Date: Tue, 30 Sep 2014 16:15:44 +0100 From: Simon McVittie <smcv@...ian.org> To: oss-security@...ts.openwall.com Subject: Re: Healing the bash fork On 30/09/14 15:27, Michal Zalewski wrote: >> Florian's prefix/suffix patch is not going to protect against the >> setuid/setgid exploit that I reported to this list last week. ... >> http://technicalprose.blogspot.co.uk/2014/09/shellshock-bug-third-vulnerability.html > > You do realize that your setuid program is patently unsafe, right? > Say: > > $ echo -e '#!/bin/sh\necho pwn3d' >date;chmod 755 date;PATH=.:$PWD > ./setuid_program > pwn3d Other ways to attack this "simple, easy and wrong" setuid program include LD_PRELOAD and, depending on implementation details, any of: LD_LIBRARY_PATH (if sh(1) and/or date(1) is dynamically-linked) ENV (if sh(1) is ksh, at least according to sudo source code) BASH_ENV (if sh(1) is bash) PYTHONPATH (if you replace date(1) with any Python script) PERL5LIB (if you replace date(1) with any Perl script) DBUS_SESSION_BUS_ADDRESS (if you replace date(1) with something that uses D-Bus) ... and that's without getting into odd corners of Unix which are not directly executed, but can be used to construct a more subtle vulnerability (e.g. IFS). Several of these are "disarmed" if ruid != euid (e.g. D-Bus, to address CVE-2012-3524), but by calling setresuid() you lost that protection. If you're going to do that, there is little that libraries or executables can do to save you. sudo attempts to have a comprehensive blacklist (plugins/sudoers/env.c in my copy) but IMO, its length demonstrates that any blacklist-based approach is unsustainable. I continue to believe that any setuid program that executes non-trivial code without whitelist-filtering its environment is seriously flawed; and sh(1), as invoked by system(), is certainly non-trivial. Or to put it another way, executables that make themselves a privilege boundary can't trust what they receive from outside the boundary, and need to take responsibility for passing a sanitized version to things inside the boundary - doubly so if the things inside the boundary have no way to detect that a privilege boundary was ever crossed. S
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.