-----BEGIN PGP SIGNED MESSAGE-----

===========================================================================
              AUSCERT External Security Bulletin Redistribution
                                    
                      ESB-1999.134 -- FreeBSD-SA-99:01
                  BSD File Flags and Programming Techniques
                              09 September 1999

===========================================================================

The FreeBSD Security Team has released the following advisory concerning
a vulnerability involving file flags that may prevent device file ownership
changes employed by some privileged programs. This vulnerability may allow
local users to maintain ownership of devices used by other users. This
may be exploited to gain increased privileges including root by snooping
on login sessions.

- ---------------------------BEGIN INCLUDED TEXT------------------

- -----BEGIN PGP SIGNED MESSAGE-----

=============================================================================
FreeBSD-SA-99:01                                            Security Advisory
                                                                FreeBSD, Inc.

Topic:          BSD File Flags and Programming Techniques

Category:       core
Module:         kernel
Announced:      1999-09-04
Affects:        FreeBSD 3.2 (and earlier)
		FreeBSD-current before the correction date.
Corrected:      FreeBSD-3.3 RELEASE
		FreeBSD-current as of 1999/08/02
		FreeBSD-3.2-stable as of 1999/08/02
		FreeBSD-2.2.8-stable as of 1999/08/04
FreeBSD only:   NO

Patches:        ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-99:01/

I.   Background    

BSD 4.4 added various flags to files in the file system.  These flags
control various aspects of which operations are permitted on those
files.  Historically, root has been been able to do all of these
operations so many programs that knew they were running as root didn't
check to make sure that these operations succeeded.

II.  Problem Description

A user can set flags and mode on the device which they logged into.
Since a bug in login and other similar programs causes the normal
chown to fail, this first user will own the terminal of any login.

III. Impact

Local users can execute a man-in-the-middle attack against any other
user (including root) when the other users logs in.  This give them
the ability to snoop and alter all text that the user writes.  Results
of this include the ability to execute commands as the user, and
stealing the user's password (and anything else the users writes over
the connection, including passwords for other machines).

IV.  Workaround

None.

V.   Solution

    FreeBSD-current

        Index: kern/vfs_syscalls.c
        ===================================================================
        RCS file: /home/imp/FreeBSD/CVS/src/sys/kern/vfs_syscalls.c,v
        retrieving revision 1.125
        retrieving revision 1.128
        diff -u -r1.125 -r1.128
        --- vfs_syscalls.c	1999/07/29 17:02:56	1.125
        +++ vfs_syscalls.c	1999/08/04 04:52:18	1.128
        @@ -1892,13 +1892,23 @@
                int error;
                struct vattr vattr;

        +	/*
        +	 * Prevent non-root users from setting flags on devices.  When
        +	 * a device is reused, users can retain ownership of the device
        +	 * if they are allowed to set flags and programs assume that
        +	 * chown can't fail when done as root.
        +	 */
        +	if ((vp->v_type == VCHR || vp->v_type == VBLK) && 
        +	    ((error = suser_xxx(p->p_ucred, p, PRISON_ROOT)) != 0))
        +		return (error);
        +
                VOP_LEASE(vp, p, p->p_ucred, LEASE_WRITE);
                vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, p);
                VATTR_NULL(&vattr);
                vattr.va_flags = flags;
                error = VOP_SETATTR(vp, &vattr, p->p_ucred, p);
                VOP_UNLOCK(vp, 0, p);
        -	return error;
        +	return (error);
         }

         /*

    FreeBSD-3.2-stable

        Index: kern/vfs_syscalls.c
        ===================================================================
        RCS file: /home/imp/FreeBSD/CVS/src/sys/kern/vfs_syscalls.c,v
        retrieving revision 1.112.2.3
        retrieving revision 1.112.2.5
        diff -u -r1.112.2.3 -r1.112.2.5
        --- vfs_syscalls.c	1999/07/30 01:07:23	1.112.2.3
        +++ vfs_syscalls.c	1999/08/11 21:39:50	1.112.2.5
        @@ -1839,13 +1839,23 @@
                int error;
                struct vattr vattr;

