oss-security - Re: Multiple libraries privilege checking

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20110516185637.GA30099@openwall.com>
Date: Mon, 16 May 2011 22:56:37 +0400
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: Multiple libraries privilege checking

On Mon, May 16, 2011 at 04:27:41PM +0200, Sebastian Krahmer wrote:
> Its probably about time to review libraries that are commonly
> linked to (formerly-) suid programs, such as
> libldap, libssl etc. In near future, in the advent of file caps
> they are often lacking proper checks.

Good idea.

> They usually just compare uid against euid (not even gid sometimes)
> and do not check the dumpable flag or AT_SECURE (dont know whether
> glibc exports a proper function to easily check that at all).

glibc exports the __libc_enable_secure variable, which is initialized
based on AT_* including AT_SECURE.  It also exports __secure_getenv().

> The libraries that I had a quick look at and which were found
> "vulnerable" are:
> 
> - openssl-1.0.0c

We've been patching OpenSSL to use __libc_enable_secure for over 10
years now. ;-)  The patch is in use at least in Owl and ALT Linux.

* Sun Apr 22 2001 Solar Designer <solar-at-owl.openwall.com>
...
- Use glibc's __libc_enable_secure for the new OPENSSL_issetugid().

I've attached our patches for OpenSSL, ncurses, S-Lang, termcap, rpm's
popt.  Of these, OpenSSL and ncurses apply to recent versions, termcap
is old by itself, whereas the rest might be obsoleted by changes made
upstream (and they're not strictly for the problem you brought up).

For OpenSSL, there's another problem: it looks like some getenv()'s
were added after the initial introduction of OPENSSL_issetugid() and
without consideration for possible security implications.  Some of those
should be patched.  This got on my to-do when we updated to OpenSSL
1.0.0d earlier this year - to do myself or delegate, but I never got
around to...  Maybe you're the one to look into this and come up with a
patch now? ;-)

Thanks,

Alexander

View attachment "openssl-1.0.0b-owl-alt-issetugid.diff" of type "text/plain" (345 bytes)

View attachment "ncurses-5.7-owl-glibc-enable_secure.diff" of type "text/plain" (930 bytes)

View attachment "slang-1.4.6-owl-fixes.diff" of type "text/plain" (7525 bytes)

View attachment "termcap-2.0.8-owl-TERMCAP.diff" of type "text/plain" (406 bytes)

View attachment "rpm-4.2-owl-popt-sgid.diff" of type "text/plain" (1987 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.