-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
NetBSD Security Advisory 2006-027
=================================
Topic: libc glob(3) buffer overflow
Version: NetBSD-current: source prior to September 13, 2005
NetBSD 4.0_BETA2: not affected
NetBSD 3.1: affected
NetBSD 3.0.*: affected
NetBSD 3.0: affected
NetBSD 2.1: affected
NetBSD 2.0.*: affected
NetBSD 2.0: affected
pkgsrc: 20040810 and earlier
Severity: Potential remote root for systems providing the
ftpd service
with a custom configuration.
Fixed: NetBSD-current: September 13, 2005
NetBSD-3-0 branch: December 2, 2006
NetBSD-3 branch: December 2, 2006
NetBSD-2-1 branch: December 2, 2006
NetBSD-2-0 branch: December 2, 2006
NetBSD-2 branch: December 2, 2006
pkgsrc: tnftpd-20040810nb1 corrects this issue
Abstract
========
A flaw in glob(3) could potentially allow for the execution
of untrusted code.
Currently the NetBSD ftp daemon that ships with the base
distribution uses
glob(3) which has been found to be potentially vulnerable to
attack. In
addition to this there may be other applications/network
services which
use glob(3) which are also potentially vulnerable.
In the case of ftpd the server must be configured to allow
remote users
to create directories in order for attackers to exploit this
issue.
Technical Details
=================
The limit computation of an internal buffer was done
incorrectly. The
size of the buffer in byte was used as element count, even
though the
elements of the buffer are 2 bytes long. Long expanded path
names would
therefore overflow the buffer.
Solutions and Workarounds
=========================
* Determining if you could be vulnerable (inetd):
By default ftpd is not enabled in the default install of
NetBSD.
To confirm if the host in question is running ftpd, check
the ftp
entries in /etc/inetd.conf. By default, the entries look
like this:
#ftp stream tcp nowait root /usr/libexec/ftpd ftpd -ll
#ftp stream tcp6 nowait root /usr/libexec/ftpd ftpd -ll
If the comment character (#) has been removed from the start
of the
lines, then ftpd has been enabled on this host. Hosts not
running ftpd
are not vulnerable, but libc should be updated to prevent
future
exposure if ftpd is enabled at a later date.
* Disable ftpd (inetd):
As root, comment out the ftp lines in /etc/inetd.conf, and
execute the
following command to disable ftpd:
% /etc/rc.d/inetd reload
* Determining if you could be vulnerable (standalone):
On NetBSD-current it is also possible to run ftpd in
standalone
mode by adding the following to rc.conf:
ftpd=YES
If this entry exists then ftpd is being run in standalone
mode.
* Disable ftpd (standalone):
As root, comment out the ftpd line in rc.conf, and execute
the following
command to disable ftpd:
% /etc/rc.d/ftpd forcestop
* Limit directory creation:
Another possible workaround is to not allow remote users to
create
directories of their choice on the ftpd server.
* Directory names:
If you allow users to create directories of their own choice
check
for very long directory names.
* Drop root privileges:
As root, add -r to the command line options for any ftp
entry in
/etc/inetd.conf. Then run:
% /etc/rc.d/inetd reload
This option may not be acceptable at all sites, since client
compatibility
issues are possible. See the ftpd(8) man page for more
details about -r.
The following instructions describe how to upgrade your libc
binaries
by updating your source tree and rebuilding and installing a
new version
of libc.
* NetBSD-current:
Systems running NetBSD-current dated from before 2005-09-13
should be upgraded to NetBSD-current dated 2005-09-14 or
later.
The following files need to be updated from CVS HEAD:
lib/libc/gen/glob.c
To update from CVS, re-build, and re-install libc:
# cd src
# cvs update lib/libc/gen/glob.c
# cd lib/libc
# make USETOOLS=no cleandir dependall
# make USETOOLS=no install
# cd ../../libexec/ftpd
# make USETOOLS=no cleandir dependall
# make USETOOLS=no install
* NetBSD 3.*:
Systems running NetBSD 3.* sources dated from before
2006-12-02 should be upgraded from NetBSD 3.* sources dated
2006-12-03 or later.
The following files need to be updated from the
netbsd-3, netbsd-3-0, netbsd-3-1 CVS branches:
lib/libc/gen/__glob13.c
To update from CVS, re-build, and re-install libc:
# cd src
# cvs update lib/libc/gen/__glob13.c
# cd lib/libc
# make USETOOLS=no cleandir dependall
# make USETOOLS=no install
# cd ../../libexec/ftpd
# make USETOOLS=no cleandir dependall
# make USETOOLS=no install
* NetBSD 2.*:
Systems running NetBSD 2.* sources dated from before
2006-12-02 should be upgraded from NetBSD 2.* sources dated
2006-12-03 or later.
The following files need to be updated from the
netbsd-2, netbsd-2-0 or netbsd-2-1 CVS branches:
lib/libc/gen/__glob13.c
To update from CVS, re-build, and re-install libc:
# cd src
# cvs update lib/libc/gen/__glob13.c
# cd lib/libc
# make USETOOLS=no cleandir dependall
# make USETOOLS=no install
# cd ../../libexec/ftpd
# make USETOOLS=no cleandir dependall
# make USETOOLS=no install
Thanks To
=========
Tomas Skare for reporting this issue and the initial
analysis.
Revision History
================
2006-12-14 Initial release
More Information
================
Advisories may be updated as new information becomes
available.
The most recent version of this advisory (PGP signed) can be
found at
ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-S
A2006-027.txt.asc
Information about NetBSD and NetBSD security can be found at
http://www.NetBSD.org/
and http://www.NetBSD.or
g/Security/.
Copyright 2006, The NetBSD Foundation, Inc. All Rights
Reserved.
Redistribution permitted only in full, unmodified form.
$NetBSD: NetBSD-SA2006-027.txt,v 1.4 2006/12/14 20:13:16
adrianp Exp $
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (NetBSD)
iQCVAwUBRYGx2T5Ru2/4N2IFAQJbLAQAhHlwMkZdBnPhI2hFnp89DkfXvrDD
QF8h
i0R4kO1BpLLFUmFfwNyQeNbRPLvfO6L5XNXMo03xAoXvbm/idhcIBXc14ays
P1zG
g9HnRmthejogSI96KDtng/AWBWl3qMxIALTaOqe6uhQrYIqPbi+ITyKx3YB/
gbO9
SJ28zBZQcQ0=
=4daO
-----END PGP SIGNATURE-----
|