Date: Thu, 30 Jun 2016 04:00:46 +0000 From: halfdog <me@...fdog.net> To: oss-security@...ts.openwall.com Subject: Debian Exim Spool Local Root -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello List, This is just a minor issue in Exim, no replies so far, so publication should be OK. Introduction: ============ Exim4 in some variants is started as root but switches to uid/gid Debian-exim/Debian-exim. But as Exim might need to store received messages in user mailboxes, it has to have the ability to regain privileges. This is also true when Exim is started as "sendmail". During internal operation, sendmail (Exim) will manipulate message spool files in directory structures owned by user "Debian-exim" without caring about symlink attacks. Thus execution of code as user "Debian-exim" can be used to gain root privileges by invoking "sendmail" as user "Debian-exim". POC: === http://www.halfdog.net/Security/2016/DebianEximSpoolLocalRoot/EximUpgrade.c demonstrates the issue using a ELF file being both executable and shared library which is invoked multiple times by different processes. Results, Discussion: =================== As Exim4 process itself is already quite privileged - it has to access the user mailboxes with different UIDs anyway - the having such problems is expectable and explainable. A change in documentation might make sense, to indicate, that the special user "Debian-exim" is only intended to mark files being used by the daemon, but not to provide root/daemon user privilege separation. Even without this vulnerability, a "Debian-exim" process could use http://www.halfdog.net/Security/2015/SetgidDirectoryPrivilegeEscalation/ to escalate to "adm" group, which again makes it very likely to use "syslog", "apache" or other components to escalate to root via "/var/log". This is annoying, perhaps this should get a CVE to make daemon-to-root escalations harder in general. Timeline: ======== 20160605: Discovery, report Debian security 20160607: Writeup 20160611: Also verified in Ubuntu, https://bugs.launchpad.net/ubuntu/+source/exim4/+bug/1580454/ 20160630: Publication References: ========== * http://www.halfdog.net/Security/2016/DebianEximSpoolLocalRoot/ * http://www.halfdog.net/Security/2015/SetgidDirectoryPrivilegeEscalation/ * https://bugs.launchpad.net/ubuntu/+source/exim4/+bug/1580454/ -----BEGIN PGP SIGNATURE----- iEYEAREKAAYFAld0lPUACgkQxFmThv7tq+5MeACePVuh5CppGyhUudMfK7kjDXjj 8mcAn2AcZFVEwUKSHadffJJyCNLP0X7H =4IJk -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.