[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Full-Disclosure] NetBSD Security Advisory 2003-011: off-by-oneerror in realpath(3)
- To: full-disclosure@lists.netsys.com
- Subject: [Full-Disclosure] NetBSD Security Advisory 2003-011: off-by-oneerror in realpath(3)
- From: "NetBSD Security Officer" <security-officer@NetBSD.org>
- Date: Mon, 4 Aug 2003 11:17:38 -0700
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.0.6336.0">
<TITLE>[Full-Disclosure] NetBSD Security Advisory 2003-011: off-by-one error in realpath(3)</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/plain format -->
<BR>
<BR>
<P><FONT SIZE=2>-----BEGIN PGP SIGNED MESSAGE-----<BR>
<BR>
<BR>
NetBSD Security Advisory 2003-011<BR>
=================================<BR>
<BR>
Topic: off-by-one error in realpath(3)<BR>
<BR>
Version: NetBSD-current: source prior to August 4, 2003<BR>
NetBSD 1.6.1: affected<BR>
NetBSD 1.6: affected<BR>
NetBSD-1.5.3: affected<BR>
NetBSD-1.5.2: affected<BR>
NetBSD-1.5.1: affected<BR>
NetBSD-1.5: affected<BR>
<BR>
Severity: Possible remote buffer overrun/root compromise<BR>
<BR>
Fixed: NetBSD-current: August 4, 2003<BR>
NetBSD-1.6 branch: August 5, 2003 (1.6.2 will include the fix)<BR>
NetBSD-1.5 branch: Awaiting pullups<BR>
<BR>
<BR>
Abstract<BR>
========<BR>
<BR>
In the library function realpath(3), there was a string manipulation<BR>
mistake which could lead to 1-byte buffer overrun. realpath(3) is<BR>
being used by important network daemons such as ftpd(8),<BR>
therefore the vulnerability could be remotely exploitable.<BR>
<BR>
Note: The same error remained in a derived function in the distribution<BR>
of the wu-ftpd server (Not part of NetBSD's base system). This<BR>
information has been available to the general public for a matter of<BR>
days now. Exploits have been released against wu-ftpd. They are probably<BR>
being written against other affected services as well. If you offer any<BR>
of the affected services, you are advised to patch your system<BR>
immediately.<BR>
<BR>
<BR>
Technical Details<BR>
=================<BR>
<BR>
<A HREF="http://www.kb.cert.org/vuls/id/743092";>http://www.kb.cert.org/vuls/id/743092</A><BR>
<BR>
Binaries in the NetBSD base system which use realpath(3) include:<BR>
<BR>
/bin/systrace<BR>
/usr/libexec/ftpd (*)<BR>
/sbin/mount<BR>
/sbin/umount<BR>
/usr/sbin/mountd (*)<BR>
/usr/bin/ssh<BR>
/usr/sbin/sshd (*)<BR>
/usr/libexec/sftp-server (*)<BR>
/usr/sbin/bootpd (*)<BR>
<BR>
Binaries marked (*) listen on network interfaces, and could be remotely<BR>
exploitable.<BR>
<BR>
<BR>
Solutions and Workarounds<BR>
=========================<BR>
<BR>
To fix this vulnerability you will need to upgrade your libc.<BR>
<BR>
The following instructions describe how to upgrade your libc<BR>
binaries by updating your source tree and rebuilding and<BR>
installing a new version of libc.<BR>
<BR>
Note that all statically-linked binaries, such as the following, must be<BR>
rebuilt:<BR>
- - binaries under /sbin and /bin for 1.5 and 1.6-based systems<BR>
- - binaries under /rescue for NetBSD-current systems<BR>
- - statically-linked binaries built by pkgsrc<BR>
<BR>
Also, running instances of daemons must be restarted, if you do not plan<BR>
to reboot the machine after the update of libc.<BR>
<BR>
<BR>
* NetBSD-current:<BR>
<BR>
Systems running NetBSD-current dated from before 2003-08-03<BR>
should be upgraded to NetBSD-current dated 2003-08-04 or later.<BR>
<BR>
The following directories need to be updated from the<BR>
netbsd-current CVS branch (aka HEAD):<BR>
lib/libc<BR>
<BR>
To update from CVS, re-build, and re-install libc and rescue:<BR>
# cd src<BR>
# cvs update -d -P lib/libc<BR>
<BR>
# cd lib/libc<BR>
# make USETOOLS=no cleandir dependall<BR>
# make USETOOLS=no install<BR>
<BR>
# cd ../../rescue<BR>
# make USETOOLS=no cleandir dependall<BR>
# make USETOOLS=no install<BR>
<BR>
(then, reboot, or restart affected daemons)<BR>
<BR>
* NetBSD 1.6, 1.6.1:<BR>
<BR>
The binary distributions of NetBSD 1.6 and 1.6.1 are vulnerable.<BR>
<BR>
Systems running NetBSD 1.6 sources dated from before<BR>
2003-08-04 should be upgraded from NetBSD 1.6 sources dated<BR>
2003-08-05 or later.<BR>
<BR>
NetBSD 1.6.2 will include the fix.<BR>
<BR>
The following directories need to be updated from the<BR>
netbsd-1-6 CVS branch:<BR>
lib/libc<BR>
<BR>
To update from CVS, re-build, and re-install libc and static<BR>
binaries:<BR>
<BR>
# cd src<BR>
# cvs update -d -P -r netbsd-1-6 lib/libc<BR>
<BR>
# cd lib/libc<BR>
# make USETOOLS=no cleandir dependall<BR>
# make USETOOLS=no install<BR>
<BR>
# cd ../../sbin<BR>
# make USETOOLS=no cleandir dependall<BR>
# make USETOOLS=no install<BR>
<BR>
# cd ../bin<BR>
# make USETOOLS=no cleandir dependall<BR>
# make USETOOLS=no install<BR>
<BR>
(then, reboot, or restart affected daemons)<BR>
<BR>
Alternatively, apply the following patch (with potential offset<BR>
differences):<BR>
<A HREF="ftp://ftp.netbsd.org/pub/NetBSD/security/patches/SA2003-011-realpath.patch";>ftp://ftp.netbsd.org/pub/NetBSD/security/patches/SA2003-011-realpath.patch</A><BR>
<BR>
To patch, re-build and re-install libc, and static binaries:<BR>
<BR>
# cd src<BR>
# patch < /path/to/SA2003-011-realpath.patch<BR>
<BR>
# cd lib/libc<BR>
# make USETOOLS=no cleandir dependall<BR>
# make USETOOLS=no install<BR>
<BR>
# cd ../../sbin<BR>
# make USETOOLS=no cleandir dependall<BR>
# make USETOOLS=no install<BR>
<BR>
# cd ../bin<BR>
# make USETOOLS=no cleandir dependall<BR>
# make USETOOLS=no install<BR>
<BR>
(then, reboot, or restart affected daemons)<BR>
<BR>
* NetBSD 1.5, 1.5.1, 1.5.2, 1.5.3:<BR>
<BR>
The binary distributions of NetBSD 1.5, 1.5.1, 1.5.2, and 1.5.3<BR>
are vulnerable.<BR>
<BR>
Changes have not yet been pulled up to the 1.5 source branch.<BR>
<BR>
Apply the following patch (with potential offset differences):<BR>
<A HREF="ftp://ftp.netbsd.org/pub/NetBSD/security/patches/SA2003-011-realpath.patch";>ftp://ftp.netbsd.org/pub/NetBSD/security/patches/SA2003-011-realpath.patch</A><BR>
<BR>
To patch, re-build and re-install libc, and static binaries:<BR>
<BR>
# cd src<BR>
# patch < /path/to/SA2003-011-realpath.patch<BR>
<BR>
# cd lib/libc<BR>
# make USETOOLS=no cleandir dependall<BR>
# make USETOOLS=no install<BR>
<BR>
# cd ../../sbin<BR>
# make USETOOLS=no cleandir dependall<BR>
# make USETOOLS=no install<BR>
<BR>
# cd ../bin<BR>
# make USETOOLS=no cleandir dependall<BR>
# make USETOOLS=no install<BR>
<BR>
(then, reboot, or restart affected daemons)<BR>
<BR>
<BR>
Thanks To<BR>
=========<BR>
<BR>
CERT<BR>
<BR>
<BR>
Revision History<BR>
================<BR>
<BR>
2003-08-04 Initial release<BR>
<BR>
<BR>
More Information<BR>
================<BR>
<BR>
Advisories may be updated as new information becomes available.<BR>
The most recent version of this advisory (PGP signed) can be found at<BR>
<A HREF="ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2003-011.txt.asc";>ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2003-011.txt.asc</A><BR>
<BR>
Information about NetBSD and NetBSD security can be found at<BR>
<A HREF="http://www.NetBSD.org/";>http://www.NetBSD.org/</A> and <A HREF="http://www.NetBSD.org/Security/";>http://www.NetBSD.org/Security/</A>.<BR>
<BR>
<BR>
Copyright 2003, The NetBSD Foundation, Inc. All Rights Reserved.<BR>
Redistribution permitted only in full, unmodified form.<BR>
<BR>
$NetBSD: NetBSD-SA2003-011.txt,v 1.7 2003/08/04 16:02:47 david Exp $<BR>
<BR>
-----BEGIN PGP SIGNATURE-----<BR>
Version: GnuPG v1.0.6 (NetBSD)<BR>
Comment: For info see <A HREF="http://www.gnupg.org";>http://www.gnupg.org</A><BR>
<BR>
iQCVAwUBPy6EcD5Ru2/4N2IFAQGJfgP9HXf/mfaGmp9y22PlfA+mxlTiTfb/9N8H<BR>
ovrKNKiETzFTSr1Ni/l4pqNrkYDRqyP1J4VnS/6wv1ewDYmIzXW1c98gM7+m792l<BR>
rgZSkaDWxLyPRUhQ8N3BLJKMHvMRdNWPuYwyL76QMVVVFmUo8vSlcH8PRNJrjD8K<BR>
FIhI6NQ3/+Q=<BR>
=do/K<BR>
-----END PGP SIGNATURE-----<BR>
<BR>
<BR>
_______________________________________________<BR>
Full-Disclosure - We believe in it.<BR>
Charter: <A HREF="http://lists.netsys.com/full-disclosure-charter.html";>http://lists.netsys.com/full-disclosure-charter.html</A><BR>
<BR>
</FONT>
</P>
</BODY>
</HTML>