Australia's Leading Computer Emergency Response Team

ESB-2012.0018 - [FreeBSD] ftpd: Root compromise - Existing account
Date: 04 January 2012
Original URL: https://auscert.org.au/render.html?cid=1980&it=15286
References: ASB-2012.0029  

Click here for PGP verifiable version
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2012.0018
                     Code execution via chrooted ftpd
                              4 January 2012

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           ftpd
Publisher:         FreeBSD
Operating System:  FreeBSD
Impact/Access:     Root Compromise -- Existing Account
Resolution:        Patch/Upgrade

Original Bulletin: 
   ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-11:07.chroot.asc

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=============================================================================
FreeBSD-SA-11:07.chroot                                     Security Advisory
                                                          The FreeBSD Project

Topic:          Code execution via chrooted ftpd

Category:       core
Module:         libc
Announced:      2011-12-23
Affects:        All supported versions of FreeBSD.
Corrected:      2011-12-23 15:00:37 UTC (RELENG_7, 7.4-STABLE)
                2011-12-23 15:00:37 UTC (RELENG_7_4, 7.4-RELEASE-p5)
                2011-12-23 15:00:37 UTC (RELENG_7_3, 7.3-RELEASE-p9)
                2011-12-23 15:00:37 UTC (RELENG_8, 8.2-STABLE)
                2011-12-23 15:00:37 UTC (RELENG_8_2, 8.2-RELEASE-p5)
                2011-12-23 15:00:37 UTC (RELENG_8_1, 8.1-RELEASE-p7)
                2011-12-23 15:00:37 UTC (RELENG_9, 9.0-STABLE)
                2011-12-23 15:00:37 UTC (RELENG_9_0, 9.0-RELEASE)

For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:http://security.FreeBSD.org/>.

I.   Background

Chroot is an operation that changes the apparent root directory for the
current process and its children.  The chroot(2) system call is widely
used in many applications as a measure of limiting a process's access to
the file system, as part of implementing privilege separation.

The nsdispatch(3) API implementation has a feature to reload its
configuration on demand.  This feature may also load shared libraries
and run code provided by the library when requested by the configuration
file.

II.  Problem Description

The nsdispatch(3) API has no mechanism to alert it to whether it is
operating within a chroot environment in which the standard paths for
configuration files and shared libraries may be untrustworthy.

The FreeBSD ftpd(8) daemon can be configured to use chroot(2), and
also uses the nsdispatch(3) API.

III. Impact

If ftpd is configured to place a user in a chroot environment, then an
attacker who can log in as that user may be able to run arbitrary code
with elevated ("root") privileges.

IV.  Workaround

Don't use ftpd with the chroot option.

V.   Solution

Perform one of the following:

1) Upgrade your vulnerable system to 7-STABLE or 8-STABLE, or to
the RELENG_8_2, RELENG_8_1, RELENG_7_4, or RELENG_7_3 security
branch dated after the correction date.

2) To update your vulnerable system via a source code patch:

The following patches have been verified to apply to FreeBSD 7.4, 7.3,
8.2 and 8.1 systems.

a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.

[FreeBSD 7.3 and 7.4]
# fetch http://security.FreeBSD.org/patches/SA-11:07/chroot7.patch
# fetch http://security.FreeBSD.org/patches/SA-11:07/chroot7.patch.asc

[FreeBSD 8.1 and 8.2]
# fetch http://security.FreeBSD.org/patches/SA-11:07/chroot8.patch
# fetch http://security.FreeBSD.org/patches/SA-11:07/chroot8.patch.asc

b) Execute the following commands as root:

# cd /usr/src
# patch < /path/to/patch

c) Recompile the operating system as described in
<URL: http://www.freebsd.org/handbook/makeworld.html> and reboot the
system.

3) To update your vulnerable system via a binary patch:

Systems running 7.4-RELEASE, 7.3-RELEASE, 8.2-RELEASE, or 8.1-RELEASE on
the i386 or amd64 platforms can be updated via the freebsd-update(8)
utility:

# freebsd-update fetch
# freebsd-update install

4) This update adds a new API, __FreeBSD_libc_enter_restricted_mode()
to the C library, which completely disables loading of shared libraries
upon return.  Applications doing chroot(2) jails need to be updated
to call this API explicitly right after the chroot(2) operation as a
safety measure.

VI.  Correction details

The following list contains the revision numbers of each file that was
corrected in FreeBSD.

CVS:

Branch                                                           Revision
  Path
- - -------------------------------------------------------------------------
RELENG_7
  src/include/unistd.h                                           1.80.2.4
  src/lib/libc/include/libc_private.h                            1.17.2.4
  src/lib/libc/Versions.def                                       1.3.2.3
  src/lib/libc/net/nsdispatch.c                                  1.14.2.3
  src/lib/libc/gen/Symbol.map                                     1.6.2.7
  src/lib/libc/gen/Makefile.inc                                 1.128.2.6
  src/lib/libc/gen/libc_dlopen.c                                  1.2.2.2
  src/libexec/ftpd/popen.c                                      1.26.10.2
  src/libexec/ftpd/ftpd.c                                       1.212.2.2
RELENG_7_4
  src/UPDATING                                             1.507.2.36.2.7
  src/sys/conf/newvers.sh                                  1.72.2.18.2.10
  src/include/unistd.h                                       1.80.2.3.4.2
  src/lib/libc/include/libc_private.h                        1.17.2.3.4.2
  src/lib/libc/Versions.def                                   1.3.2.2.4.2
  src/lib/libc/net/nsdispatch.c                              1.14.2.2.2.2
  src/lib/libc/gen/Symbol.map                                 1.6.2.6.4.2
  src/lib/libc/gen/Makefile.inc                             1.128.2.5.4.2
  src/lib/libc/gen/libc_dlopen.c                                  1.2.4.2
  src/libexec/ftpd/popen.c                                  1.26.10.1.2.2
  src/libexec/ftpd/ftpd.c                                   1.212.2.1.6.2
RELENG_7_3
  src/UPDATING                                            1.507.2.34.2.11
  src/sys/conf/newvers.sh                                  1.72.2.16.2.13
  src/include/unistd.h                                       1.80.2.3.2.2
  src/lib/libc/include/libc_private.h                        1.17.2.3.2.2
  src/lib/libc/Versions.def                                   1.3.2.2.2.2
  src/lib/libc/net/nsdispatch.c                              1.14.2.1.6.2
  src/lib/libc/gen/Symbol.map                                 1.6.2.6.2.2
  src/lib/libc/gen/Makefile.inc                             1.128.2.5.2.2
  src/lib/libc/gen/libc_dlopen.c                                  1.1.2.1
  src/libexec/ftpd/popen.c                                      1.26.24.2
  src/libexec/ftpd/ftpd.c                                   1.212.2.1.4.2
RELENG_8
  src/include/unistd.h                                           1.95.2.2
  src/lib/libc/include/libc_private.h                            1.20.2.3
  src/lib/libc/Versions.def                                       1.8.2.3
  src/lib/libc/net/nsdispatch.c                                  1.18.2.3
  src/lib/libc/gen/Symbol.map                                    1.21.2.6
  src/lib/libc/gen/Makefile.inc                                 1.144.2.7
  src/lib/libc/gen/libc_dlopen.c                                  1.1.4.2
  src/libexec/ftpd/popen.c                                      1.26.22.3
  src/libexec/ftpd/ftpd.c                                       1.214.2.3
RELENG_8_2
  src/UPDATING                                             1.632.2.19.2.7
  src/sys/conf/newvers.sh                                  1.83.2.12.2.10
  src/include/unistd.h                                       1.95.2.1.6.2
  src/lib/libc/include/libc_private.h                        1.20.2.2.4.2
  src/lib/libc/Versions.def                                   1.8.2.2.4.2
  src/lib/libc/net/nsdispatch.c                              1.18.2.2.2.2
  src/lib/libc/gen/Symbol.map                                1.21.2.5.2.2
  src/lib/libc/gen/Makefile.inc                             1.144.2.6.2.2
  src/lib/libc/gen/libc_dlopen.c                                  1.2.8.2
  src/libexec/ftpd/popen.c                                  1.26.22.2.4.2
  src/libexec/ftpd/ftpd.c                                   1.214.2.1.6.2
RELENG_8_1
  src/UPDATING                                            1.632.2.14.2.10
  src/sys/conf/newvers.sh                                  1.83.2.10.2.11
  src/include/unistd.h                                       1.95.2.1.4.2
  src/lib/libc/include/libc_private.h                        1.20.2.2.2.2
  src/lib/libc/Versions.def                                   1.8.2.2.2.2
  src/lib/libc/net/nsdispatch.c                              1.18.2.1.4.2
  src/lib/libc/gen/Symbol.map                                1.21.2.3.2.2
  src/lib/libc/gen/Makefile.inc                             1.144.2.4.2.2
  src/lib/libc/gen/libc_dlopen.c                                 1.2.10.2
  src/libexec/ftpd/popen.c                                  1.26.22.2.2.2
  src/libexec/ftpd/ftpd.c                                   1.214.2.1.4.2
RELENG_9
  src/include/unistd.h                                          1.101.2.2
  src/lib/libc/include/libc_private.h                            1.26.2.2
  src/lib/libc/Versions.def                                       1.9.2.2
  src/lib/libc/net/nsdispatch.c                                  1.19.2.2
  src/lib/libc/gen/Symbol.map                                    1.38.2.2
  src/lib/libc/gen/Makefile.inc                                 1.159.2.2
  src/lib/libc/gen/libc_dlopen.c                                  1.1.6.2
  src/lib/libc/iconv/citrus_module.c                              1.1.2.2
  src/libexec/ftpd/popen.c                                       1.27.2.2
  src/libexec/ftpd/ftpd.c                                       1.220.2.2
RELENG_9_0
  src/include/unistd.h                                      1.101.2.1.2.2
  src/lib/libc/include/libc_private.h                        1.26.2.1.2.2
  src/lib/libc/Versions.def                                   1.9.2.1.2.2
  src/lib/libc/net/nsdispatch.c                              1.19.2.1.2.2
  src/lib/libc/gen/Symbol.map                                1.38.2.1.2.2
  src/lib/libc/gen/Makefile.inc                             1.159.2.1.2.2
  src/lib/libc/gen/libc_dlopen.c                                  1.2.6.2
  src/lib/libc/iconv/citrus_module.c                          1.1.2.1.2.2
  src/libexec/ftpd/popen.c                                   1.27.2.1.2.2
  src/libexec/ftpd/ftpd.c                                   1.220.2.1.2.2
- - -------------------------------------------------------------------------

