[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 17 May 2011 13:18:33 +0200
From: Sebastian Krahmer <krahmer@...e.de>
To: oss-security@...ts.openwall.com
Subject: Re: Multiple libraries privilege checking
On Mon, May 16, 2011 at 10:56:37PM +0400, Solar Designer wrote:
> On Mon, May 16, 2011 at 04:27:41PM +0200, Sebastian Krahmer wrote:
> > Its probably about time to review libraries that are commonly
> > linked to (formerly-) suid programs, such as
> > libldap, libssl etc. In near future, in the advent of file caps
> > they are often lacking proper checks.
>
> Good idea.
>
> > They usually just compare uid against euid (not even gid sometimes)
> > and do not check the dumpable flag or AT_SECURE (dont know whether
> > glibc exports a proper function to easily check that at all).
>
> glibc exports the __libc_enable_secure variable, which is initialized
> based on AT_* including AT_SECURE. It also exports __secure_getenv().
>
> > The libraries that I had a quick look at and which were found
> > "vulnerable" are:
> >
> > - openssl-1.0.0c
>
> We've been patching OpenSSL to use __libc_enable_secure for over 10
> years now. ;-) The patch is in use at least in Owl and ALT Linux.
>
> * Sun Apr 22 2001 Solar Designer <solar-at-owl.openwall.com>
> ...
> - Use glibc's __libc_enable_secure for the new OPENSSL_issetugid().
>
> I've attached our patches for OpenSSL, ncurses, S-Lang, termcap, rpm's
> popt. Of these, OpenSSL and ncurses apply to recent versions, termcap
> is old by itself, whereas the rest might be obsoleted by changes made
> upstream (and they're not strictly for the problem you brought up).
>
> For OpenSSL, there's another problem: it looks like some getenv()'s
> were added after the initial introduction of OPENSSL_issetugid() and
> without consideration for possible security implications. Some of those
Indeed, for example if you use the engine, one can specify which
directory should be used for drivers...
I uploaded a openssl-1.0.0d patch to
http://suse.de/~krahmer/libs-vs-fscaps
[modulo synchronization time]
I will upload patches for other libs as soon as I wrote them.
Included is support for __libc_enable_secure (which might be also
not available on systems without glibc, or more particular
without glibc rtld such as systems using bionic) but it needs
to be enabled by hand inside the Makefile (as I dont know
of an easy check to detect that). The "static" nature on most
dists has already been mentioned.
The prefered way is to check the dumpable flag via prctl() which
is detected by the config script. Additionally, euid and egid is
always checked unless enable_secure or dumpable flag already
detects secure-mode.
I hope I didnt miss a getenv() (some are in testcases) and got
the logic wrong. :p
l8er,
-s
--
~ perl self.pl
~ $_='print"\$_=\47$_\47;eval"';eval
~ krahmer@...e.de - SuSE Security Team
---
SUSE LINUX Products GmbH, GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB 16746 (AG Nürnberg)
Maxfeldstraße 5
90409 Nürnberg
Germany
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
