SuSE: 'shadow/login' local privilege escalation vulnerability
Summary
______________________________________________________________________________
SuSE Security Announcement
Package: shadow/login
Announcement-ID: SuSE-SA:2001:034
Date: Tuesday, Oct 23rd 2001 18:00 MEST
Affected SuSE versions: 6.3, 6.4, 7.0, 7.1, 7.2, 7.3
Vulnerability Type: local privilege escalation
Severity (1-10): 2
SuSE default package: yes
Other affected systems: most linux systems, common problem on
linux-like systems.
Content of this advisory:
1) security vulnerability resolved: shadow/login
problem description, discussion, solution and upgrade information
2) pending vulnerabilities, solutions, workarounds
3) standard appendix (further information)
______________________________________________________________________________
1) problem description, brief discussion, solution, upgrade information
Multiple Linux vendors have issued security announcements about failures
of the /bin/login program to properly initialize the privileges of an
authenticated user if the PAM module pam_limits is enabled.
The bug has been categorized as a sequence bug, and is located in the
code of the login program itself: A call to getpwnam(3) returns a pointer
to a struct passwd, and the data is being used. Then, a call to PAM
routines cause getpwnam(3) to be called again, but beyond the programmer's
control or knowledge. The pointer as returned by the first getpwnam(3)
remains the same, but the data may be different. By consequence, the
data is in an undefined state. The error appears with the pam_limits
PAM module only because other PAM modules do not call getpwnam(3).
SuSE developers did not succeed in reproducing the error on SuSE Linux
installations since SuSE distributions do not come with the standard
login implementation from the util-linux collection. Instead, a version
maintained by Thorsten Kukuk <kukuk@suse.de> is used. This login
implementation may cause wrong group IDs to be set in very rare cases.
The harm of this bug is therefore considerably small on SuSE Linux.
However, we provide fixed rpm packages that remedy the problem. Since
the bug is not limited to the login program but to all programs that
authenticate users, more security announcements in this field are to
be expected. The Linux vendors cooperate to share the workload that
results from the audit of these programs.
To install the updates, please download the update package for your
distribution and use the command 'rpm -Uhv file.rpm' to apply the update.
Please run "SuSEconfig" after performing the package update to make sure
that the permissions of your files are configured as the security
settings of your installation define. Alternatively, if you have disabled
SuSEconfig, check for the permissions of the files /usr/bin/chage,
/usr/bin/chfn, /usr/bin/chsh, /usr/bin/expiry, /usr/bin/gpasswd and
/usr/bin/passwd to suit your needs. Setting these executeables to 4755
owned by root enables their functionality, removing the setuid bit
(chmod -s) disables it.
i386 Intel Platform:
SuSE-7.3
9380496a4a248aeac73d7136de381348
source rpm:
b595cea811bb92aa895974aee2fd5968
SuSE-7.2
18e33d4b728b49403c2679c560b52f06
source rpm:
0d9fb9cec79cdd4671306658a103fc6b
SuSE-7.1
a5b2177d66048f988249e0acbc9648bf
source rpm:
4525572bf268b73004774a25d7f5de2a
SuSE-7.0
2be3765b08ce9d94abbd4932dbe3f39b
source rpm:
97935450371dde96cb92134ab8596b85
SuSE-6.4
c6d07aa8662e00d501f9fbb9d57f71bb
source rpm:
79d9e99e67fcd23d64508eafe5070b36
SuSE-6.3
82c4466697251685c5f1fa733c0ad4e2
source rpm:
bac32336670e134146af62886e3d477e
Sparc Platform:
SuSE-7.1
3e63326bd5dd2dd3e9d8175b6db918e0
source rpm:
c95b2761cc4d9b417394a550d43716ca
SuSE-7.0
5ce1d42bb0e5a6677666390b9980de5d
source rpm:
622dc8e8c6d6bf90f09d79b144a20533
AXP Alpha Platform:
SuSE-7.1
ed882226bcb5241e105fb0f6466bf476
source rpm:
b70743683ca521d66be357b90baff035
SuSE-7.0
778ebfcaacc9087e6c781f6a10a68a75
source rpm:
68d957bf5d0cc942e12501056d05f0bd
SuSE-6.4
e7646c335fa009506535412daf344480
source rpm:
3d748914265b37b15b42687e5ff87945
SuSE-6.3
c1cb80bb6d7a15a445550c739ced029b
source rpm:
0b05d59fffc9ff8bd1cb922df7a84fac
PPC Power PC Platform:
SuSE-7.1
a1dbc8bb966db28469fabe583d157bed
source rpm:
2b2f0fbcb842149cb095fff125f54279
SuSE-7.0
d55986fc84158f06dcbfea0c7812037f
source rpm:
dc84f0301b4a4daeae1fb6465f0d16c1
SuSE-6.4
3d7e644c70e6d98944ff623b24bbfde0
source rpm:
646985dc82d9845832db6863fba9442d
______________________________________________________________________________
2) Pending vulnerabilities in SuSE Distributions and Workarounds:
- Linux kernel
Security bugs have been found in both the 2.2 and 2.4 kernel series
of all currently supported SuSE Linux distributions (6.3-7.3), including
the freshly appeared SuSE-7.3. These bugs allow a local attacker to gain
root privileges, but there is no remote attack as of now.
As a temporary workaround, it is possible for experienced users of
linux-like systems to disable all setuid bits from all files in the
installed system using a find command with a -exec option.
We are currently in the process of testing the update kernels of both
2.2 (2.2.19) and 2.4 (2.4.13) series to make sure that these update
kernels will have the same level of stability and robustness as expected
from SuSE linux systems. The official kernel rpm packages will be
announced in a SuSE Security announcement during the second half of
this week. In the meanwhile, the directory
contains the preliminary
update packages for testing (2.2.19 packages will be available shortly).
Please proceed with the update as described in
SUSE – Open-Source-Lösungen für Enterprise Server und Cloud | SUSE
and report any problems that you may find to feedback@suse.de.
- openssh
After stabilizing the openssh package, updates for the distributions
6.4-7.2 are currently being prepared. The update packages fix a security
problem related to the recently discovered problems with source ip
based access restrictions in a user's ~/.ssh/authorized_keys2 file.
The packages will appear shortly on our ftp servers. Please note that
packages for the distributions 6.3 and up including 7.0 containing
cryptographic software are located on the German ftp server ftp.suse.de,
all other packages can be found on ftp.suse.com at the usual location.
- htdig (ht://Dig)
htdig, a powerful indexing and information gathering tool for a webserver,
has been found vulnerable to a weakness where commandline options can
be passed on to the cgi program as a result of weak runtime environment
checking. The security announcement by Thomas Biege is waiting for the
update packages to reach the ftp-server (currently transferring).
Please continue to watch the suse-security-announce mailing list for
new security announcements.
______________________________________________________________________________
3) standard appendix: authenticity verification, additional information
- Package authenticity verification:
SuSE update packages are available on many mirror ftp servers all over
the world. While this service is being considered valuable and important
to the free and open source software community, many users wish to be
sure about the origin of the package and its content before installing
the package. There are two verification methods that can be used
independently from each other to prove the authenticity of a downloaded
file or rpm package:
1) md5sums as provided in the (cryptographically signed) announcement.
2) using the internal gpg signatures of the rpm package.
1) execute the command
md5sum
References
