FreeBSD Orville-write Port Vulnerability
BID:1070
Info
FreeBSD Orville-write Port Vulnerability
| Bugtraq ID: | 1070 |
| Class: | Configuration Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Mar 27 2000 12:00AM |
| Updated: | Mar 27 2000 12:00AM |
| Credit: | This vulnerability was made public in FreeBSD advisory FreeBSD-SA-00:10, published March 15, 2000. |
| Vulnerable: |
FreeBSD FreeBSD 3.4 FreeBSD FreeBSD 3.3 FreeBSD FreeBSD 3.2 FreeBSD FreeBSD 3.1 FreeBSD FreeBSD 3.0 |
| Not Vulnerable: |
FreeBSD FreeBSD 4.0 |
Discussion
FreeBSD Orville-write Port Vulnerability
A vulnerability has been discovered in the Orville-write package, as distributed as part of the FreeBSD port system. The binary /usr/local/bin/huh is incorrectly installed setuid root. This, combined with a buffer overrun, may allow local users to gain root privileges.
The orville-write package is not part of FreeBSD proper. It is available, without any claims about security, as part of the FreeBSD port package. This package is only installed if the user deliberately installs the port.
A vulnerability has been discovered in the Orville-write package, as distributed as part of the FreeBSD port system. The binary /usr/local/bin/huh is incorrectly installed setuid root. This, combined with a buffer overrun, may allow local users to gain root privileges.
The orville-write package is not part of FreeBSD proper. It is available, without any claims about security, as part of the FreeBSD port package. This package is only installed if the user deliberately installs the port.
Exploit / POC
FreeBSD Orville-write Port Vulnerability
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution / Fix
FreeBSD Orville-write Port Vulnerability
Solution:
Versions of orville-write in the ports hierarchy since March 9, 2000 have not been vulnerable. FreeBSD 4.0-RELEASE is not vulnerable. New versions of this port are available at
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-3-stable/misc/orville-write-2.41a.tgz
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-current/misc/orville-write-2.41a.tgz
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/alpha/packages-4-current/misc/orville-write-2.41a.tgz
The FreeBSD port skeleton is available at http://www.freebsd.org/ports
Solution:
Versions of orville-write in the ports hierarchy since March 9, 2000 have not been vulnerable. FreeBSD 4.0-RELEASE is not vulnerable. New versions of this port are available at
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-3-stable/misc/orville-write-2.41a.tgz
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-current/misc/orville-write-2.41a.tgz
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/alpha/packages-4-current/misc/orville-write-2.41a.tgz
The FreeBSD port skeleton is available at http://www.freebsd.org/ports
References
FreeBSD Orville-write Port Vulnerability
References:
References: