1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
|
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=============================================================================
FreeBSD-SA-11:07.chroot Security Advisory
The FreeBSD Project
Topic: Code execution via chrooted ftpd
Category: core
Module: libc
Announced: 2011-12-23
Affects: All supported versions of FreeBSD.
Corrected: 2011-12-23 15:00:37 UTC (RELENG_7, 7.4-STABLE)
2011-12-23 15:00:37 UTC (RELENG_7_4, 7.4-RELEASE-p5)
2011-12-23 15:00:37 UTC (RELENG_7_3, 7.3-RELEASE-p9)
2011-12-23 15:00:37 UTC (RELENG_8, 8.2-STABLE)
2011-12-23 15:00:37 UTC (RELENG_8_2, 8.2-RELEASE-p5)
2011-12-23 15:00:37 UTC (RELENG_8_1, 8.1-RELEASE-p7)
2011-12-23 15:00:37 UTC (RELENG_9, 9.0-STABLE)
2011-12-23 15:00:37 UTC (RELENG_9_0, 9.0-RELEASE)
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:http://security.FreeBSD.org/>.
I. Background
Chroot is an operation that changes the apparent root directory for the
current process and its children. The chroot(2) system call is widely
used in many applications as a measure of limiting a process's access to
the file system, as part of implementing privilege separation.
The nsdispatch(3) API implementation has a feature to reload its
configuration on demand. This feature may also load shared libraries
and run code provided by the library when requested by the configuration
file.
II. Problem Description
The nsdispatch(3) API has no mechanism to alert it to whether it is
operating within a chroot environment in which the standard paths for
configuration files and shared libraries may be untrustworthy.
The FreeBSD ftpd(8) daemon can be configured to use chroot(2), and
also uses the nsdispatch(3) API.
III. Impact
If ftpd is configured to place a user in a chroot environment, then an
attacker who can log in as that user may be able to run arbitrary code
with elevated ("root") privileges.
IV. Workaround
Don't use ftpd with the chroot option.
V. Solution
Perform one of the following:
1) Upgrade your vulnerable system to 7-STABLE or 8-STABLE, or to
the RELENG_8_2, RELENG_8_1, RELENG_7_4, or RELENG_7_3 security
branch dated after the correction date.
2) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to FreeBSD 7.4, 7.3,
8.2 and 8.1 systems.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
[FreeBSD 7.3 and 7.4]
# fetch http://security.FreeBSD.org/patches/SA-11:07/chroot7.patch
# fetch http://security.FreeBSD.org/patches/SA-11:07/chroot7.patch.asc
[FreeBSD 8.1 and 8.2]
# fetch http://security.FreeBSD.org/patches/SA-11:07/chroot8.patch
# fetch http://security.FreeBSD.org/patches/SA-11:07/chroot8.patch.asc
b) Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile the operating system as described in
<URL: http://www.freebsd.org/handbook/makeworld.html> and reboot the
system.
3) To update your vulnerable system via a binary patch:
Systems running 7.4-RELEASE, 7.3-RELEASE, 8.2-RELEASE, or 8.1-RELEASE on
the i386 or amd64 platforms can be updated via the freebsd-update(8)
utility:
# freebsd-update fetch
# freebsd-update install
4) This update adds a new API, __FreeBSD_libc_enter_restricted_mode()
to the C library, which completely disables loading of shared libraries
upon return. Applications doing chroot(2) jails need to be updated
to call this API explicitly right after the chroot(2) operation as a
safety measure.
VI. Correction details
The following list contains the revision numbers of each file that was
corrected in FreeBSD.
