lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <A4802233B78DC349B09F24734411414D54A51E@blackbox.mius.cz>
Date: Sat, 5 Apr 2003 12:24:53 +0200
From: Kotala Zdeněk <Zdenek.Kotala@...s.cz>
To: bugtraq@...urityfocus.com
Subject: Interbase/Firebird - external file security bug


Class: IB/FB can create or modify all accessible files on disk
Remote: YES
Localy: YES

Vulnerable: IB 6.01, IB6.5, FB 1.0.2 (WIN/Linux)
Not Vulnerable: IB7.0
Not Tested: FB 1.5 Beta

Overview:

IB/FB support external file for table. Data store in raw format and
there isn't access rectriction. If file exist it's opened for R/W append
mode.
Default IB6/FB1 installation use system (win) or root(linux) account to run 
IBServer.

Precondition:

This bug is exploitable only if user is authorized into ibserver, but on
default
linux instalation FB1.0.2, I can create database and external table without 
user/password(isql has been used). And in another case, there are many 
methods how is possible get password (sniffs, brute force ...).

Description:

There tree method for abusing this security bug:

1) First method allows users to carry away binary database file.
This metod was reported on Borland QualityCentral (5.3.2002). It's
report 278. 

2)  With this issue IBserver can read and modify all files accesible on
disk. If
external table is used, only raw data are stored into file. The linux
example:

create table test external '/etc/passwd' (id char(80));
insert into test values('r00t::0:0:root:/root:/bin/bash');

This example append r00t user into system without password and with root
access.

3) Concept of third method is to use UDF function for installation back door
into system. 

  1) cracker create external file into UDF libs dir which contain backdoor
    function,
  2) import udf function and start them from SQL,
  3) install better backdoor thru the UDF backdoor.

I don't test UDF example, but I thing that it's will work. It may be used
under other user account.

Workaround:

Upgrade to IB version 7 or you may convert process owner from root/SYSTEM to
other with more security restriction, but this isn't defence for method 1.

FB 1.0.2 contain script for convert rights from root to firebird account,
but
it's don't work correctly. All firebird's binary dirs are owned by firebird
user
and it may be abused for installation bad UDF lib.


Thanks:

Thanks to Craig Stuntz


Firebird and Iterbase team was contacted.



                    


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