oss-sec mailing list archives
Debian Exim Spool Local Root
From: halfdog <me () halfdog net>
Date: Thu, 30 Jun 2016 04:00:46 +0000
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello List, This is just a minor issue in Exim, no replies so far, so publication should be OK. Introduction: ============ Exim4 in some variants is started as root but switches to uid/gid Debian-exim/Debian-exim. But as Exim might need to store received messages in user mailboxes, it has to have the ability to regain privileges. This is also true when Exim is started as "sendmail". During internal operation, sendmail (Exim) will manipulate message spool files in directory structures owned by user "Debian-exim" without caring about symlink attacks. Thus execution of code as user "Debian-exim" can be used to gain root privileges by invoking "sendmail" as user "Debian-exim". POC: === http://www.halfdog.net/Security/2016/DebianEximSpoolLocalRoot/EximUpgrade.c demonstrates the issue using a ELF file being both executable and shared library which is invoked multiple times by different processes. Results, Discussion: =================== As Exim4 process itself is already quite privileged - it has to access the user mailboxes with different UIDs anyway - the having such problems is expectable and explainable. A change in documentation might make sense, to indicate, that the special user "Debian-exim" is only intended to mark files being used by the daemon, but not to provide root/daemon user privilege separation. Even without this vulnerability, a "Debian-exim" process could use http://www.halfdog.net/Security/2015/SetgidDirectoryPrivilegeEscalation/ to escalate to "adm" group, which again makes it very likely to use "syslog", "apache" or other components to escalate to root via "/var/log". This is annoying, perhaps this should get a CVE to make daemon-to-root escalations harder in general. Timeline: ======== 20160605: Discovery, report Debian security 20160607: Writeup 20160611: Also verified in Ubuntu, https://bugs.launchpad.net/ubuntu/+source/exim4/+bug/1580454/ 20160630: Publication References: ========== * http://www.halfdog.net/Security/2016/DebianEximSpoolLocalRoot/ * http://www.halfdog.net/Security/2015/SetgidDirectoryPrivilegeEscalation/ * https://bugs.launchpad.net/ubuntu/+source/exim4/+bug/1580454/ -----BEGIN PGP SIGNATURE----- iEYEAREKAAYFAld0lPUACgkQxFmThv7tq+5MeACePVuh5CppGyhUudMfK7kjDXjj 8mcAn2AcZFVEwUKSHadffJJyCNLP0X7H =4IJk -----END PGP SIGNATURE-----
Current thread:
- Debian Exim Spool Local Root halfdog (Jun 29)
- <Possible follow-ups>
- Re: Debian Exim Spool Local Root Yves-Alexis Perez (Jun 30)