FreeBSD Jail RC.D Multiple Local Symbolic Link Vulnerabilities
BID:22011
Info
FreeBSD Jail RC.D Multiple Local Symbolic Link Vulnerabilities
| Bugtraq ID: | 22011 |
| Class: | Design Error |
| CVE: |
CVE-2007-0166 |
| Remote: | No |
| Local: | Yes |
| Published: | Jan 11 2007 12:00AM |
| Updated: | Aug 02 2007 04:15PM |
| Credit: | Dirk Engling discovered these vulnerabilities. |
| Vulnerable: |
FreeBSD FreeBSD 6.0 .x FreeBSD FreeBSD 6.0 -STABLE FreeBSD FreeBSD 6.0 -RELEASE FreeBSD FreeBSD 5.5 -STABLE FreeBSD FreeBSD 5.5 -RELEASE FreeBSD FreeBSD 5.4 -RELENG FreeBSD FreeBSD 5.4 -RELEASE FreeBSD FreeBSD 5.4 -PRERELEASE FreeBSD FreeBSD 5.3 -STABLE FreeBSD FreeBSD 5.3 -RELENG FreeBSD FreeBSD 5.3 -RELEASE FreeBSD FreeBSD 5.3 FreeBSD FreeBSD 6.2 FreeBSD FreeBSD 6.1 -STABLE FreeBSD FreeBSD 6.1 -RELEASE-p10 FreeBSD FreeBSD 6.1 -RELEASE FreeBSD FreeBSD 6.0 -RELEASE-p5 FreeBSD FreeBSD 5.4-STABLE |
| Not Vulnerable: | |
Discussion
FreeBSD Jail RC.D Multiple Local Symbolic Link Vulnerabilities
FreeBSD is prone to multiple local symbolic-link vulnerabilities because the jail startup 'rc.d' script fails to properly ensure that certain operations are not performed on symbolic links.
Successfully exploiting these issues allows users with superuser privileges inside jailed environments to overwrite arbitrary files in the host environment, overlay filesystems in arbitrary locations in the host filesystem, or to unmount filesystems in the host filesystem. These issues allow attackers to execute arbitrary machine code with superuser privileges in the host environment, escaping the jailed environment.
FreeBSD versions since version 5.3 are vulnerable to these issues.
FreeBSD is prone to multiple local symbolic-link vulnerabilities because the jail startup 'rc.d' script fails to properly ensure that certain operations are not performed on symbolic links.
Successfully exploiting these issues allows users with superuser privileges inside jailed environments to overwrite arbitrary files in the host environment, overlay filesystems in arbitrary locations in the host filesystem, or to unmount filesystems in the host filesystem. These issues allow attackers to execute arbitrary machine code with superuser privileges in the host environment, escaping the jailed environment.
FreeBSD versions since version 5.3 are vulnerable to these issues.
Exploit / POC
FreeBSD Jail RC.D Multiple Local Symbolic Link Vulnerabilities
Attackers can use standard filesystem utilities to exploit these issues.
Attackers can use standard filesystem utilities to exploit these issues.
Solution / Fix
FreeBSD Jail RC.D Multiple Local Symbolic Link Vulnerabilities
Solution:
FreeBSD has released an advisory along with patches to address these issues. Fixes have been committed to FreeBSD's CVS repository as of January 11, 2007. Please see the references for more information.
FreeBSD FreeBSD 6.1 -RELEASE
FreeBSD FreeBSD 6.1 -STABLE
FreeBSD FreeBSD 6.1 -RELEASE-p10
FreeBSD FreeBSD 6.0 -RELEASE-p5
FreeBSD FreeBSD 5.5 -STABLE
FreeBSD FreeBSD 5.5 -RELEASE
FreeBSD FreeBSD 6.0 .x
FreeBSD FreeBSD 6.0 -RELEASE
FreeBSD FreeBSD 6.0 -STABLE
Solution:
FreeBSD has released an advisory along with patches to address these issues. Fixes have been committed to FreeBSD's CVS repository as of January 11, 2007. Please see the references for more information.
FreeBSD FreeBSD 6.1 -RELEASE
-
FreeBSD jail61.patch
http://security.FreeBSD.org/patches/SA-07:01/jail61.patch
FreeBSD FreeBSD 6.1 -STABLE
-
FreeBSD jail61.patch
http://security.FreeBSD.org/patches/SA-07:01/jail61.patch
FreeBSD FreeBSD 6.1 -RELEASE-p10
-
FreeBSD jail61.patch
http://security.FreeBSD.org/patches/SA-07:01/jail61.patch
FreeBSD FreeBSD 6.0 -RELEASE-p5
-
FreeBSD jail60.patch
http://security.FreeBSD.org/patches/SA-07:01/jail60.patch
FreeBSD FreeBSD 5.5 -STABLE
-
FreeBSD jail5.patch
http://security.FreeBSD.org/patches/SA-07:01/jail5.patch
FreeBSD FreeBSD 5.5 -RELEASE
-
FreeBSD jail5.patch
http://security.FreeBSD.org/patches/SA-07:01/jail5.patch
FreeBSD FreeBSD 6.0 .x
-
FreeBSD jail60.patch
http://security.FreeBSD.org/patches/SA-07:01/jail60.patch
FreeBSD FreeBSD 6.0 -RELEASE
-
FreeBSD jail60.patch
http://security.FreeBSD.org/patches/SA-07:01/jail60.patch
FreeBSD FreeBSD 6.0 -STABLE
-
FreeBSD jail60.patch
http://security.FreeBSD.org/patches/SA-07:01/jail60.patch
References
FreeBSD Jail RC.D Multiple Local Symbolic Link Vulnerabilities
References:
References:
- FreeBSD Homepage (FreeBSD)
- FreeBSD Security Page (FreeBSD)