Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2013.1062
Error in authorization check re tcpdrop sysctl
5 August 2013
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: tcpdrop
Publisher: NetBSD
Operating System: NetBSD
Impact/Access: Unauthorised Access -- Existing Account
Resolution: Patch/Upgrade
Original Bulletin:
http://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2013-008.txt.asc
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
NetBSD Security Advisory 2013-008
=================================
Topic: Error in authorization check re tcpdrop sysctl
Version: NetBSD-current: affected prior to Aug 2nd, 2013
NetBSD 6.1: affected
NetBSD 6.0: affected
NetBSD 5.2: not affected
NetBSD 5.1: not affected
Severity: Local Denial of Service
Fixed: NetBSD-current: Aug 2nd, 2013
NetBSD-6 branch: Aug 2nd, 2013
NetBSD-6-1 branch: Aug 2nd, 2013
NetBSD-6-0 branch: Aug 2nd, 2013
Please note that NetBSD releases prior to 5.1 are no longer supported.
It is recommended that all users upgrade to a supported release.
Abstract
========
Due to a programming error, the authorization check is inverted
in the KAUTH_REQ_NETWORK_SOCKET_DROP sysctl; as a result, users on
affected systems cannot use tcpdrop to terminate their own connections,
only those of others.
Technical Details
=================
The authorization check in src/sys/kern/uipc_socket.c for
KAUTH_REQ_NETWORK_SOCKET_DROP uses:
if (proc_uidmatch(cred, so->so_cred))
when it ought to have tested
if (proc_uidmatch(cred, so->so_cred) == 0)
This is an error in the kernel.
See also https://program.ohm2013.org/event/252.html
Solutions and Workarounds
=========================
Workaround:
To deal with the immediate problem of users using tcpdrop, a
weak mitigation would be to remove access to the tcpdrop binary
for users; the fault would still exist and be exploitable with
self-built tools though.
Fix:
Install a kernel containing the fix.
The fastest way to do that, if you are running or can run a standard kernel
built as part of the NetBSD release process, is to obtain the corresponding
kernel from the daily NetBSD autobuild output and install it on your system.
You can obtain such kernels from http://nyftp.netbsd.org/pub/NetBSD-daily/
where they are sorted by NetBSD branch, date, and architecture. To fix
a system running e.g. NetBSD 6.0 or the stable NetBSD 6.0 branch, the
most appropriate kernel will be the "netbsd-6-0" kernel.
To fix a system running NetBSD-current, the "HEAD" kernel should be used.
In all cases, a kernel from an autobuild dated 20130803 or newer must be
used to fix the problem.
If you cannot use the autobuilt kernels, then for all affected NetBSD
versions, you need to obtain fixed kernel sources, rebuild and install
the new kernel, and reboot the system.
The fixed source may be obtained from the NetBSD CVS repository.
The following instructions briefly summarise how to upgrade your
kernel. In these instructions, replace:
ARCH with your architecture (from uname -m), and
KERNCONF with the name of your kernel configuration file.
NEWVERSION with the CVS version of the fix
Versions of src/sys/kern/uipc_socket.c:
Branch NEWVERSION
---------------------------
HEAD 1.216
netbsd-6 1.209.2.3
netbsd-6-1 1.209.2.2.2.1
netbsd-6-0 1.209.2.1.4.1
To update from CVS, re-build, and re-install the kernel:
# cd src
# cvs update -rNEWVERSION sys/kern/uipc_socket.c
# ./build.sh kernel=KERNCONF
# mv /netbsd /netbsd.old
# cp sys/arch/ARCH/compile/obj/KERNCONF/netbsd /netbsd
# shutdown -r now
For more information on how to do this, see:
http://www.NetBSD.org/guide/en/chap-kernel.html
Thanks To
=========
Sander Bos for finding the issue, informing security officer and
proposing the fix.
Revision History
================
2013-08-02 Initial release
More Information
================
Advisories may be updated as new information becomes available.
The most recent version of this advisory (PGP signed) can be found at
http://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2013-008.txt.asc
Information about NetBSD and NetBSD security can be found at
http://www.NetBSD.org/ and http://www.NetBSD.org/Security/ .
Copyright 2013, The NetBSD Foundation, Inc. All Rights Reserved.
Redistribution permitted only in full, unmodified form.
$NetBSD: NetBSD-SA2013-008.txt,v 1.1 2013/08/02 20:28:43 tonnerre Exp $
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (NetBSD)
iQIcBAEBAgAGBQJR/BaKAAoJEAZJc6xMSnBuRvMQALJNe4iSb+W952/l0Yf1mImT
NnWC6tYhSzO4GodvyWSZaDtEnMOoqohwBjF5W6KbSEj6ME4pdX7bhdJaF/s4qfD0
k4TrTpSMhTPVdwNIaN0uvLxNIouAHuvCu0jUA50aERTR7eVWi7tfKjYo+tYa86tE
UK7EqD/zTmsS1ZlENcxuEGrddx2hbUB38kySM0G0SvX7VVmLCos3efheAvxMOt17
gJ+L7n5PdhqnfUh/8ZjxDUbed5etHNOCCe1SMx5/QXkAnx+9Ub6veApxUbLlB2bn
itQF66y9ZMEHylj69FtCh4ow2tGssHO+jk9bLJ7Z5c/4RNZx1M6gckPco7mSPhYu
0scqWY4T70kR7ek5PrZ5mOY23+nMtVafO5YkgVj6JWuO2mzf3JA2LBkPPQ8RJVIu
4vQgwzW9cPjP8WEQTEhhws2udgiNJjatTHZMm2iDainNptjxwag63dKKzc4FGk25
++NLtjj7oj7ZK8x8aI+n4x9Qs2Mnu9HqK48VwkcAFe/aodTuDpnUigKtM2/r7+B/
saSzJeoCPXEn5HlmNtnrzRaM81Fhq/qDVeYpU9ctuwmN9DclC6P+pVzW6k2scI8A
CSkEtBhB2eNkbA/Cmz+YzOipPmJsmiDpSTYRkIfzrjFQi+GDLF6Q6x5/mqrZYdgC
8RoqnnFgIaV0X21EZ8qy
=UFgo
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBUf8BdRLndAQH1ShLAQInyQ//d6U9YD12DCw8FTzlUTkkNAmOz4uQZHJP
8d4xBd/qWkfSZnKB61oud7miFM5h7Wb2AwPELZ9CUE/ecTHSljN84yZPjG86ppMQ
AuDP8dnEfIOOmIlM8sujKr8soWWuEmtsO5taULRr2TYvYVoQa+Xiqu2jPgzm/AMF
JiMNl9NSRk9jV516T35sQmqGtk2ph44/mGdG7eZNqdz3zYStkZVlWY68a/S+yxk9
B1iandR4sa+aZA/wsjzp5U+sMSEyv0HRfJHm5jntqTUJMzrwtp/bZcFu3VwstMNh
UIhfdnlxjdfHLrXEyS8eHR3eb6MdgDvFSV+3bRbqAEtpYpJynJ9B/Z7qCJ11hKxK
eK0n8XPs0n9nJtgI5hodROfyHwXQ3f2aRPvoNSxa1ByBPGCTl1fU9q3m9uhVrLWx
vxcoXnv5Agp7rfPJC0g7e/OgkP0YpMDlyOFX4TSpCAbnSwLim5QLeyWCWMGkigss
b03k+6WKHslF51g9tA7ixBbdnrUics/LwKHT79a2GYDq4s0DwxkpGF5zME4u7wk0
JaaNkrc9X+qdttMFcY+Z9z8jhuuK91bKPKc7pamkkFolpoSjjRcDF5M2n48C9BHA
uW33gNffNR8jEIoGENqSFFCB8++vk9rqWS27OTU4VYerkzHPb5f/L9XSAlvjg0dp
pY30Am0jFEw=
=Pipz
-----END PGP SIGNATURE-----