NetBSD SVR4 compatibility device creation Vulnerability
BID:114
Info
NetBSD SVR4 compatibility device creation Vulnerability
| Bugtraq ID: | 114 |
| Class: | Configuration Error |
| CVE: | |
| Remote: | No |
| Local: | Unknown |
| Published: | Apr 21 1999 12:00AM |
| Updated: | Apr 21 1999 12:00AM |
| Credit: | This vulnerability was discoveredd by Klaus Klain <[email protected]>. |
| Vulnerable: |
NetBSD NetBSD 1.3.3 NetBSD NetBSD 1.3.2 NetBSD NetBSD 1.3.1 NetBSD NetBSD 1.3 |
| Not Vulnerable: | |
Discussion
NetBSD SVR4 compatibility device creation Vulnerability
The System Release 4 emulation system under NetBSD requires the creation of a set of device files. The SVR4_MAKEDEV script shipped with the system can automate this task. Among the devices files created by this script is a SVR4 /dev/wabi equivalent places under /emul/svr4. The device is supposed to be equivalent to the /dev/null special file.
As the script was originally developed under the Sparc port of NetBSD, the device file is created with a major and minor number equivalent to that of the /dev/null device in that platform (3 and 2). On the i386 port that major and minor number are associated with the IDE disk device (wd(4)). As the device file is created with with world read and write permissions a regular user can read and write to the equivalent of the /dev/rwd0c disk device file.
This vulnerability only affects NetBSD 1.3.3 and prior, and NetBSD-current until 19990420 under the i386 architecture.
The System Release 4 emulation system under NetBSD requires the creation of a set of device files. The SVR4_MAKEDEV script shipped with the system can automate this task. Among the devices files created by this script is a SVR4 /dev/wabi equivalent places under /emul/svr4. The device is supposed to be equivalent to the /dev/null special file.
As the script was originally developed under the Sparc port of NetBSD, the device file is created with a major and minor number equivalent to that of the /dev/null device in that platform (3 and 2). On the i386 port that major and minor number are associated with the IDE disk device (wd(4)). As the device file is created with with world read and write permissions a regular user can read and write to the equivalent of the /dev/rwd0c disk device file.
This vulnerability only affects NetBSD 1.3.3 and prior, and NetBSD-current until 19990420 under the i386 architecture.
Exploit / POC
NetBSD SVR4 compatibility device creation Vulnerability
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution / Fix
NetBSD SVR4 compatibility device creation Vulnerability
Solution:
NetBSD has made a patch available for NetBSD 1.3.3 which corrects the SVR4_MAKEDEV script. You can find this patch at:
ftp://ftp.NetBSD.ORG/pub/NetBSD/misc/security/patches/19990419-SVR4_MAKEDEV
NetBSD-current users should upgrade to a source tree later than 19990420.
You can also remove the offending device file and create a correct one manually:
# /bin/rm -f /emul/svr4/dev/wabi
# /sbin/mknod /emul/svr4/dev/wabi c 2 2
#/bin/chmod u=rw,g=rw,o=rw /emul/svr4/dev/wabi
Solution:
NetBSD has made a patch available for NetBSD 1.3.3 which corrects the SVR4_MAKEDEV script. You can find this patch at:
ftp://ftp.NetBSD.ORG/pub/NetBSD/misc/security/patches/19990419-SVR4_MAKEDEV
NetBSD-current users should upgrade to a source tree later than 19990420.
You can also remove the offending device file and create a correct one manually:
# /bin/rm -f /emul/svr4/dev/wabi
# /sbin/mknod /emul/svr4/dev/wabi c 2 2
#/bin/chmod u=rw,g=rw,o=rw /emul/svr4/dev/wabi
References
NetBSD SVR4 compatibility device creation Vulnerability
References:
References: