-----BEGIN PGP SIGNED MESSAGE-----

===========================================================================
              AUSCERT External Security Bulletin Redistribution
                             
                      ESB-2000.038 -- FreeBSD-SA-00:04
              Delegate port contains numerous buffer overflows
                                07 March 2000

===========================================================================

FreeBSD have released the following advisory describing numerous
vulnerabilities in the delegate package which is part of the FreeBSD ports
collection.  These vulnerabilities may allow remote users to execute
arbitrary commands on the local system, typically as the 'nobody' user.

- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----

=============================================================================
FreeBSD-SA-00:04                                           Security Advisory
                                                                FreeBSD, Inc.

Topic:          Delegate port contains numerous buffer overflows

Category:       ports
Module:         delegate
Announced:      2000-02-19
Affects:        Ports collection before the correction date.
Corrected:      2000-02-02
FreeBSD only:   NO

I.   Background

An optional third-party port distributed with FreeBSD contains numerous
remotely-exploitable buffer overflows which allow an attacker to execute
arbitrary commands on the local system, typically as the 'nobody' user.

II.  Problem Description

Delegate is a versatile application-level proxy. Unfortunately it is
written in a very insecure style, with potentially dozens of different
exploitable buffer overflows (including several demonstrated ones), each of
which could allow an attacker to execute arbitrary code on the delegate
server. This code will run as the user ID of the 'delegated' process,
typically 'nobody' in the recommended configuration, but this still
represents a security risk as the attacker may be able to mount a local
attack to further upgrade his or her access privileges.

Note that the delegate utility is not installed by default, nor is it "part
of FreeBSD" as such: it is part of the FreeBSD ports collection, which
contains over 3100 third-party applications in a ready-to-install format.

FreeBSD makes no claim about the security of these third-party
applications, although an effort is underway to provide a security audit of
the most security-critical ports.

III. Impact

If you have not chosen to install the delegate port/package, then your
system is not vulnerable. If you have, then local or remote users who can
connect to the delegate port(s), or malicious servers which a user accesses
using the delegate proxy, can potentially execute arbitrary code on your
system in any number of ways.

IV.  Workaround

Remove the delegate port/package, if you have installed it.

V.   Solution

Unfortunately no simple fix is available - the problems with the delegate
software are too endemic to be fixed by a simple patch. It is hoped the
software authors will take security to heart and correct the security
problems in a future version, although user caution is advised given the
current state of the code.

Depending on your local setup and your security threat model, using a
firewall/packet filter such as ipfw(8) or ipf(8) to prevent remote users
from connecting to the delegate port(s) may be enough to meet your security
needs. Note that this will not prevent legitimate proxy users from
attacking the delegate server, although this may not be an issue if they
have a shell account on the machine anyway.

Note also that this does not prevent "passive" exploits in which a user is
convinced through other means into visiting a malicious server using the
proxy, which may be able to compromise it by sending back invalid
data. Several flaws of this type have been discovered during a brief
survey of the code.

If you are running FreeBSD 4.0, a possible solution might be to confine the
delegate process inside a "jail" (see the jail(8) manpage). A properly
configured jail will isolate the contents in their own separate "virtual
machine", which can be suitably secured so that an attacker who gains
control of a process running inside the jail cannot escape and gain access
to the rest of the machine. Note that this is different from a traditional
chroot(8), since it does not just attempt to isolate processes inside
portions of the filesystem. This solution is not possible under standard
FreeBSD 3.x or earlier.

- -----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBOK+NTVUuHi5z0oilAQGGnAP+NOxAOVpEUpyR0iQwNjA1Je7B4M5gOxzc
NwqQKp7WBm/IzzIW23KvyPcbTld83+m2tnhdNW3srh8ESSYDaa/hhmG2AtR0LYEL
H2EWTIBcPBhidquX+ihKGTSaMnMjYpmp6GVGSsBqcNFXAPGHiJ6BbsEg2k6rJSLz
wgL0NJ+qkCI=
=ZhXO
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content.  The decision to use any or all of this information is
the responsibility of each user or organisation, and should be done so in
accordance with site policies and procedures.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the original authors to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

	http://www.auscert.org.au/Information/advisories.html

If you believe that your system has been compromised, contact AusCERT or
your representative in FIRST (Forum of Incident Response and Security
Teams).

Internet Email: auscert@auscert.org.au
Facsimile:	(07) 3365 7031
Telephone:	(07) 3365 4417 (International: +61 7 3365 4417)
		AusCERT personnel answer during Queensland business hours
		which are GMT+10:00 (AEST).
		On call after hours for emergencies.


-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
Comment: ftp://ftp.auscert.org.au/pub/auscert/AUSCERT_PGP.key

iQCVAwUBOMy1nih9+71yA2DNAQF50QP/d0+9BmyJGtJtatl6ND/NWT2b0vqXff3+
OVvMxCbMPVcwJE7DuBJFnsPxrs5tracg0f2vfWpbw9oSb4v2Z0Rd3dcDwt70ga37
F/NA9RrXLIZgmUvat8kw7/lmYmZApFfe2wrLmAdYQf4DQ8M7MNcmvnzE4xY9tvSF
KKysDZd7TFM=
=Z9Ht
-----END PGP SIGNATURE-----