BSD UFS Secure Level 1 Vulnerability
BID:510
Info
BSD UFS Secure Level 1 Vulnerability
| Bugtraq ID: | 510 |
| Class: | Design Error |
| CVE: |
CVE-1999-1394 |
| Remote: | No |
| Local: | Yes |
| Published: | Jul 02 1999 12:00AM |
| Updated: | Jul 11 2009 12:56AM |
| Credit: | First posted to BugTraq by Stealth <[email protected]> on June 2, 1999. |
| Vulnerable: |
OpenBSD OpenBSD 2.5 NetBSD NetBSD 1.4 x86 FreeBSD FreeBSD 3.2 BSDI BSD/OS 4.0 |
| Not Vulnerable: | |
Discussion
BSD UFS Secure Level 1 Vulnerability
In 4.4BSD derivatives there are four secure levels that provide for added filesystem security (among other things) over and above the regular unix permission systems. Part of the secure levels are the system of file flags which include immutable and append-only flags. In secure level 0, these flags are irrelevant. The vulnerability lies in the inherent flaw with security level 1. In security level 1, the file flags are acknowledged; files such as /usr/bin/login can be set immutable and so forth -- however, umounted partitions/devices can be freely written to and modified (by root, of course). Stealth <[email protected]> has written a tool which allows for an intruder who has gained root to bypass security level 1 through writing directly to the device and clearing the file flags. The tool also sets the CLEAN flag in the filesystem which fools the computer into thinking the modified device is clean avoiding detection at bootup. A hypothetical situation for exploit of this vulnerability is as follows,
Hacker compromises root on target host.
Hacker attempts backdoor insertion and realizes suid binaries are immutable.
Hacker verifies secure level is set to 1.
Hacker umounts /usr.
Hacker writes directly to device previously mounted as /usr, clearing file flags.
Hacker mounts modified device as /usr.
Hacker installs backdoored /usr/bin/login.
In 4.4BSD derivatives there are four secure levels that provide for added filesystem security (among other things) over and above the regular unix permission systems. Part of the secure levels are the system of file flags which include immutable and append-only flags. In secure level 0, these flags are irrelevant. The vulnerability lies in the inherent flaw with security level 1. In security level 1, the file flags are acknowledged; files such as /usr/bin/login can be set immutable and so forth -- however, umounted partitions/devices can be freely written to and modified (by root, of course). Stealth <[email protected]> has written a tool which allows for an intruder who has gained root to bypass security level 1 through writing directly to the device and clearing the file flags. The tool also sets the CLEAN flag in the filesystem which fools the computer into thinking the modified device is clean avoiding detection at bootup. A hypothetical situation for exploit of this vulnerability is as follows,
Hacker compromises root on target host.
Hacker attempts backdoor insertion and realizes suid binaries are immutable.
Hacker verifies secure level is set to 1.
Hacker umounts /usr.
Hacker writes directly to device previously mounted as /usr, clearing file flags.
Hacker mounts modified device as /usr.
Hacker installs backdoored /usr/bin/login.
Exploit / POC
Solution / Fix
BSD UFS Secure Level 1 Vulnerability
Solution:
Setting to secure level 2 will disallow writing directly to umounted devices. Running fsck manually will alert you to whether filesystems have been modified.
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution:
Setting to secure level 2 will disallow writing directly to umounted devices. Running fsck manually will alert you to whether filesystems have been modified.
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
References
BSD UFS Secure Level 1 Vulnerability
References:
References: