Date: Wed, 17 Sep 1997 17:33:33 +0000 (GMT) From: Alfred Perlstein <perlsta@fang.cs.sunyit.edu> To: Simon Shapiro <Shimon@i-Connect.Net> Cc: freebsd-security@FreeBSD.ORG, Christian Hudon <S1205299.ber@student.goethe.de>, security@debian.org Subject: Re: FW: CERT Advisory CA-97.23 - rdist (fwd) Message-ID: <Pine.BSF.3.95.970917173305.25735A-100000@fang.cs.sunyit.edu> In-Reply-To: <XFMail.970917090526.Shimon@i-Connect.Net>
next in thread | previous in thread | raw e-mail | index | archive | help
last i checked rdist is NOT setuid on FreeBSD no hole! On Wed, 17 Sep 1997, Simon Shapiro wrote: > I know we have a (much) superior O/S, but it never hurts to ask. Right? > > Simon > > ----- Forwarded Message ----: > <Pine.PMDF.3.95.970917173103.76241J-100000@ber>----- > > Date: Wed, 17 Sep 1997 17:31:27 +0200 (MET-DST) > From: Christian Hudon <S1205299.ber@student.goethe.de> > To: security@debian.org > Subject: CERT Advisory CA-97.23 - rdist (fwd) > > Are we vulnerable to that one? > > Christian > > ---------- Forwarded message ---------- > Date: Tue, 16 Sep 1997 14:26:13 -0500 > From: Aleph One <aleph1@DFW.NET> > Reply-To: cert-advisory-request@cert.org > To: BUGTRAQ@NETSPACE.ORG > Subject: CERT Advisory CA-97.23 - rdist > > -----BEGIN PGP SIGNED MESSAGE----- > > ============================================================================ > = > CERT* Advisory CA-97.23 > Original issue date: September 16, 1997 > Last revised: -- > > Topic: Buffer Overflow Problem in rdist > - > ---------------------------------------------------------------------------- > - > > The CERT Coordination Center has received reports of a vulnerability in > rdist > that enables anyone with access to a local account to gain root privileges. > This is not the same vulnerability as the one discussed in CA-96.14. > > Section III.A contains instructions on how to determine if your site is > vulnerable. If your implementation of rdist is vulnerable, the CERT/CC team > encourages you to follow your vendor's instructions (Sec. III.B and Appendix > A) or install a freely available version of the rdist program that is not > installed as set-user-id root and is, therefore, not susceptible to the > exploitation described in this advisory (Sec. III.C). > > For information on the earlier problem with rdist, see > ftp://info.cert.org/pub/cert_advisories/CA-96.14.rdist_vul > > We will update this advisory as we receive additional information. > Please check our advisory files regularly for updates that relate to your > site. > > - > ---------------------------------------------------------------------------- > - > > I. Description > > The rdist program is a UNIX Operating System utility used to > distribute files from one host to another. On some systems, rdist > opens network connections using a privileged port as the source port. > This requires root privileges, and to attain these privileges rdist on > such systems is installed set-user-id root. > > A new vulnerability has been found in some set-user-id root > implementations of rdist. The vulnerability lies in the function > expstr(), where macros supplied as arguments are expanded using > sprintf(). It is possible to overwrite stack frames and call specially > pre-crafted native machine code. If the appropriate machine code is > supplied, an attacker can execute arbitrary programs (such as the > shell) with set-user-id root privileges. > > Note that this vulnerability is distinct from that discussed in CERT > advisory CA-96.14. > > > II. Impact > > On systems with a vulnerable copy of rdist, anyone with access to a > local account can gain root access. > > > III. Solution > > We urge you to follow the steps in Section A to determine if your > system is vulnerable and, if it is, to turn off rdist while you decide > how to proceed. > > If your system is vulnerable and you need the functionality that rdist > provides, you should install a vendor patch (Section B). Until you can > do so, you may want to use a freely available version of rdist that > does not need to be installed as set-user-id root and is, therefore, > not susceptible to the exploitation described in this advisory > (Section C). > > A. How to check for set-user-id root versions of rdist > > To find set-user-id root versions of rdist and to disable the > programs that are possibly vulnerable, use the following find > command or a variant. Consult your local system documentation to > determine how to tailor the find program on your system. > > You will need to run the find command on each system you maintain > because the command examines files on the local disk only. > Substitute the names of your local file systems for > FILE_SYSTEM_NAMES in the example. Example local file system names > are /, /usr, and /var. You must do this as root. > > Note that this is one long command, though we have separated > it onto three lines using backslashes. > > find FILE_SYSTEM_NAMES -xdev -type f -user root \ > -name '*rdist*' -perm -04000 -exec ls -l '{}' \; \ > -ok chmod 0500 '{}' \; > > This command will find all files on a system that > - are only in the file system you name (FILE_SYSTEM_NAMES -xdev) > - are regular files (-type f) > - are owned by root (-user root) > - have "rdist" as a component of the name (-name '*rdist*') > - are setuid (-perm -04000) > > Once found, those files will > - have their names and details printed (-exec ls -l '{}') > - have the setuid mode removed (making the file available > only to root) but only if you type `y' in response to the > prompt (-ok chmod 0500 '{}' \;) > > B. Obtain and install the appropriate patch > > Below is a list of vendors who have provided information for this > advisory. Details are in Appendix A, and we will update the appendix > as we receive more information. > > Berkeley Software Design, Inc. (BSDI) > Digital Equipment Corp. > FreeBSD, Inc. > Hewlett-Packard Company > IBM Corporation > NEC Corporation > The Santa Cruz Operation, Inc. (SCO) > Siemens-Nixdorf > Silicon Graphics Inc. (SGI) > Sun Microsystems, Inc. > > If your vendor's name is not on this list, please contact the > vendor directly. > > C. If you need the functionality that rdist provides but a patched > version is not yet available from your vendor, consider installing > rdist-6.1.3, which is freely available from > > ftp://usc.edu/pub/rdist/rdist-6.1.3.tar.gz > > MD5 (rdist-6.1.3.tar.gz) = 8a76b880b023c5e648b7cb77b9608b9f > > The README file in the distribution explains how to configure and > install this version of rdist. > > We recommend that you configure this version of rdist to use rsh > instead of rcmd. Here is the relevant text from the README: > > By default rdist uses rsh(1c) to make connections to remote > hosts. This has the advantage that rdist does not need to be > setuid to "root". This eliminates most potential security > holes. It has the disadvantage that it takes slightly more time > for rdist to connect to a remote host due to the added overhead > of doing a fork() and then running the rsh(1c) command. > > Some sites with sufficient expertise use the ssh program in > conjunction with rdist, instead of using rcmd or rsh. If you have > the expertise, you may want to implement this configuration. > > For further details on this option see "Ssh (Secure Shell) FAQ - > Frequently asked questions," Section 4.4, "Can I use rdist with > ssh?" > It is available from > > http://www.uni-karlsruhe.de/~ig25/ssh-faq/ssh-faq-4.html > > For details on how to obtain ssh, see FAQ Section 3.4, "Where can I > obtain ssh?" This section can be found in > > http://www.uni-karlsruhe.de/~ig25/ssh-faq/ssh-faq-3.html > > > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > > Appendix A - Vendor Information > > Below is a list of the vendors who have provided information for this > advisory. We will update this appendix as we receive additional information. > If you do not see your vendor's name, the CERT/CC did not hear from that > vendor. Please contact the vendor directly. > > > Berkeley Software Design, Inc. (BSDI) > ===================================== > BSDI shipped a patch for this for our 2.1 release (U210-018) when > the original Bugtraq advisory was released. The 3.0 version of > rdist is not vulnerable and in fact is no longer even setuid. > > > Digital Equipment Corp. > ======================= > This reported problem is not present for Digital's ULTRIX or Digital UNIX > Operating Systems Software. > > DIGITAL EQUIPMENT CORPORATION > ----------------------------- > > FreeBSD, Inc. > ============= > 2.1.0 is vulnerable. > 2.1.5, 2.1.6 and 2.1.7 are and 2.1-stable are not. In any case, upgrading > to 2.1.7 or even better, 2.1-stable should be considered. > If there is demand, we'll release a patch for 2.1.0 > > All 2.2 releases, 2.2-stable and FreeBSD-current are not vulnerable. > > > Hewlett-Packard Company > ======================= > HP is -not- vulnerable; the problem didn't exist in 9.X, and has been > fixed > in 10.X with Security Bulletin #36 (HPSBUX9608-036) last year. Patch > numbers change frequently because of cumulative patching, so please check > current patch ID information either by bulletin or by platform/release at > our HP Electronic Support Center in the "Security Patch Matrix," which is > updated every 24 hours. > > 1) From your Web browser, access the URL: > > http://us-support.external.hp.com (US,Canada,Asia-Pacific, > and Latin-America) > > http://europe-support.external.hp.com (Europe) > > 2) On the HP Electronic Support Center main screen, select the > hyperlink "Support Information Digests". > > > 3) On the "Welcome to HP's Support Information Digests" screen, > under the heading "Register Now", select the appropriate hyperlink > "Americas and Asia-Pacific", or "Europe". > > 4) On the "New User Registration" screen, fill in the fields > for the User Information and Password and then select the button > labeled "Submit New User". > > 5) On the "User ID Assigned" screen, select the hyperlink > "Support Information Digests". > > **Note what your assigned user ID and password are for future > reference. > > 6) You should now be on the "HP Support Information Digests Main" > screen. You might want to verify that your email address is > correct as displayed on the screen. From this screen, you may > also view/subscribe to the digests, including the security > bulletins digest. > > To get a patch matrix of current HP-UX and BLS security > patches referenced by either Security Bulletin or Platform/OS, > click on following screens in order: > Technical Knowledge Database > Browse the HP Security Bulletins Archive > HP-UX Security Patch Matrix > > > IBM Corporation > =============== > All versions of AIX are vulnerable to this buffer overflow. There is > no 3.2 fix. It is recommended that 3.2 customers upgrade to a higher > level. The following APARs will be available for AIX version 4 > soon. > > AIX 3.2: upgrade to 4.1.5 or higher > AIX 4.1: IX70876 > AIX 4.2: IX70875 > > To Order > -------- > APARs may be ordered using Electronic Fix Distribution (via FixDist) > or from the IBM Support Center. For more information on FixDist, > reference URL: > > http://service.software.ibm.com/aixsupport/ > > or send e-mail to aixserv@austin.ibm.com with a subject of "FixDist". > > IBM and AIX are registered trademarks of International Business Machines > Corporation. > > > NEC Corporation > =============== > The following systems are NOT affected by this vulnerability: > > UX/4800 > UX/4800(64) > EWS-UX/V(Rel4.2MP) > EWS-UX/V(Rel4.2) > UP-UX/V(Rel4.2MP) > > To report a new vulnerability, contact <UX48-security-support@nec.co.jp>. > > > The Santa Cruz Operation, Inc. (SCO) > ==================================== > SCO has determined that the following SCO operating systems are > not vulnerable: > > - SCO CMW+ 3.0 > - SCO Open Desktop/Open Server 3.0 > - SCO OpenServer 5.0 > - SCO UnixWare 2.1 > > > Siemens-Nixdorf Informationssysteme AG > ====================================== > Siemens-Nixdorf does not ship rdist. > > > Silicon Graphics Inc. (SGI) > =========================== > At this time, Silicon Graphics does not have any public information for > the > rdist buffer overflow issue. Silicon Graphics has communicated with > CERT/CC > and other external security parties and is actively investigating this > issue. When more Silicon Graphics information (including any possible > patches) is available for release, that information will be released via > the > SGI security mailing list, wiretap. > > For subscribing to the wiretap mailing list and other SGI security related > information, please refer to the Silicon Graphics Security Headquarters > website located at: > > http://www.sgi.com/Support/security/security.html > > > Sun Microsystems, Inc. > ====================== > We are producing patches. > > - > ---------------------------------------------------------------------------- > - > > The CERT Coordination Center thanks Hiroshi Nakano of Ryukoku University, > Japan for reporting this problem. We also thank Wolfgang Ley of DFN-CERT > for his assistance with the Solutions section of the advisory. > > - > ---------------------------------------------------------------------------- > - > > If you believe that your system has been compromised, contact the CERT > Coordination Center or your representative in the Forum of Incident Response > and Security Teams (see http://www.first.org/team-info/). > > > CERT/CC Contact Information > - ---------------------------- > Email cert@cert.org > > Phone +1 412-268-7090 (24-hour hotline) > CERT personnel answer 8:30-5:00 p.m. EST(GMT-5) / EDT(GMT-4) > and are on call for emergencies during other hours. > > Fax +1 412-268-6989 > > Postal address > CERT Coordination Center > Software Engineering Institute > Carnegie Mellon University > Pittsburgh PA 15213-3890 > USA > > Using encryption > We strongly urge you to encrypt sensitive information sent by email. We > can > support a shared DES key or PGP. Contact the CERT/CC for more > information. > Location of CERT PGP key > ftp://info.cert.org/pub/CERT_PGP.key > > Getting security information > CERT publications and other security information are available from > http://www.cert.org/ > ftp://info.cert.org/pub/ > > CERT advisories and bulletins are also posted on the USENET newsgroup > comp.security.announce > > To be added to our mailing list for advisories and bulletins, send > email to > cert-advisory-request@cert.org > In the subject line, type > SUBSCRIBE your-email-address > > - > --------------------------------------------------------------------------- > Copyright 1997 Carnegie Mellon University. Conditions for use, disclaimers, > and sponsorship information can be found in > http://www.cert.org/legal_stuff.html and > ftp://info.cert.org/pub/legal_stuff . > If you do not have FTP or web access, send mail to cert@cert.org with > "copyright" in the subject line. > > *CERT is registered in the U.S. Patent and Trademark Office. > > - > --------------------------------------------------------------------------- > > This file: ftp://info.cert.org/pub/cert_advisories/CA-97.23.rdist > http://www.cert.org > click on "CERT Advisories" > > > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > Revision history > > > > -----BEGIN PGP SIGNATURE----- > Version: 2.6.2 > > iQCVAwUBNB6ULXVP+x0t4w7BAQF7OgP9FBPOVv0sieagN7Qpbt6nykgKYd8yvi6x > Tp4vdUsFEZBjyO8jA3eSyBpjcOBouhZhpCnaGtinZoCmYV+Mks/I4OnrVTyDMtmH > DiDmGtzNwAMdAPn49bAgyGQsObUJ9v6hnHl34JbylJJ2h471AltdeoBtbrxwdE6d > 4iv8mwfbQ5M= > =QTr5 > -----END PGP SIGNATURE----- > > > -- > TO UNSUBSCRIBE FROM THIS MAILING LIST: e-mail the word "unsubscribe" to > debian-private-request@lists.debian.org . > Trouble? e-mail to templin@bucknell.edu . > > > --------------End of forwarded message------------------------- > > --- > > > Sincerely Yours, (Sent on 17-Sep-97, 08:51:44 > by XF-Mail) > > Simon Shapiro Atlas Telecom > Senior Architect 14355 SW Allen Blvd., Suite 130 Beaverton OR 97005 > Shimon@i-Connect.Net Voice: 503.643.5559, Emergency: 503.799.2313 >
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.3.95.970917173305.25735A-100000>