CVS:
Branch Revision
Path
- -------------------------------------------------------------------------
RELENG_7
src/include/unistd.h 1.80.2.4
src/lib/libc/include/libc_private.h 1.17.2.4
src/lib/libc/Versions.def 1.3.2.3
src/lib/libc/net/nsdispatch.c 1.14.2.3
src/lib/libc/gen/Symbol.map 1.6.2.7
src/lib/libc/gen/Makefile.inc 1.128.2.6
src/lib/libc/gen/libc_dlopen.c 1.2.2.2
src/libexec/ftpd/popen.c 1.26.10.2
src/libexec/ftpd/ftpd.c 1.212.2.2
RELENG_7_4
src/UPDATING 1.507.2.36.2.7
src/sys/conf/newvers.sh 1.72.2.18.2.10
src/include/unistd.h 1.80.2.3.4.2
src/lib/libc/include/libc_private.h 1.17.2.3.4.2
src/lib/libc/Versions.def 1.3.2.2.4.2
src/lib/libc/net/nsdispatch.c 1.14.2.2.2.2
src/lib/libc/gen/Symbol.map 1.6.2.6.4.2
src/lib/libc/gen/Makefile.inc 1.128.2.5.4.2
src/lib/libc/gen/libc_dlopen.c 1.2.4.2
src/libexec/ftpd/popen.c 1.26.10.1.2.2
src/libexec/ftpd/ftpd.c 1.212.2.1.6.2
RELENG_7_3
src/UPDATING 1.507.2.34.2.11
src/sys/conf/newvers.sh 1.72.2.16.2.13
src/include/unistd.h 1.80.2.3.2.2
src/lib/libc/include/libc_private.h 1.17.2.3.2.2
src/lib/libc/Versions.def 1.3.2.2.2.2
src/lib/libc/net/nsdispatch.c 1.14.2.1.6.2
src/lib/libc/gen/Symbol.map 1.6.2.6.2.2
src/lib/libc/gen/Makefile.inc 1.128.2.5.2.2
src/lib/libc/gen/libc_dlopen.c 1.1.2.1
src/libexec/ftpd/popen.c 1.26.24.2
src/libexec/ftpd/ftpd.c 1.212.2.1.4.2
RELENG_8
src/include/unistd.h 1.95.2.2
src/lib/libc/include/libc_private.h 1.20.2.3
src/lib/libc/Versions.def 1.8.2.3
src/lib/libc/net/nsdispatch.c 1.18.2.3
src/lib/libc/gen/Symbol.map 1.21.2.6
src/lib/libc/gen/Makefile.inc 1.144.2.7
src/lib/libc/gen/libc_dlopen.c 1.1.4.2
src/libexec/ftpd/popen.c 1.26.22.3
src/libexec/ftpd/ftpd.c 1.214.2.3
RELENG_8_2
src/UPDATING 1.632.2.19.2.7
src/sys/conf/newvers.sh 1.83.2.12.2.10
src/include/unistd.h 1.95.2.1.6.2
src/lib/libc/include/libc_private.h 1.20.2.2.4.2
src/lib/libc/Versions.def 1.8.2.2.4.2
src/lib/libc/net/nsdispatch.c 1.18.2.2.2.2
src/lib/libc/gen/Symbol.map 1.21.2.5.2.2
src/lib/libc/gen/Makefile.inc 1.144.2.6.2.2
src/lib/libc/gen/libc_dlopen.c 1.2.8.2
src/libexec/ftpd/popen.c 1.26.22.2.4.2
src/libexec/ftpd/ftpd.c 1.214.2.1.6.2
RELENG_8_1
src/UPDATING 1.632.2.14.2.10
src/sys/conf/newvers.sh 1.83.2.10.2.11
src/include/unistd.h 1.95.2.1.4.2
src/lib/libc/include/libc_private.h 1.20.2.2.2.2
src/lib/libc/Versions.def 1.8.2.2.2.2
src/lib/libc/net/nsdispatch.c 1.18.2.1.4.2
src/lib/libc/gen/Symbol.map 1.21.2.3.2.2
src/lib/libc/gen/Makefile.inc 1.144.2.4.2.2
src/lib/libc/gen/libc_dlopen.c 1.2.10.2
src/libexec/ftpd/popen.c 1.26.22.2.2.2
src/libexec/ftpd/ftpd.c 1.214.2.1.4.2
RELENG_9
src/include/unistd.h 1.101.2.2
src/lib/libc/include/libc_private.h 1.26.2.2
src/lib/libc/Versions.def 1.9.2.2
src/lib/libc/net/nsdispatch.c 1.19.2.2
src/lib/libc/gen/Symbol.map 1.38.2.2
src/lib/libc/gen/Makefile.inc 1.159.2.2
src/lib/libc/gen/libc_dlopen.c 1.1.6.2
src/lib/libc/iconv/citrus_module.c 1.1.2.2
src/libexec/ftpd/popen.c 1.27.2.2
src/libexec/ftpd/ftpd.c 1.220.2.2
RELENG_9_0
src/include/unistd.h 1.101.2.1.2.2
src/lib/libc/include/libc_private.h 1.26.2.1.2.2
src/lib/libc/Versions.def 1.9.2.1.2.2
src/lib/libc/net/nsdispatch.c 1.19.2.1.2.2
src/lib/libc/gen/Symbol.map 1.38.2.1.2.2
src/lib/libc/gen/Makefile.inc 1.159.2.1.2.2
src/lib/libc/gen/libc_dlopen.c 1.2.6.2
src/lib/libc/iconv/citrus_module.c 1.1.2.1.2.2
src/libexec/ftpd/popen.c 1.27.2.1.2.2
src/libexec/ftpd/ftpd.c 1.220.2.1.2.2
- -------------------------------------------------------------------------
Subversion:
Branch/path Revision
- -------------------------------------------------------------------------
stable/7/ r228843
releng/7.4/ r228843
releng/7.3/ r228843
stable/8/ r228843
releng/8.2/ r228843
releng/8.1/ r228843
stable/9/ r228843
releng/9.0/ r228843
- -------------------------------------------------------------------------
VII. References
The latest revision of this advisory is available at
http://security.FreeBSD.org/advisories/FreeBSD-SA-11:07.chroot.asc
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.18 (FreeBSD)
iEYEARECAAYFAk70nOoACgkQFdaIBMps37ILmgCgjVxRH+NsPpnXOVdwWmuxlSDp
h9wAniE0tokORcqQlFJim5Pc1Z65ybwl
=45yE
-----END PGP SIGNATURE-----
|
