Date: Sun, 2 Mar 2008 09:11:44 +0300 From: Eygene Ryabinkin <rea-fbsd@codelabs.ru> To: freebsd-security@freebsd.org Cc: sipherr@gmail.com Subject: Re: *BSD user-ppp local root (when conditions permit) Message-ID: <b6%2BdwiWTUoSsMesVYHLwZcXnaBY@nE9n69L2PrcQKa%2Be6OgU6kZtlVg> In-Reply-To: <eJwztaR4hgj0LBOZtN1f3kC2qd8@49l6neKHPg6j4SHeejH198Klzys> References: <20080229163903.3680.qmail@securityfocus.com> <eJwztaR4hgj0LBOZtN1f3kC2qd8@49l6neKHPg6j4SHeejH198Klzys>
next in thread | previous in thread | raw e-mail | index | archive | help
Me again. Sun, Mar 02, 2008 at 02:06:34AM +0300, Eygene Ryabinkin wrote: > Fri, Feb 29, 2008 at 04:39:03PM -0000, sipherr@gmail.com wrote: > > I just tested this on FreeBSD 6.3. This bug was discovered on NetBSD. It also works on OpenBSD (unconfirmed on 4.2) > > > > Steps to reproduce: > > > > 1. Run ppp > > > > 2. type the following (or atleat some variation of) > > > > ~/~/~/~/~/~/~/~/~/~/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx > > > > > > > > This will produce a segmentation violation (Core dumped). > > Yes, good catch: looks like stack-based buffer overflow. Also works > on FreeBSD 7.0. Could you please test the following rough patch -- > it seem to cure the situation. Although it is a bit late for > today and I will recheck it more carefully tomorrow. About the possible exploitation scenarios: I see two of them in the default FreeBSD installation, when ppp is setuid root and permitted to run only for root and the 'network' group. a) Trusted users from the group 'network': interactive privilege escalation and local root exploit. b) Trusted users who can modify ppp's configuration files: non-interactive escalation and local root exploit (remote root exploit in the setups where some Web interface to the PPP configuration and like exists). Had I missed something? -- Eygene
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?b6%2BdwiWTUoSsMesVYHLwZcXnaBY>