        +  	/*
        +	 * Prevent non-root users from setting flags on devices.  When
        +	 * a device is reused, users can retain ownership of the device
        +	 * if they are allowed to set flags and programs assume that
        +	 * chown can't fail when done as root.
        +	 */
        +	if ((vp->v_type == VCHR || vp->v_type == VBLK) && 
        +	    ((error = suser(p->p_ucred, &p->p_acflag)) != 0))
        +		return (error);
        +
                VOP_LEASE(vp, p, p->p_ucred, LEASE_WRITE);
                vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, p);
                VATTR_NULL(&vattr);
                vattr.va_flags = flags;
                error = VOP_SETATTR(vp, &vattr, p->p_ucred, p);
                VOP_UNLOCK(vp, 0, p);
        -	return error;
        +	return (error);
         }

         /*

    FreeBSD 2.2.8-stable:

        Index: kern/vfs_syscalls.c
        ===================================================================
        RCS file: /home/imp/FreeBSD/CVS/src/sys/kern/vfs_syscalls.c,v
        retrieving revision 1.51.2.7
        retrieving revision 1.51.2.8
        diff -u -r1.51.2.7 -r1.51.2.8
        --- vfs_syscalls.c	1998/07/03 03:50:31	1.51.2.7
        +++ vfs_syscalls.c	1999/08/04 18:58:56	1.51.2.8
        @@ -1439,6 +1439,17 @@
                if (error)
                        return (error);
                vp = nd.ni_vp;
        +	if ((error = VOP_GETATTR(vp, &vattr, p->p_ucred, p)))
        +		return (error);
        +	/*
        +	 * Prevent non-root users from setting flags on devices.  When
        +	 * a device is reused, users can retain ownership of the device
        +	 * if they are allowed to set flags and programs assume that
        +	 * chown can't fail when done as root.
        +	 */
        +	if ((vp->v_type == VCHR || vp->v_type == VBLK) &&
        +	    ((error = suser(p->p_ucred, &p->p_acflag)) != 0))
        +		return (error);
                LEASE_CHECK(vp, p, p->p_ucred, LEASE_WRITE);
                VOP_LOCK(vp);
                VATTR_NULL(&vattr);

VI.  Credits

Theo de Raadt came up with the firewalling solution presented here.

lumpy@blue.9mm.com brought this problem to light.

=============================================================================
FreeBSD, Inc.

Web Site:                       http://www.freebsd.org/
Confidential contacts:          security-officer@freebsd.org
Security notifications:         security-notifications@freebsd.org
Security public discussion:     freebsd-security@freebsd.org
PGP Key:                ftp://ftp.freebsd.org/pub/FreeBSD/CERT/public_key.asc

Notice: Any patches in this document may not apply cleanly due to
        modifications caused by digital signature or mailer software.
        Please reference the URL listed at the top of this document
        for original copies of all patches if necessary.
=============================================================================

- -----BEGIN PGP SIGNATURE-----
Version: 2.6.3ia
Charset: noconv
Comment: Processed by Mailcrypt 3.4, an Emacs/PGP interface

iQCVAwUBN9CAHFUuHi5z0oilAQEJPwP/XhzCOs4ipJkZIPWlSDvsvPLcJWXzb3HK
Fs8gLV3CPnW7YdSpveosI3hBY9WNCVAFx9WkM5+n+FBSRfbRzFJkkblN85ZCz7pI
+RXg6Sv5vuzy6SRxMRK2vu1FXuwZevVQaMq4ANUXpdo5MyUE8rMGb9PLWdxOxdf5
s6zlG0oFyvI=
=CqoX
- -----END PGP SIGNATURE-----

- ---------------------------END INCLUDED TEXT--------------------

This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content.  The decision to use any or all of this information is
the responsibility of each user or organisation, and should be done so in
accordance with site policies and procedures.

NOTE: This is only the original release of the security bulletin.  It will
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the original authors to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/Information/advisories.html

If you believe that your system has been compromised, contact AusCERT or
your representative in FIRST (Forum of Incident Response and Security
Teams).

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for emergencies.

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
Comment: ftp://ftp.auscert.org.au/pub/auscert/AUSCERT_PGP.key

iQCVAwUBN+dwGSh9+71yA2DNAQG7NQP6AyJRUK3KcWEe52TeiZ1hbGJDyIxqa7IX
8xV99Jz1qKtMqxQ0TxoEdUJP15PdK/9h/8tNnj9hs11ZdDTSP8OaTcXiuZwHaL/q
LyS7Z34Cc1whPMMPWfFwCx2DFEh8dbYP+PfCAl7KhIriNxsegzpZS6p3kTYUTBg4
iuqkPVF2ZW4=
=5++G
-----END PGP SIGNATURE-----