FreeBSD fts Library Buffer Overflow Vulnerability

Bugtraq ID:	644
Class:	Boundary Condition Error
CVE:
Remote:	No
Local:	Yes
Published:	Sep 16 1999 12:00AM
Updated:	Sep 16 1999 12:00AM
Credit:	This vulnerability was released to the Bugtraq mailing list as FreeBSD Advisory FreeBSD-SA-99:05 by Patrick Oonk <[email protected]> on Thu, 16 Sep 1999.
Vulnerable:	FreeBSD FreeBSD 3.2 FreeBSD FreeBSD 3.1 FreeBSD FreeBSD 3.0 FreeBSD FreeBSD 2.2.8 FreeBSD FreeBSD 2.2.6 FreeBSD FreeBSD 2.2.5 FreeBSD FreeBSD 2.2.4 FreeBSD FreeBSD 2.2.3 FreeBSD FreeBSD 2.2.2 FreeBSD FreeBSD 2.1.7 .1 FreeBSD FreeBSD 2.1.5 FreeBSD FreeBSD 2.1 FreeBSD FreeBSD 2.0.5 FreeBSD FreeBSD 2.0 FreeBSD FreeBSD 1.1.5 .1
Not Vulnerable:

FreeBSD fts Library Buffer Overflow Vulnerability

Within Libc and in particular in the fts library functions a buffer overflow exists in certain FreeBS installations. The fts routines are used by programs which need to traverse the files system of the host. Any series of startup scripts which do work within the file system may use fts. However, this particular overflow is related to the security-checking scripts. The fts library functions had a buffer overflow which would lead to a core dump when periodic ran the security checking scripts (or other scripts which traverse trees that can be controlled by users). periodic(3) should limit core size to zero to disable core dumps while it is executing commands, but does not do so. In addition, the kernel should not follow symbolic links. All three of these problems caused a situation where it was possible for an attacker could create or overwrite an arbitrary file on the system with a moderate degree of control of its contents to cause a problem. The vast majority of this description was taken from the FreeBSD Advisory FreeBSD-SA-99:05 which is available in its entirety in the 'credits' section of this vulnerability entry.

FreeBSD fts Library Buffer Overflow Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

FreeBSD fts Library Buffer Overflow Vulnerability

Solution:
This problem can be worked around via preventing coredumps from the periodic(3) program. However, this is NOT a suggested long term fix. The fts overflow could quite likely be exploited via any number of SUID scripts. The best solution for this is to apply the patch referenced later in this Solution. However, immediate work around information is as follows:

# mv /usr/sbin/periodic /usr/sbin/periodic.bin
# cat > /usr/sbin/periodic
#!/bin/sh
ulimit -c 0
/usr/sbin/periodic.bin $*
^D
# chmod 555 /usr/sbin/periodic

Apply the following patches to libc and do a make world. Please also see the companion advisory FreeBSD-SA-99:04.core.asc in the advisories directory of our ftp site for details on the kernel portions of this fix.

Index: lib/libc/gen/fts.c
===================================================================
RCS file: /home/imp/FreeBSD/CVS/src/lib/libc/gen/fts.c,v
retrieving revision 1.10
retrieving revision 1.11
diff -u -r1.10 -r1.11
--- fts.c 1999/08/15 19:21:29 1.10
+++ fts.c 1999/09/02 07:45:07 1.11
@@ -963,6 +963,24 @@
return (sp->fts_path == NULL);
}

+static void
+ADJUST(p, addr)
+ FTSENT *p;
+ void *addr;
+{
+ if ((p)->fts_accpath >= (p)->fts_path &&
+ (p)->fts_accpath < (p)->fts_path + (p)->fts_pathlen) {
+ if (p->fts_accpath != p->fts_path)
+ errx(1, "fts ADJUST: accpath %p path %p",
+ p->fts_accpath, p->fts_path);
+ if (p->fts_level != 0)
+ errx(1, "fts ADJUST: level %d not 0", p->fts_level);
+ (p)->fts_accpath =
+ (char *)addr + ((p)->fts_accpath - (p)->fts_path);
+ }
+ (p)->fts_path = addr;
+}
+
/*
* When the path is realloc'd, have to fix all of the pointers in structures
* already returned.
@@ -974,18 +992,18 @@
{
FTSENT *p;

-#define ADJUST(p) { - (p)->fts_accpath = - (char *)addr + ((p)->fts_accpath - (p)->fts_path); +#define ADJUST1(p) { + if ((p)->fts_accpath == (p)->fts_path) + (p)->fts_accpath = (addr); (p)->fts_path = addr; }
/* Adjust the current set of children. */
for (p = sp->fts_child; p; p = p->fts_link)
- ADJUST(p);
+ ADJUST(p, addr);

/* Adjust the rest of the tree. */
for (p = sp->fts_cur; p->fts_level >= FTS_ROOTLEVEL;) {
- ADJUST(p);
ADJUST(p, addr);
p = p->fts_link ? p->fts_link : p->fts_parent;
}
}

FreeBSD fts Library Buffer Overflow Vulnerability

References:

• FreeBSD Security Information (FreeBSD)
  
• Patches for SA-99:05 (FreeBSD)