From owner-doc-jp-work@jp.FreeBSD.org Sat Aug  3 03:11:58 2002
Received: (from daemon@localhost)
	by castle.jp.FreeBSD.org (8.11.6+3.4W/8.11.3) id g72IBwu76469;
	Sat, 3 Aug 2002 03:11:58 +0900 (JST)
	(envelope-from owner-doc-jp-work@jp.FreeBSD.org)
Received: from wasley.bl.mmtr.or.jp (wasley.bl.mmtr.or.jp [210.228.160.21])
	by castle.jp.FreeBSD.org (8.11.6+3.4W/8.11.3) with SMTP/inet id g72IBvn76464
	for <doc-jp-work@jp.FreeBSD.org>; Sat, 3 Aug 2002 03:11:57 +0900 (JST)
	(envelope-from rushani@bl.mmtr.or.jp)
Received: (qmail 24056 invoked from network); 3 Aug 2002 03:11:54 +0900
Received: from unknown (HELO localhost) (210.165.137.233)
  by mx.bl.mmtr.or.jp with SMTP; 3 Aug 2002 03:11:54 +0900
Date: Sat, 03 Aug 2002 03:11:06 +0900 (JST)
Message-Id: <20020803.031106.02306575.rushani@bl.mmtr.or.jp>
To: doc-jp-work@jp.FreeBSD.org
From: Hideyuki KURASHINA <rushani@bl.mmtr.or.jp>
X-PGP-Public-Key: http://www.bl.mmtr.or.jp/~rushani/public_key.txt
X-PGP-Fingerprint: A052 6F98 6146 6FE3 91E2  DA6B F2FA 2088 439A DC57
X-URL: http://www.bl.mmtr.or.jp/~rushani/
X-Mailer: Mew version 3.0.54 on Emacs 21.2 / Mule 5.0 (SAKAKI)
Mime-Version: 1.0
Content-Type: Multipart/Mixed;
 boundary="--Next_Part(Sat_Aug__3_03:11:06_2002_114)--"
Content-Transfer-Encoding: 7bit
Reply-To: doc-jp-work@jp.FreeBSD.org
Precedence: list
X-Sequence: doc-jp-work 454
Subject: [doc-jp-work 454] Re: ANNOUNCE: FreeBSD Security Advisory FreeBSD-SA-02:32.pppd
Errors-To: owner-doc-jp-work@jp.FreeBSD.org
Sender: owner-doc-jp-work@jp.FreeBSD.org
X-Originator: rushani@bl.mmtr.or.jp
X-Distribute: distribute version 2.1 (Alpha) patchlevel 24e+020727

----Next_Part(Sat_Aug__3_03:11:06_2002_114)--
Content-Type: Text/Plain; charset=iso-2022-jp
Content-Transfer-Encoding: 7bit

$BARIJ$G$9(B.

02:32.pppd $B$G$9(B.

$B!VLdBj$N>\:Y!W$N(B "The call to chmod(2) is subject to a symlink race, ..."
$B$K<+?.$,$J$$$N$GC!$$$F$/$@$5$$(B.

***

$B$=$l$+$i(B 02:33.openssl, 02:34.rpc $B$N(B style $BJQ99$N$_$N%Q%C%A$G$9(B.


--- 02:33.work2	Sat Aug  3 01:41:58 2002
+++ 02:33	Sat Aug  3 01:43:20 2002
@@ -31,6 +31,7 @@
 
 $B%H%T%C%/(B:       openssl $B$K$*$1$kJ#?t$N%;%-%e%j%F%#>e$N<eE@(B
                 (openssl contains multiple vulnerabilities)
+
 $BJ,N`(B:           core
 $B%b%8%e!<%k(B:     crypto/openssl
 $B9pCNF|(B:         2002-07-31
@@ -110,7 +111,7 @@
 V.   $B2r7h:v(B - Solution
 
 Do one of the following:
-$B<!$N$&$A$N$R$H$D$r9T$C$F$/$@$5$$(B
+$B<!$N$&$A$N$R$H$D$r9T$C$F$/$@$5$$!#(B
 
 1) Upgrade your vulnerable system to 4.6-STABLE; or to the RELENG_4_6,
 RELENG_4_5, or RELENG_4_4 security branch dated after the correction

--- 02:34.work2	Sat Aug  3 01:43:49 2002
+++ 02:34	Sat Aug  3 01:44:01 2002
@@ -31,6 +31,7 @@
 
 $B%H%T%C%/(B:       Sun RPC XDR $B%G%3!<%@$K$*$1$k%P%C%U%!%*!<%P%U%m!<(B
                 (Sun RPC XDR decoder contains buffer overflow)
+
 $BJ,N`(B:           core
 $B%b%8%e!<%k(B:     libc
 $B9pCNF|(B:         2002-08-01


-- rushani

----Next_Part(Sat_Aug__3_03:11:06_2002_114)--
Content-Type: Text/Plain; charset=iso-2022-jp
Content-Transfer-Encoding: 7bit
Content-Disposition: inline; filename="02:32"


FreeBSD $B%;%-%e%j%F%#4+9p(B $BF|K\8lHG(B
=============================================================================
FreeBSD-SA-02:32.pppd (2002-07-31)
 * exploitable race condition in pppd
=============================================================================

 $B$3$N%a!<%k$O(B, announce-jp $B$KN.$l$?(B

  Subject: ANNOUNCE: FreeBSD Security Advisory FreeBSD-SA-02:32.pppd
  From: FreeBSD Security Advisories <security-advisories@FreeBSD.org>
  Date: Wed, 31 Jul 2002 05:02:12 -0700 (PDT)
  Message-Id: <200207311202.g6VC2CFK023547@freefall.freebsd.org>
  X-Sequence: announce-jp 1017

 $B$rF|K\8lLu$7$?$b$N$G$9!#(B

 $B86J8$O(B PGP $B=pL>$5$l$F$$$^$9$,!"$3$NF|K\8lLu$O(B PGP $B=pL>$5$l$F$$$^$;$s!#(B
 $B=$@5%Q%C%AEy$NFbMF$,2~$6$s$5$l$F$$$J$$$3$H$r3NG'$9$k$?$a$K(B PGP $B=pL>$N(B
 $B%A%'%C%/$r9T$J$&$K$O!"86J8$r;2>H$7$F$/$@$5$$!#(B

 $BF|K\8lLu$*$h$S%_%i!<%5%$%HMxMQ$N>\:Y$K$D$$$F$O!"J8Kv$N!V(BA. FreeBSD
 $B%;%-%e%j%F%#4+9p(B $BF|K\8lHG$K$D$$$F!W$r$4Mw$/$@$5$$!#(B


                                 [$BK]Lu<T(B: $BARIJ(B $B1Q9T(B <rushani@jp.FreeBSD.org>]
--($B$3$3$+$i(B)
=============================================================================
FreeBSD-SA-02:32.pppd                                       Security Advisory
                                                          The FreeBSD Project

$B%H%T%C%/(B:       pppd $B$KB8:_$9$k0-MQ2DG=$J6%9g>uBV(B
                (exploitable race condition in pppd)

$BJ,N`(B:           core
$B%b%8%e!<%k(B:     pppd
$B9pCNF|(B:         2002-07-31
$B%/%l%8%C%H(B:     Sebastian Krahmer <krahmer@suse.de>
$B1F6AHO0O(B:       4.6.1-RELEASE-p1 $B$r4^$`=$@5F|0JA0$N$9$Y$F$N(B FreeBSD
$B=$@5F|(B:         2002-07-30 03:50:40 UTC (RELENG_4)
                2002-07-30 19:15:52 UTC (RELENG_4_6)
                2002-07-30 19:16:46 UTC (RELENG_4_5)
                2002-07-30 19:17:27 UTC (RELENG_4_4)
FreeBSD $B$K8GM-$+(B:       NO

I.   $BGX7J(B - Background

FreeBSD ships with several implementations of the Point-to-Point
Protocol (PPP).  The pppd program is one of these implementations.  It
provides basic support for negotiating a link, while encapsulation is
done by driver code in the kernel.
FreeBSD $B$K$O(B Point-to-Point Protocol (PPP) $B$N<BAu$,$$$/$D$+$"$j!"(B
$B$=$N$&$A$N$R$H$D$,(B pppd $B$G$9!#(Bpppd $B$O4pK\E*$J%j%s%/%M%4%7%(!<%7%g%s(B
$B5!G=$rDs6!$7!"(Bkernel $BFb$N%I%i%$%P$K$h$C$F%+%W%;%k2=$r9T$$$^$9!#(B

II.  $BLdBj$N>\:Y(B - Problem Description

A race condition exists in the pppd program that may be exploited
in order to change the permissions of an arbitrary file.  The file
specified as the tty device is opened by pppd, and the permissions
are recorded.  If pppd fails to initialize the tty device in some way
(such as a failure of tcgetattr(3)), then pppd will then attempt to
restore the original permissions by calling chmod(2).  The call to
chmod(2) is subject to a symlink race, so that the permissions may
`restored' on some other file.
pppd $B$K$O!"G$0U$N%U%!%$%k$N5v2DB0@-$rJQ99$9$k$?$a$K!"0-MQ2DG=$J(B
$B6%9g>uBV$,B8:_$7$^$9!#(Bpppd $B$O(B tty $B%G%P%$%9$H$7$F;XDj$7$?%U%!%$%k$r(B
$B%*!<%W%s$7!"$=$N5v2DB0@-$,5-O?$7$^$9!#$"$kJ}K!(B ($BNc$($P(B tcgetattr(3)
$B$,<:GT$7$?$H$-$J$I(B) $B$K$h$C$F(B tty $B%G%P%$%9$N=i4|2=$K<:GT$9$k$H!"(Bpppd $B$O(B
chmod(2) $B$r8F$S=P$7$F%U%!%$%k$NK\Mh$N5v2DB0@-$KLa$=$&$H$7$^$9!#(B
$B$7$+$7!"(Bchmod(2) $B$O%7%s%\%j%C%/%j%s%/$N6%9g$K=>$&$N$G!"JL$N%U%!%$%k$N(B
$B5v2DB0@-$r!VJQ99$7$F$7$^$&!W2DG=@-$,$"$j$^$9!#(B

Note that the pppd program is installed set-user-ID to root, so that
any file's permissions may be changed in this fashion.
pppd $B$O(B root $B$K(B set-user-ID $B$5$l$F%$%s%9%H!<%k$5$l$^$9!#$=$N$?$a!"(B
$B$3$NJ}K!$rMQ$$$FG$0U$N%U%!%$%k$N5v2DB0@-$rJQ99$5$l$k2DG=@-$,$"$k(B
$B$H$$$&$3$H$KCm0U$7$F$/$@$5$$!#(B

III. $B1F6AHO0O(B - Impact

A malicious local user may exploit the race condition to acquire write
permissions to a critical system file, such as /etc/crontab, and
leverage the situation to acquire escalated privileges.
$B0-0U$r;}$C$?%m!<%+%k%f!<%6$O!"$3$N6%9g>uBV$r0-MQ$7$F(B /etc/crontab $B$N(B
$B$h$&$K%7%9%F%`$XCWL?E*$J1F6A$r5Z$\$9%U%!%$%k$N=q$-9~$_8"8B$r<hF@$9$k(B
$B$3$H$,2DG=$G$9!#$3$N>u67$rA}I}$7$F$5$i$K>e0L$N8"8B$rIT@5$K<hF@$9$k(B
$B$3$H$G$-$^$9!#(B

In FreeBSD 4.4-RELEASE and later, the local user must be in group
`dialer' in order to run pppd and attempt to exploit this race.
FreeBSD 4.4-RELEASE $B$H$=$l0J9_$G$O!"%m!<%+%k%f!<%6$O(B pppd $B$r<B9T$9$k(B
$B$?$a$K(B dialer $B%0%k!<%W$K=jB0$7$F$$$kI,MW$,$"$j$^$9$,!"$3$N6%9g>uBV$r(B
$B0-MQ$7$h$&$H;n$_$k$3$H$,2DG=$G$9!#(B

IV.  $B2sHrJ}K!(B - Workaround

root $B$G0J2<$N%3%^%s%I$r<B9T$7$F(B pppd $B$+$i(B set-user-ID $B$r:o=|$7$^$9!#(B

# chmod u-s /usr/sbin/pppd

V.   $B2r7h:v(B - Solution

Do one of the following:
$B<!$N$&$A$N$R$H$D$r9T$C$F$/$@$5$$!#(B

1) Upgrade your vulnerable system to 4.6-STABLE; or to the RELENG_4_6,
RELENG_4_5, or RELENG_4_4 security branch dated after the correction
date (4.6.1-RELEASE-p2, 4.5-RELEASE-p11, or 4.4-RELEASE-p18).
1) $B<eE@$r;}$C$?(B FreeBSD $B%7%9%F%`$r:G?7$N(B 4.6-STABLE $B$K%"%C%W%0%l!<%I(B
   $B$9$k$+!"=$@5F|0J9_$N(B RELENG_4_6$B!"(BRELENG_4_5$B!"(BRELENG_4_4 $B%;%-%e%j%F%#(B
   $B%V%i%s%A(B (4.6.1-RELEASE-p2$B!"(B4.5-RELEASE-p11$B!"$^$?$O(B 4.4-RELEASE-p18)
   $B$N$$$:$l$+$K%"%C%W%0%l!<%I$9$k!#(B

2) To patch your present system:
2) $B8=:_$N%7%9%F%`$K%Q%C%A$rE,MQ$9$k!#(B

The following patch has been verified to apply to FreeBSD 4.4, 4.5,
and 4.6 systems.
$B0J2<$N=$@5%Q%C%A$O!"(BFreeBSD 4.6-RELEASE$B!"(B4.5-RELEASE$B!"(B4.4-RELEASE $B$K(B
$BE,MQ$G$-$k$3$H$,3NG'$5$l$F$$$k$b$N$G$9!#(B

a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
a) $B0J2<$N>l=j$+$i=$@5%Q%C%A$r%@%&%s%m!<%I$7!"(BPGP $B%f!<%F%#%j%F%#$r;H$C$F(B
   PGP $B=pL>$r3NG'$7$^$9!#(B

# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:32/pppd.patch
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:32/pppd.patch.asc

b) Execute the following commands as root:
b) Execute the following commands as root:
b) root $B$G0J2<$N%3%^%s%I$r<B9T$7$^$9!#(B

# cd /usr/src
# patch < /path/to/patch
# cd /usr/src/usr.sbin/pppd
# make depend && make && make install

VI.  $B=$@5$N>\:Y(B - Correction details

The following list contains the revision numbers of each file that was
corrected in FreeBSD.
FreeBSD $B$N$*$$$F:#2s=$@5$5$l$?3F%U%!%$%k$N%j%S%8%g%sHV9f$r0J2<$K<($7$^$9!#(B

Path                                                             Revision
  Branch
- -------------------------------------------------------------------------
usr.sbin/pppd/main.c
  RELENG_4                                                       1.19.2.1
  RELENG_4_6                                                    1.19.10.1
  RELENG_4_5                                                     1.19.8.1
  RELENG_4_4                                                     1.19.6.1
sys/conf/newvers.sh
  RELENG_4_6                                                1.44.2.23.2.7
  RELENG_4_5                                               1.44.2.20.2.12
  RELENG_4_4                                               1.44.2.17.2.17
- -------------------------------------------------------------------------

A.   FreeBSD $B%;%-%e%j%F%#4+9p(B $BF|K\8lHG$K$D$$$F(B

$BF|K\8lLu$O(B FreeBSD $BF|K\8l%I%-%e%a%s%F!<%7%g%s%W%m%8%'%/%H(B (doc-jp) $B$,(B
$B;29M$N$?$a$KDs6!$9$k$b$N$G$9!#2a5n$NF|K\8lHG%;%-%e%j%F%#4+9p$O(B

 http://www.FreeBSD.org/ja/security/

$B$K$^$H$a$i$l$F$$$^$9!#(B

$B$?$@$7K]Lu<T$*$h$S(B doc-jp $B$O!"$=$NFbMF$K$D$$$F$$$+$J$kJ]>Z$b(B
$B$$$?$7$^$;$s$N$G$4Cm0U$/$@$5$$!#F|K\8lLu$K$D$$$F$N$40U8+!"$4MWK>!"(B
$B$*Ld$$9g$o$;Ey$O(B doc-jp@jp.FreeBSD.org $B$^$G$*4j$$$7$^$9!#(B

$B$3$N4+9p$NCf$G>R2p$5$l$F$$$k(B WWW $B%5%$%H(B http://www.FreeBSD.org/ $B$*$h$S(B
FTP $B%5%$%H(B ftp://ftp.FreeBSD.org/ $B$K$O(B, $BF|K\$N%_%i!<%5%$%H$,B8:_$7$^$9!#(B
$B%M%C%H%o!<%/$N:.;($r4KOB$9$k$?$a!"$^$:$O%_%i!<%5%$%H$NMxMQ$r(B
$B9MN8$9$k$h$&$*4j$$$7$^$9!#(B

$BF|K\$N%_%i!<%5%$%H$rMxMQ$9$k$K$O!"(B
http://www.FreeBSD.org/ $B$r(B http://www.jp.FreeBSD.org/www.freebsd.org/ $B$K!"(B
ftp://ftp.FreeBSD.org/ $B$r(B ftp://ftp.jp.FreeBSD.org/ $B$K!"(B
$B$=$l$>$lCV$-49$($F$/$@$5$$!#(B

$BB>$NCO0h$r4^$`%_%i!<%5%$%H$K4X$9$k>\:Y$O(B

 http://www.FreeBSD.org/handbook/mirror.html ($B1QJ8(B)
 http://www.FreeBSD.org/ja/handbook/mirror.html ($BF|K\8lLu(B)

$B$K$^$H$a$i$l$F$$$^$9!#(B

----Next_Part(Sat_Aug__3_03:11:06_2002_114)----
