[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

this are not release critical, or a security hole



severity 24905 normal
thanks

This is not a critical bug report. In fact, I disagree it is a bug at all.

> cfingerd version 1.3.2 runs all external executables and
> scripts with root privileges.  This includes fake user
> scripts, user invoked scripts and all helper applications.

> This is likely to open up all kinds of security holes
> because these scripts were never written to be run
> as suid root.

> The bug has been confirmed through source code review and
> testing on a single machine.  Independent confirmation should
> be obtained just in case I am mistaken anyway.

I fail to understand how you have "confirmed" a bug which is only "likely"
to exist. Anyway, debian cfingerd ships with _no_ fake user scripts
enabled, so this is _not_ a security hole present in the debian package.

joey@kite:/tmp/cfingerd-1.3.2/scripts>dpkg -L cfingerd |grep /etc
/etc
/etc/cfingerd
/etc/cfingerd/scripts
/etc/cfingerd/top_finger.txt
/etc/cfingerd/bottom_finger.txt
/etc/cfingerd/noname_banner.txt
/etc/cfingerd/nouser_banner.txt
/etc/cfingerd/rejected_banner.txt
/etc/cfingerd/cfingerd.conf
/etc/cron.weekly
/etc/cron.weekly/cfingerd

Look ma, no scripts!

> For more information, please read privs.h in the cfingerd
> source and understand, that as long as cfingerd can issue
> a sequence of system calls to regain root privileges, so
> can any script invoked from cfingerd, as well as any
> code a hacker may fool cfingerd into executing (e.g. by
> means of a buffer overrun).

I'm sorry, but this is flat out, 100% _wrong_. After an exec() system call,
the saved uid is lost. Therefore, a child program cannot use it to regain
suid root permissions.

W. Richard Stevens, Advanced Programming in the Unix
Environment, page 213: "The saved set-user-ID is copied from the
effective user ID by exec."

> Luckily most, but not all external scripts have been disabled
> in the default Debian configuration.  One of the remaining
> scripts is a pipe invoked when fingering userlist-only@hostname.

> As a simple test, enable a fakeuser and modify the script to look
> like this:

> #!/bin/bash
> echo ${UID} ${EUID}

> Then finger the fakeuser and notice that the output looks like
> this:

> 0 0

> meaning root root!

So what? You were root. You edited /etc/cfingerd/cfingerd.conf. You told it
to run this program. Only root may do this. The fact that the program runs
as root is not a security hole, because only root can set it up to run this
way.

> I am now using Debian 2.0 kernel 2.0.33 (compiled by me) libc-2.0.7.
> I am not currently running cfingerd, but am keeping a copy in
> non-executable form.

> -- 
> This message is hastily written, please ignore any unpleasant wordings,
> do not consider it a binding commitment, even if its phrasing may
> indicate so. Its contents may be deliberately or accidentally untrue.
> Trademarks and other things belong to their owners, if any.

-- 
see shy jo


--  
To UNSUBSCRIBE, email to debian-devel-request@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org


Reply to: