BID:5133

Multiple Vendor BSD KTrace SUID/SGID Process Tracing Vulnerability

Info

Multiple Vendor BSD KTrace SUID/SGID Process Tracing Vulnerability

Bugtraq ID:	5133
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Jun 27 2002 12:00AM
Updated:	Jun 27 2002 12:00AM
Credit:	This issue was publicized by the OpenBSD Development Team.
Vulnerable:	OpenBSD OpenBSD 3.1 OpenBSD OpenBSD 3.0 FreeBSD FreeBSD 4.6 -RELEASE FreeBSD FreeBSD 4.6 FreeBSD FreeBSD 4.5 -STABLE FreeBSD FreeBSD 4.5 -RELEASE FreeBSD FreeBSD 4.5 FreeBSD FreeBSD 4.4 -STABLE FreeBSD FreeBSD 4.4 -RELENG FreeBSD FreeBSD 4.4 FreeBSD FreeBSD 4.3 -STABLE FreeBSD FreeBSD 4.3 -RELENG FreeBSD FreeBSD 4.3 -RELEASE FreeBSD FreeBSD 4.3 FreeBSD FreeBSD 4.2 -STABLE FreeBSD FreeBSD 4.2 -RELEASE FreeBSD FreeBSD 4.2 FreeBSD FreeBSD 4.1.1 -STABLE FreeBSD FreeBSD 4.1.1 -RELEASE FreeBSD FreeBSD 4.1.1 FreeBSD FreeBSD 4.1 FreeBSD FreeBSD 4.0

Not Vulnerable:

Discussion

Multiple Vendor BSD KTrace SUID/SGID Process Tracing Vulnerability

A vulnerability exists in multiple BSD kernels which may allow local users to trace setuid/setgid processes using the ktrace function. This presents a security vulnerability as only the superuser should be able to trace setuid/setgid processes using this function.

Exploit / POC

Multiple Vendor BSD KTrace SUID/SGID Process Tracing Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Solution / Fix

Multiple Vendor BSD KTrace SUID/SGID Process Tracing Vulnerability

Solution:
OpenBSD has released source code patches which address this issue.

FreeBSD patches are available. Additionally, this vulnerability is fixed in recent versions of FreeBSD as follows:

2002-07-05 22:36:38 UTC (RELENG_4)
2002-07-11 16:47:41 UTC (RELENG_4_6)
2002-07-11 16:47:55 UTC (RELENG_4_5)
2002-07-11 16:56:05 UTC (RELENG_4_4)

OpenBSD OpenBSD 3.1