Subversion:

Branch/path                                                      Revision
- - -------------------------------------------------------------------------
stable/7/                                                         r228843
releng/7.4/                                                       r228843
releng/7.3/                                                       r228843
stable/8/                                                         r228843
releng/8.2/                                                       r228843
releng/8.1/                                                       r228843
stable/9/                                                         r228843
releng/9.0/                                                       r228843
- - -------------------------------------------------------------------------

VII. References

The latest revision of this advisory is available at
http://security.FreeBSD.org/advisories/FreeBSD-SA-11:07.chroot.asc
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.18 (FreeBSD)

iEYEARECAAYFAk70nOoACgkQFdaIBMps37ILmgCgjVxRH+NsPpnXOVdwWmuxlSDp
h9wAniE0tokORcqQlFJim5Pc1Z65ybwl
=45yE
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBTwOxSu4yVqjM2NGpAQJZ9w/+P1j/fbkb+v+V1cmN+zbllf/XaWqCcxqD
OnD7ZZZcipPuPli6Cl5uZdicdsz5tCXdeYvI52IbIkdg91RW6gCt5EZdB6ho8l6m
nBODt3Pc/gm1MUksA7vktp4T04r6aqIfoTCizcDw70FXBi3hv/Rt89qPJ2UOAub8
IKAwySrkmo00ADf6Ih3vpvjmoP2RHXzTr3JEe3wLiYzVGSXgsAsWStOF0lU89iQ6
tWPc+MAp5EM+TnGEOEr30IN+Y6LawjH1Lnlw5088X536lMigP0epvSJUhJQ3eSld
N+wXlcmedufXflkC36F2KrxaJCuvoNscwnNF0RdAh9p2/6MA9QyyanKScN2aX5lC
1IImmIJjzQFosuZEMIJp4el7FlNqynGyhDsNlVsLtf1rw7wvZah8e+L6OqEW5zPT
bux/L0XB2Aflr8xQj67Jf6s6zstVx+csy8vPA0lvLJMiay/iMaWuIejUtJ9bP0w2
a/WCmZ4vfu32inhBhEAviubUzHC+zgFzGqIY8lpmYpQDCzyxexxPcR54H5t3Rj13
+g1yPNJTKnCR9+fhywH9ThaOUfegiUDeub3GaEIJTkgIsTbCsokdPoGp/n8qqrrN
Kg6v+12vue7eRt8LT77GmB3KYkKfN28J8HUuSbaaRJ0enRxfernMDs2dRcTm9x/R
kDtMv8oyloA=
=LBo4
-----END PGP SIGNATURE-----