.
             Unfortunately, the severity of the format string bug that was fixed in
             pw_error() was not fully realized at the time.

             In addition to fixing the bugs, CAVEATS sections were added to all stdarg
             function man pages (printf, syslog, setproctitle, err/warn) to warn
             programmers that user-supplied strings should never be passed to these
             routines without using the "%s" conversion specifier.

             ----------------------------------------------------------------------------

             TECHNICAL DETAILS

             To understand a format string attack, you need only understand how varargs
             (see "man stdarg") functions work. For example, the printf() function
             accepts a variable number of arguments depending on the supplied format.
             Here is the function prototype:

                     int
                     printf(const char *format, ...);

             The problem occurs when one of these functions is used thusly:

                     printf(user_supplied_string);

             An attacker can put their own format specifiers in user_supplied_string.
             The printf() function does not know where it's arguments stop on the stack.
             If you put 100 `%s' format specifiers in the string, but give it no
             arguments, the function will happily continue on down the stack blindly.

             The problem is magnified by special conversion specifiers such as `%n'
             which let you write to memory. Further attack details are beyond the scope
             of this advisory. For more information see Guardent's white paper on
             "Format String Attacks" by Tim Newsham at the following URL:

                     http://www.guardent.com/docs/FormatString.PDF

             ----------------------------------------------------------------------------

             RESOLUTION

             /bin/chmod u-s /usr/bin/chpass

             Use this command to protect yourself until you are patched. (Note that the
             vulnerability is actually in the libutil library, which chpass is linked to,
             not the chpass program itself.)

             Then, apply the fix below to your OpenBSD 2.7 source tree. The patch is also
             available at http://www.openbsd.org/errata.html (025).

             ----------------------------------------------------------------------------

             CREDITS

             This vulnerability was originally extinguished on June 30 in a mass
             format string repair commit by Todd C. Miller of the OpenBSD project. Other
             developers who contributed to the audit include Theo de Raadt, Todd Fries,
             and Aaron Campbell.

             OpenBSD would also like to thank Kyle Hufford and Eric Jackson for their
             assistance in creating this advisory.

             ----------------------------------------------------------------------------

             OPENBSD 2.7 PATCH

             Apply by doing:
                     cd /usr/src
                     patch -p0 < 025_pw_error.patch

             And then rebuild and install libutil.
                     cd lib/libutil
                     make depend
                     make
                     make install

             Index: lib/libutil/passwd.c
             ===================================================================
             RCS file: /cvs/src/lib/libutil/passwd.c,v
             retrieving revision 1.20
             retrieving revision 1.21
             diff -u -r1.20 -r1.21
             --- lib/libutil/passwd.c        1998/11/16 07:10:32     1.20
             +++ lib/libutil/passwd.c        2000/06/30 16:00:07     1.21
             @@ -579,7 +579,7 @@
                     char   *master = pw_file(_PATH_MASTERPASSWD);
              
                     if (err)
             -               warn(name);
             +               warn("%s", name);
                     if (master)
                             warnx("%s: unchanged", master);
                     pw_abort();