Multiple Vendor exec C Library Standard I/O File Descriptor Race Condition Vulnerability
BID:4708
Info
Multiple Vendor exec C Library Standard I/O File Descriptor Race Condition Vulnerability
| Bugtraq ID: | 4708 |
| Class: | Race Condition Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | May 09 2002 12:00AM |
| Updated: | May 09 2002 12:00AM |
| Credit: | Discovered by FozZy <[email protected]>. |
| Vulnerable: |
SCO Unixware 7.1.1 OpenBSD OpenBSD 2.9 OpenBSD OpenBSD 2.8 OpenBSD OpenBSD 2.7 OpenBSD OpenBSD 2.6 OpenBSD OpenBSD 2.5 OpenBSD OpenBSD 2.4 OpenBSD OpenBSD 3.1 OpenBSD OpenBSD 3.0 Caldera OpenUnix 8.0 |
| Not Vulnerable: | |
Discussion
Multiple Vendor exec C Library Standard I/O File Descriptor Race Condition Vulnerability
The OpenBSD kernel, as a security measure, checks that the C library standard I/O file descriptors 0-2 are valid open files before exec()ing setuid images. If any of these descriptors are closed, they are opened as a new file descriptor to /dev/null.
An error exists in this check. If the kernel file descriptor table is full, an error will occur when the new file descriptor fails to open. This condition does not, however, prevent the exec() call. This may result in untrusted, attacker supplied data being written to sensitive I/O channels. Local root compromise has been confirmed as a possible consequence.
This issue is also reported to affect SCO UnixWare 7.1.1 and Open UNIX 8.0.0.
The OpenBSD kernel, as a security measure, checks that the C library standard I/O file descriptors 0-2 are valid open files before exec()ing setuid images. If any of these descriptors are closed, they are opened as a new file descriptor to /dev/null.
An error exists in this check. If the kernel file descriptor table is full, an error will occur when the new file descriptor fails to open. This condition does not, however, prevent the exec() call. This may result in untrusted, attacker supplied data being written to sensitive I/O channels. Local root compromise has been confirmed as a possible consequence.
This issue is also reported to affect SCO UnixWare 7.1.1 and Open UNIX 8.0.0.
Exploit / POC
Multiple Vendor exec C Library Standard I/O File Descriptor Race Condition Vulnerability
An exploit has been provided by FozZy <[email protected]>. It is available at: http://www.dmpfrance.com/fd_openbsd.c.
An exploit has been provided by FozZy <[email protected]>. It is available at: http://www.dmpfrance.com/fd_openbsd.c.
Solution / Fix
Multiple Vendor exec C Library Standard I/O File Descriptor Race Condition Vulnerability
Solution:
Patches are available:
OpenBSD OpenBSD 3.0
OpenBSD OpenBSD 3.1
OpenBSD OpenBSD 2.9
SCO Unixware 7.1.1
Caldera OpenUnix 8.0
Solution:
Patches are available:
OpenBSD OpenBSD 3.0
-
OpenBSD 021_fdalloc2.patch
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/021_fdalloc2.patc h
OpenBSD OpenBSD 3.1
-
OpenBSD 003_fdalloc2.patch
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/003_fdalloc2.patc h
OpenBSD OpenBSD 2.9
-
OpenBSD 026_fdalloc2.patch
ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.9/common/026_fdalloc2.patc h
SCO Unixware 7.1.1
-
SCO erg712059.711.pkg.Z
ftp://ftp.sco.com/pub/updates/OpenUNIX/CSSA-2002-SCO.43/erg712059.711. pkg.Z
Caldera OpenUnix 8.0
-
SCO erg712059.ou8.pkg.Z
ftp://ftp.sco.com/pub/updates/OpenUNIX/CSSA-2002-SCO.43/erg712059.ou8. pkg.Z
References
Multiple Vendor exec C Library Standard I/O File Descriptor Race Condition Vulnerability
References:
References: