FreeBSD bug grants local root access (FreeBSD 6.x)

[Frederique Rijsdijk-2]

Hi,

Any info on this subject on

http://www.theregister.co.uk/2009/09/14/freebsd_security_bug/



-- Frederique
_______________________________________________
freebsd-security@... mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@..."

[Chris Rees]

On 15 Sep 2009 08:43, Frederique Rijsdijk <frederique@...> wrote:


> Hi,



> Any info on this subject on



> http://www.theregister.co.uk/2009/09/14/freebsd_security_bug/




It appears to only affect 6.x.... and requires local access. If an attacker  
has local access to a machine you're screwed anyway.

Chris
_______________________________________________
freebsd-security@... mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@..."

[Xin LI-2]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

Frederique Rijsdijk wrote:
> Hi,
>
> Any info on this subject on
>
> http://www.theregister.co.uk/2009/09/14/freebsd_security_bug/

Currently we (secteam@) are testing the correction patch and do
peer-review on the security advisory draft, the bug was found and fixed
on -HEAD and 7-STABLE before 7.1-RELEASE during some stress test but was
not recognized as a security vulnerability at that time.  The exploit
code has to be executed locally, i.e. either by an untrusted local user,
or be exploited in conjunction with some remote vulnerability on
applications that allow the attacker to inject their own code.

We can not release further details about the problem at this time,
though, but I think we will likely to publish the advisory and
correction patch this patch Wednesday.

Cheers,
- --
Xin LI <delphij@...> http://www.delphij.net/
FreeBSD - The Power to Serve!
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.12 (FreeBSD)

iEYEARECAAYFAkqvWZgACgkQi+vbBBjt66DAwACdHwj+VB8Ak0oRwhiH7X16+2Wl
nU0An2bMd4Y40DqCUJI+DEmNmozmm7fz
=+LtQ
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-security@... mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@..."

[Chris Palmer-3]

utisoft@... writes:

> It appears to only affect 6.x.... and requires local access. If an
> attacker has local access to a machine you're screwed anyway.

No, the thing you're screwed anyway by is local *physical* access. Merely
running a process as a non-root local user should *not* be a "you're screwed
anyway" scenario. The fundamental security guarantee of a modern operating
system is that different principals cannot affect each other's resources
(user chris cannot read or write user jane's email -- let alone root's
email). This bug breaks that guarantee, and is definitely not a ho-hum bug.

Remote exploits, which I agree are even worse, are in a sense a special case
of breaking the same guarantee: the pseudo-principal "anonymous maniac from
the Internet" can affect user root's (or whoever's) resources. Some
operating systems even have an explicit "anonymous" user, but the point is
the same either way.


--
http://www.noncombatant.org/
http://hemiolesque.blogspot.com/

_______________________________________________
freebsd-security@... mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@..."

[Xin LI-2]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

utisoft@... wrote:
> It appears to only affect 6.x.... and requires local access. If an
> attacker has local access to a machine you're screwed anyway.

'local' here means login as a local user, i.e. ssh/telnet/etc, not
console access which seems to be what you mean by 'local access'.

Note that, in order to successfully exploit this vulnerability, a remote
attacker still need someone or something to run the code on their
behalf, typically this would have to be used in conjunction with some
other remote vulnerability (i.e. some popular remote admin tool that
allows you to upload and run something on web server's context, etc).

We are still working on this one, it looks like that we would need to
patch some other problems altogether.

Cheers,
- --
Xin LI <delphij@...> http://www.delphij.net/
FreeBSD - The Power to Serve!
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.12 (FreeBSD)

iEYEARECAAYFAkqwKwcACgkQi+vbBBjt66BtawCgsDhrON8DzvX7A6M1O37A2Qw6
/54An0CAgPeTTJcJKcdkVWcF9qX0FVuY
=EeKO
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-security@... mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@..."

[Xin LI-2]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Chris Palmer wrote:

> utisoft@... writes:
>
>> It appears to only affect 6.x.... and requires local access. If an
>> attacker has local access to a machine you're screwed anyway.
>
> No, the thing you're screwed anyway by is local *physical* access. Merely
> running a process as a non-root local user should *not* be a "you're screwed
> anyway" scenario. The fundamental security guarantee of a modern operating
> system is that different principals cannot affect each other's resources
> (user chris cannot read or write user jane's email -- let alone root's
> email). This bug breaks that guarantee, and is definitely not a ho-hum bug.

Exactly.  This type of vulnerability could turn into a serious threat if
being used with some other vulnerabilities that allows code injection,
which is worse.

Cheers,
- --
Xin LI <delphij@...> http://www.delphij.net/
FreeBSD - The Power to Serve!
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.12 (FreeBSD)

iEYEARECAAYFAkqwK+AACgkQi+vbBBjt66Cu2gCfQWDWssPUTP+YESUOS7pJXCal
TY0An332WH2WDUiF1vhlgOW+QUk9U0rk
=S2nD
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-security@... mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@..."

[Chris Rees]

2009/9/16 Xin LI <delphij@...>:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Chris Palmer wrote:
>> utisoft@... writes:
>>
>>> It appears to only affect 6.x.... and requires local access. If an
>>> attacker has local access to a machine you're screwed anyway.
>>
>> No, the thing you're screwed anyway by is local *physical* access. Merely
>> running a process as a non-root local user should *not* be a "you're screwed
>> anyway" scenario. The fundamental security guarantee of a modern operating
>> system is that different principals cannot affect each other's resources
>> (user chris cannot read or write user jane's email -- let alone root's
>> email). This bug breaks that guarantee, and is definitely not a ho-hum bug.
>
> Exactly.  This type of vulnerability could turn into a serious threat if
> being used with some other vulnerabilities that allows code injection,
> which is worse.
>
> Cheers,
> - --
> Xin LI <delphij@...>    http://www.delphij.net/

Ahem, I must read posts correctly first. Beg pardon, I'll type that
100 times this evening.

Chris

--
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
A: Top-posting.
Q: What is the most annoying thing in a mailing list?
_______________________________________________
freebsd-security@... mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@..."

[Mike Tancsa]

At 05:08 AM 9/15/2009, Xin LI wrote:

>-----BEGIN PGP SIGNED MESSAGE-----
>Hash: SHA1
>
>Hi,
>
>Frederique Rijsdijk wrote:
> > Hi,
> >
> > Any info on this subject on
> >
> > http://www.theregister.co.uk/2009/09/14/freebsd_security_bug/
>
>Currently we (secteam@) are testing the correction patch and do
>peer-review on the security advisory draft, the bug was found and fixed
>on -HEAD and 7-STABLE before 7.1-RELEASE during some stress test but was
>not recognized as a security vulnerability at that time.  The exploit
>code has to be executed locally, i.e. either by an untrusted local user,
>or be exploited in conjunction with some remote vulnerability on
>applications that allow the attacker to inject their own code.
>
>We can not release further details about the problem at this time,
>though, but I think we will likely to publish the advisory and
>correction patch this patch Wednesday.

Hi,
         Just wondering if there is any update on this issue ?

         ---Mike

--------------------------------------------------------------------
Mike Tancsa,                                      tel [phone]
Sentex Communications,                            mike@...
Providing Internet since 1994                    www.sentex.net
Cambridge, Ontario Canada                         www.sentex.net/mike

_______________________________________________
freebsd-security@... mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@..."

[Simon L. Nielsen]

On 2009.09.25 08:52:25 -0400, Mike Tancsa wrote:

> At 05:08 AM 9/15/2009, Xin LI wrote:
> >Frederique Rijsdijk wrote:
> > > Hi,
> > >
> > > Any info on this subject on
> > >
> > > http://www.theregister.co.uk/2009/09/14/freebsd_security_bug/
> >
> >Currently we (secteam@) are testing the correction patch and do
> >peer-review on the security advisory draft, the bug was found and fixed
> >on -HEAD and 7-STABLE before 7.1-RELEASE during some stress test but was
> >not recognized as a security vulnerability at that time.  The exploit
> >code has to be executed locally, i.e. either by an untrusted local user,
> >or be exploited in conjunction with some remote vulnerability on
> >applications that allow the attacker to inject their own code.
> >
> >We can not release further details about the problem at this time,
> >though, but I think we will likely to publish the advisory and
> >correction patch this patch Wednesday.
>
>          Just wondering if there is any update on this issue ?

It turned out more difficult to fix than expected and we (secteam)
didn't handle that as well as we should have, but I think we are
almost there so the advisory should be out soon - sometime this week
at the latest.

Sorry about the delay - this should have been fixed by now.

--
Simon L. Nielsen
FreeBSD Deputy Security Officer
_______________________________________________
freebsd-security@... mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@..."

[Jacques Marneweck-3]

Hi Simon,

Is there any further feedback regarding this bug?  Has anyone tested
to see if this also affects FreeBSD 5.x?

Regards
--jm

On Mon, Sep 28, 2009 at 9:22 PM, Simon L. Nielsen <simon@...> wrote:

> On 2009.09.25 08:52:25 -0400, Mike Tancsa wrote:
>> At 05:08 AM 9/15/2009, Xin LI wrote:
>> >Frederique Rijsdijk wrote:
>> > > Hi,
>> > >
>> > > Any info on this subject on
>> > >
>> > > http://www.theregister.co.uk/2009/09/14/freebsd_security_bug/
>> >
>> >Currently we (secteam@) are testing the correction patch and do
>> >peer-review on the security advisory draft, the bug was found and fixed
>> >on -HEAD and 7-STABLE before 7.1-RELEASE during some stress test but was
>> >not recognized as a security vulnerability at that time.  The exploit
>> >code has to be executed locally, i.e. either by an untrusted local user,
>> >or be exploited in conjunction with some remote vulnerability on
>> >applications that allow the attacker to inject their own code.
>> >
>> >We can not release further details about the problem at this time,
>> >though, but I think we will likely to publish the advisory and
>> >correction patch this patch Wednesday.
>>
>>          Just wondering if there is any update on this issue ?
>
> It turned out more difficult to fix than expected and we (secteam)
> didn't handle that as well as we should have, but I think we are
> almost there so the advisory should be out soon - sometime this week
> at the latest.
>
> Sorry about the delay - this should have been fixed by now.
>
> --
> Simon L. Nielsen
> FreeBSD Deputy Security Officer

--
Jacques Marneweck
http://www.powertrip.co.za/
http://www.powertrip.co.za/blog/
http://www.ataris.co.za/

#include <std/disclaimer.h>
_______________________________________________
freebsd-security@... mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@..."

[Bjoern A. Zeeb]

On Fri, 2 Oct 2009, Jacques Marneweck wrote:

Hi,

> Is there any further feedback regarding this bug?

There is progress.


>   Has anyone tested
> to see if this also affects FreeBSD 5.x?

FreeBSD 5.x is not a supported branch anymore, so it's unlikely that
anyone will check it.  See http://security.freebsd.org/#sup for a list
of branches SO/secteam care about.

/bz

--
Bjoern A. Zeeb         It will not break if you know what you are doing.
_______________________________________________
freebsd-security@... mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@..."