-----BEGIN PGP SIGNED MESSAGE-----

===========================================================================
              AUSCERT External Security Bulletin Redistribution
                             
              ESB-1999.110 -- NetBSD Security Advisory 1999-011
                  profil(2) can modify setuid root programs
                               12 August 1999

===========================================================================

The NetBSD Foundation, Inc. has released the following advisory concerning
a possible security vulnerability in the NetBSD kernel versions prior to
1.4.1.  This vulnerability may allow a wrapper program, constructed by a
local user, to modify the internal data space of a program it invokes by
using the impact of profiling, which is not turned off when a process
execve(2)'s another program image.  This may allow users to exploit setuid
programs to gain root privileges.

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----

                 NetBSD Security Advisory 1999-011
                 =================================

Topic:		profil(2) can modify setuid root programs
Version:	all versions of NetBSD prior to 1.4.1
Severity:	theoretical problem only, no known exploits


Abstract
========

As part of an ongoing effort to construct a completely secure kernel and
application environment, the NetBSD project has identified and corrected
a possible security issue.

A wrapper program can be constructed by a local user that can modify the
internal data space of a program it execve(2)'s in a partially predictable
way, including setuid root binaries.

It might be possible to write a security-related exploit via this mechanism.


Technical Details
=================

NetBSD uses a profil(2) system call that dates back to "version 6" unix.
This system call arranges for the kernel to sample the PC and increment
an element of an array on every profile clock tick.

The security issue stems from the fact that profiling is not turned off
when a process execve(2)'s another program image.

As the size and location of this array as well as the scale factor are
under the program's control, it is possible to arrange for an arbitrary
16-bit program virtual address to be incremented on each profile clock
tick.

Although unlikely, it is theoretically possible that an attacker with local
access and knowledge of the addresses used by privileged programs could
construct an exploit.

It may be that there are no candidate addresses that, when incremented,
result in a security failure. However, as this can turn -1 into 0, and 0
into 1, and as security-related system calls and library functions often
return either -1 or 0, this mechanism could turn system call returns of
success into failure or failure into success if a program stores system
call results into memory locations.


Solutions and Workarounds
=========================

Upgrade to NetBSD 1.4.1, NetBSD-current, or apply the following patch:

Index: kern_exec.c
===================================================================
RCS file: /cvsroot/syssrc/sys/kern/kern_exec.c,v
retrieving revision 1.101
diff -u -w -u -r1.101 kern_exec.c
- - --- kern_exec.c	1999/04/27 05:28:44	1.101
+++ kern_exec.c	1999/08/06 07:19:24
@@ -415,6 +415,7 @@
 			goto exec_abort;
 	}
 
+	stopprofclock(p);	/* stop profiling */
 	fdcloseexec(p);		/* handle close on exec */
 	execsigs(p);		/* reset catched signals */
 	p->p_ctxlink = NULL;	/* reset ucontext link */

Thanks To
=========

Discovery of problem and kernel patch by Ross Harvey <ross@netbsd.org>.


Revision History
================

	1999/08/08 - initial version


More Information
================

Information about NetBSD and NetBSD security can be found at
http://www.NetBSD.ORG/ and http://www.NetBSD.ORG/Security/.


Copyright 1999, The NetBSD Foundation, Inc.  All Rights Reserved.

$NetBSD: NetBSD-SA1999-011.txt,v 1.3 1999/08/09 02:38:00 mrg Exp $

- -----BEGIN PGP SIGNATURE-----
Version: 2.6.3ia
Charset: noconv

iQCVAwUBN64/JD5Ru2/4N2IFAQEEKwQAyG0W9xE76JLOVC829EQgVt85Ba56y4DV
lwb45wvxQKmAqYRrvgxMU9rbH/WDKaCAGAQywAjTu2DITGPRw/THXIY7R1ioUIJI
sOz7+zqxwVAJMQvx3qkQ19UFT1tmXFXeeHOYmorzet6cfY13H3xaLKFOWpmzuAiI
0rzmyEbaJa4=
=prt9
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content.  The decision to use any or all of this information is
the responsibility of each user or organisation, and should be done so in
accordance with site policies and procedures.

NOTE: This is only the original release of the security bulletin.  It will
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the original authors to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

	http://www.auscert.org.au/Information/advisories.html

If you believe that your system has been compromised, contact AusCERT or
your representative in FIRST (Forum of Incident Response and Security
Teams).

Internet Email: auscert@auscert.org.au
Facsimile:	(07) 3365 7031
Telephone:	(07) 3365 4417 (International: +61 7 3365 4417)
		AusCERT personnel answer during Queensland business hours
		which are GMT+10:00 (AEST).
		On call after hours for emergencies.

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
Comment: ftp://ftp.auscert.org.au/pub/auscert/AUSCERT_PGP.key

iQCVAwUBN+dv1ih9+71yA2DNAQEmbQQAhuHAKKhRuJPL2b5TTnQAoaGqxyoHGKGb
kqxFF7IWbjnrt/aiWgbMoOmZ0u+CBsWBCczgH2b6hTE/t7QbdmK//VcfMehSKV84
R2tRhSwFWXG0L/nx8/SsNOs2yc4kT82CNCuSi/tSGbp2pmzm8E3dt2WmkdqZ5kuq
Q0+sLXEm7Fo=
=5R+0
-----END PGP SIGNATURE-----