Bugtraq mailing list archives
NetBSD Security Advisory 1999-011
From: ross () GHS COM (Ross Harvey)
Date: Sun, 8 Aug 1999 19:42:14 -0700
-----BEGIN PGP SIGNED MESSAGE----- NetBSD Security Advisory 1999-011 ================================= Topic: profil(2) can modify setuid root programs Version: all versions of NetBSD prior to 1.4.1 Severity: theoretical problem only, no known exploits Abstract ======== As part of an ongoing effort to construct a completely secure kernel and application environment, the NetBSD project has identified and corrected a possible security issue. A wrapper program can be constructed by a local user that can modify the internal data space of a program it execve(2)'s in a partially predictable way, including setuid root binaries. It might be possible to write a security-related exploit via this mechanism. Technical Details ================= NetBSD uses a profil(2) system call that dates back to "version 6" unix. This system call arranges for the kernel to sample the PC and increment an element of an array on every profile clock tick. The security issue stems from the fact that profiling is not turned off when a process execve(2)'s another program image. As the size and location of this array as well as the scale factor are under the program's control, it is possible to arrange for an arbitrary 16-bit program virtual address to be incremented on each profile clock tick. Although unlikely, it is theoretically possible that an attacker with local access and knowledge of the addresses used by privileged programs could construct an exploit. It may be that there are no candidate addresses that, when incremented, result in a security failure. However, as this can turn -1 into 0, and 0 into 1, and as security-related system calls and library functions often return either -1 or 0, this mechanism could turn system call returns of success into failure or failure into success if a program stores system call results into memory locations. Solutions and Workarounds ========================= Upgrade to NetBSD 1.4.1, NetBSD-current, or apply the following patch: Index: kern_exec.c =================================================================== RCS file: /cvsroot/syssrc/sys/kern/kern_exec.c,v retrieving revision 1.101 diff -u -w -u -r1.101 kern_exec.c - --- kern_exec.c 1999/04/27 05:28:44 1.101 +++ kern_exec.c 1999/08/06 07:19:24 @@ -415,6 +415,7 @@ goto exec_abort; } + stopprofclock(p); /* stop profiling */ fdcloseexec(p); /* handle close on exec */ execsigs(p); /* reset catched signals */ p->p_ctxlink = NULL; /* reset ucontext link */ Thanks To ========= Discovery of problem and kernel patch by Ross Harvey <ross () netbsd org>. Revision History ================ 1999/08/08 - initial version More Information ================ Information about NetBSD and NetBSD security can be found at http://www.NetBSD.ORG/ and http://www.NetBSD.ORG/Security/. Copyright 1999, The NetBSD Foundation, Inc. All Rights Reserved. $NetBSD: NetBSD-SA1999-011.txt,v 1.3 1999/08/09 02:38:00 mrg Exp $ -----BEGIN PGP SIGNATURE----- Version: 2.6.3ia Charset: noconv iQCVAwUBN64/JD5Ru2/4N2IFAQEEKwQAyG0W9xE76JLOVC829EQgVt85Ba56y4DV lwb45wvxQKmAqYRrvgxMU9rbH/WDKaCAGAQywAjTu2DITGPRw/THXIY7R1ioUIJI sOz7+zqxwVAJMQvx3qkQ19UFT1tmXFXeeHOYmorzet6cfY13H3xaLKFOWpmzuAiI 0rzmyEbaJa4= =prt9 -----END PGP SIGNATURE-----
Current thread:
- Cisco 675 password nonsense DeMoNx (Jul 31)
- Re: Cisco 675 password nonsense Brian Elfert (Aug 03)
- Re: Cisco 675 password nonsense Dave Dittrich (Aug 06)
- Microsoft Security Bulletin MS99-027 Microsoft Product Security Response Team (Aug 06)
- Re: Cisco 675 password nonsense Brian Elfert (Aug 06)
- Microsoft Security Bulletin (MS99-027) Aleph One (Aug 06)
- Re: Cisco 675 password nonsense Signal 11 (Aug 07)
- Remote DoS of WebTrends Enterprise Reporting Server rpc (Aug 08)
- sdtcm_convert Joel Eriksson (Aug 08)
- NetBSD Security Advisory 1999-011 Ross Harvey (Aug 08)
- MS IE FTP Folder Shell Extension Buffer Overflow s.hird () STUDENT QUT EDU AU (Aug 09)
- [jen () ettnet se: sdtcm_convert] Joel Eriksson (Aug 09)
- Bay Annex-Pri Privacy Issues lumpy (Aug 09)
- Re: Bay Annex-Pri Privacy Issues Eric Vyncke (Aug 10)
- Re: Bay Annex-Pri Privacy Issues Dick St.Peters (Aug 11)
- Re: Cisco 675 password nonsense Dave Dittrich (Aug 06)
- Re: Cisco 675 password nonsense Brian Elfert (Aug 03)
- <Possible follow-ups>
- Re: Cisco 675 password nonsense Francis Bodie (Aug 03)
- Cisco 675 password nonsense jobe smithe (Aug 09)