| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CADxEXOjkQovB-+B_TJzv-RM-qWVX5s0cRmZUF4cRBBgwAPM-zQ@mail.gmail.com>
Date: Tue, 7 Apr 2015 21:46:40 +0000
From: Pierre Kim <pierre.kim.sec@...il.com>
To: bugtraq@...urityfocus.com
Subject: FreeBSD 10.x ZFS encryption.key disclosure (CVE-2015-1415)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
## Advisory Information
Title: FreeBSD 10.x ZFS encryption.key disclosure (CVE-2015-1415)
Advisory URL: https://pierrekim.github.io/advisories/CVE-2015-1415.txt.asc
Date published: 2015-04-07
Vendors contacted: FreeBSD
Release mode: Coordinated release
## Product Description
FreeBSD is a UNIX-like operating system.
## Vulnerability Summary
FreeBSD 10.x installer supports the installation of FreeBSD 10.x on an
encrypted ZFS filesystem by default.
When using the encryption system within ZFS during the installation of
FreeBSD 10.0 and FreeBSD 10.1, the encryption.key has wrong permissions
which allow local users to read this file.
Even if the keyfile is passphrase-encrypted, it can present a risk.
## Details
By default, the encryption key file is /boot/encryption.key.
Instead of being 0600, the permissions are 0644:
$ ls -la /boot/encryption.key
- -rw-r--r-- 1 root wheel 4096 Feb 17 15:16 /boot/encryption.key
$
This file is readable by a local user.
## Vendor Response
According to the vendor, a security advisory will be published, describing
the problem and the solution. It concerns:
- stable/10, 10.1-STABLE
- releng/10.1, 10.1-RELEASE-p8
- releng/10.0, 10.0-RELEASE-p18
## Report Timeline
* Mar 01, 2015: Problem found by Pierre Kim
* Apr 01, 2015: Vendor is notified of the vulnerability
* Apr 01, 2015: Vendor confirms report and indicates a fix is prepared
but there will be no security advisory format notification because of
the nature of the problem
* Apr 02, 2015: Pierre Kim asks a CVE number to the vendor
* Apr 02, 2015: Vendor indicates to use CVE-2015-1415 and confirms that a
signed notification to the mailing lists will be sent.
* Apr 03, 2015: Pierre Kim contacts FreeBSD about the future notification
* Apr 04, 2015: Vendor confirms a security advisory will be published
next week
* Apr 07, 2015: Vendor publishes a security advisory (FreeBSD-SA-15:08)
* Apt 07, 2015: This advisory is sent to bugtraq@
## Credit
This vulnerability was found by Pierre Kim (@PierreKimSec).
## References
https://www.freebsd.org/doc/handbook/bsdinstall-partitioning.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1415
https://www.freebsd.org/security/advisories/FreeBSD-SA-15:08.bsdinstall.asc
## Disclaimer
This advisory is licensed under a Creative Commons Attribution Non-Commercial
Share-Alike 3.0 License: http://creativecommons.org/licenses/by-nc-sa/3.0/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBCAAGBQJVJF22AAoJEMQ+Dtp9ky28NDgP/iW9YALiZKLPVhnShFEhFO4C
SvSza1s7LJkhtOH8qOGplzTrn8wSV5BNhwzMaIaKpksP5RjoCkynxvAw/OncazPl
tsfHM89m7bQ4puyXF3eb6lMkfaIkxoDAXM5R5DFb2Q+3wg4SDygdM7+BQEdqCXDV
2B+ZNGae2CcsqLq04zjskFgY2bwqNMyX3GbbmUJvVI5IXQIS30e1lVIq8zxcK7u0
lKFlVyp+gdyusenPz0lCqR82Pe1IA3tHuNn2zw3/EudT4VhD789/t/0lEWlSyNg7
uiTCqFpQXnpEnvXEez1gZiDuNccIMXXYv0agB+/mYkkoviQPk5jqCwI5rvs+ppFU
IH0gAafqS/UIl5+/dhDdIVDA4+r4WWLUxJfFkDy4ThCQHZtZMCsBYk3/RNJBPDUW
JiVZWV8LSSHtYfWj7YoiCswuC9FLp6CT9e+/XQUJjpNrwfpeT5KlFOCFUKQXwV6W
5nUJnQhjVfrXVjeRuOvMCInSwG8DWbfyX75QMmJNyV7aPMrS2prRXbOlTLuQUyzP
cJkmToeO4XE4COV+jvtC+c39Booy3r8yp3lfHmz1NXffiv6Ua+11vLamUeYOVPew
r4TmionPpSeAx3ODhKEKGjW+HIkl9sx3WcSnEBl88Aqd3Zv77G3ok4usFz4PvPnb
/hnH/lhpePtv13jyZpXc
=pOPH
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists