-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =============================================================================== >> CERT-NL, 01-Mar-2000 << >> All CERT-NL information has been moved to http://cert.surfnet.nl. Links << >> to CERT-NL information contained in this advisory are therefore outdated. << >> << >> CERT-NL also has stopped the CERT-CC-Mirror service. Due to this the << >> links to the CERT-CC mirror are obsolete. Visit the CERT-CC site for the << >> complete CERT-CC advisory texts: http://www.cert.org << =============================================================================== =============================================================================== Security Advisory CERT-NL =============================================================================== Author/Source : Gert Meijerink Index : S-96-23 Distribution : World Page : 1 Classification: External Version: 1 Subject : Vendor Initiated Bulletin: FreeBSD-vfsload Date : 20-may-96 =============================================================================== By courtesy of The FreeBSD Project, Inc. we received information on a vulnerability in FreeBSD 2.0, 2.0.5, 2.1, 2.1-stable, and 2.2-current. CERT-NL recommends to use the workaround provided until they can update their operating system to a version with this vulnerability fixed. ============================================================================== ============================================================================= FreeBSD-SA-96:09 Security Advisory The FreeBSD Project, Inc. Topic: unauthorized access via mount_union / mount_msdos (vfsload) Category: core Module: libc Announced: 1996-05-17 Affects: FreeBSD 2.0, 2.0.5, 2.1, 2.1-stable, and 2.2-current Corrected: 1996-05-17 2.1-stable and 2.2-current sources Source: FreeBSD native bug FreeBSD only: yes Patches: ftp://freebsd.org/pub/CERT/patches/SA-96:09/ ============================================================================= I. Background A bug was found in the vfsload(3) library call that affects all versions of FreeBSD from 2.0 through 2.2-CURRENT that caused a system vulnerability. This problem is present in all source code and binary distributions of FreeBSD version 2.x released before 1996-05-18. The FreeBSD project is aware of active exploits of this vulnerability. All FreeBSD users are encouraged to use the workaround provided until they can update their operating system to a version with this vulnerability fixed. II. Problem Description The mount_union and mount_msdos programs invoke another system utility in an insecure fashion while setuid root. III. Impact The problem could allow local users to gain unauthorized permissions. This vulnerability can only be exploited by users with a valid account on the local system. IV. Solution(s) Update operating system sources and binaries to FreeBSD 2.1-stable or FreeBSD 2.2-current as distributed later than 1996-05-18 or if you are currently running 2.1 or later, you may apply the solution patches available at the URL listed at the top of this message. The OS updates fix the actual problem in the vfsload(3) library routine. Once the vfsload() library routine is fixed, the workaround listed below is not necessary to solve this problem. However, an additional stability problem has come to light (ref. FreeBSD SA-96:10) so the FreeBSD project suggests using both the setuid workaround and the solution for best results. V. Workaround This vulnerability can quickly and easily be limited by removing the setuid permission bit from the mount_union and mount_msdos program. This workaround will work for all versions of FreeBSD affected by this problem. As root, execute the command: % chmod u-s /sbin/mount_union /sbin/mount_msdos then verify that the setuid permissions of the files have been removed. The permissions array should read "-r-xr-xr-x" as shown here: % ls -l /sbin/mount_union /sbin/mount_msdos -r-xr-xr-x 1 root bin 151552 Apr 26 04:41 /sbin/mount_msdos -r-xr-xr-x 1 root bin 53248 Apr 26 04:40 /sbin/mount_union In addition to changing the permissions on the executable files, if you have the source code installed, we suggest patching the sources so that mount_union will not be installed with the setuid bit set: *** /usr/src/sbin/mount_union/Makefile Sun Nov 20 14:47:52 1994 - - --- /usr/src/sbin/mount_union/Makefile Fri May 17 10:36:09 1996 *************** *** 8,14 **** CFLAGS+= -I${.CURDIR}/../../sys -I${MOUNT} .PATH: ${MOUNT} - - - BINOWN= root - - - BINMODE=4555 - - - .include - - --- 8,11 ---- *** /usr/src/sbin/i386/mount_msdos/Makefile Sun Dec 4 00:01:24 1994 - - --- /usr/src/sbin/i386/mount_msdos/Makefile Fri May 17 11:31:57 1996 *************** *** 6,14 **** SRCS= mount_msdos.c getmntopts.c MAN8= mount_msdos.8 - - - BINOWN= root - - - BINMODE= 4555 - - - MOUNT= ${.CURDIR}/../../mount CFLAGS+= -I${MOUNT} .PATH: ${MOUNT} - - --- 6,11 ---- ============================================================================= The FreeBSD Project, Inc. Web Site: http://www.freebsd.com/ Confidential contacts: security-officer@freebsd.org PGP Key: ftp://freebsd.org/pub/CERT/public_key.asc Security notifications: security-notifications@freebsd.org Security public discussion: security@freebsd.org ============================================================================== CERT-NL is the Computer Emergency Response Team for SURFnet customers. SURFnet is the Dutch network for educational, research and related institutes. CERT-NL is a member of the Forum of Incident Response and Security Teams (FIRST). All CERT-NL material is available under: http://cert.surfnet.nl/ In case of computer or network security problems please contact your local CERT/security-team or CERT-NL (if your institute is NOT a SURFnet customer please address the appropriate (local) CERT/security-team). CERT-NL is one/two hour(s) ahead of UTC (GMT) in winter/summer, i.e. UTC+0100 in winter and UTC+0200 in summer (DST). Email: cert-nl@surfnet.nl ATTENDED REGULARLY ALL DAYS Phone: +31 302 305 305 BUSINESS HOURS ONLY Fax: +31 302 305 329 BUSINESS HOURS ONLY Snailmail: SURFnet bv Attn. CERT-NL P.O. Box 19035 NL - 3501 DA UTRECHT The Netherlands NOODGEVALLEN: 06 22 92 35 64 ALTIJD BEREIKBAAR EMERGENCIES : +31 6 22 92 35 64 ATTENDED AT ALL TIMES CERT-NL'S EMERGENCY PHONENUMBER IS ONLY TO BE USED IN CASE OF EMERGENCIES: THE SURFNET HELPDESK OPERATING THE EMERGENCY NUMBER HAS A *FIXED* PROCEDURE FOR DEALING WITH YOUR ALERT AND WILL IN REGULAR CASES RELAY IT TO CERT-NL IN AN APPROPRIATE MANNER. CERT-NL WILL THEN CONTACT YOU. =============================================================================== -----BEGIN PGP SIGNATURE----- Version: PGP 6.5.1i iQA/AwUBOL6IJjSYjBqwfc9jEQIvXACfd1E+p3xEowr5NUTGA0xaw3l1DKkAniW0 jj4vlgjAl0khIT3fwNvwCd/v =LO+i -----END PGP SIGNATURE-----