-----BEGIN PGP SIGNED MESSAGE----- =============================================================================== Security Advisory CERT-NL =============================================================================== Author/Source : Gert Meijerink Index : S-96-28 Distribution : World Page : 1 Classification: External Version: 1 Subject : Vendor Initiated Bulletin: FreeBSD man page Date : 23-may-96 =============================================================================== By courtesy of FreeBSD, Inc. we received information on a vulnerability in the man page utility. CERT-NL recommends to implement the provided workaround. ============================================================================== ============================================================================= FreeBSD-SA-96:11 Security Advisory Revised: Wed May 22 00:11:46 PDT 1996 FreeBSD, Inc. Topic: security compromise from man page utility Category: core Module: man Announced: 1996-05-21 Affects: FreeBSD 2.0, 2.0.5, 2.1, 2.1-stable, and 2.2-current Corrected: 2.1-stable and 2.2-current as of 1996-05-21 FreeBSD only: yes Patches: ftp://freebsd.org/pub/CERT/patches/SA-96:11/ ============================================================================= I. Background FreeBSD replaced the standard BSD manual page reader with code developed by a third party to support compressed manual pages. A bug was found in the manual page reader which can allow an unprivileged local user to compromise system security in a limited fashion. This problem is present in all source code and binary distributions of FreeBSD version 2.x released before 1996-05-21. II. Problem Description The man program is setuid to the "man" user. By executing a particular sequence of commands, an unprivileged local user may gain the access privileges of the "man" user. However, root access could be obtained with further work. III. Impact The "man" user has no particular special privileges, it is the owner of the /usr/share/man/cat[0-9] directory hierarchy. Unformatted system manual pages are owned by the "bin" user. However, further exploits once "man" is obtained could possibly allow a local user to obtain unlimited access via a trojan horse. This vulnerability can only be exploited by users with a valid account on the local system. IV. Workaround One may simply disable the setuid bit on the /usr/bin/man file. This will disable caching of formatted manual pages, no system functionality will be lost. This workaround will suffice for all versions of FreeBSD affected by this problem. As root, execute the command: # chmod u-s /usr/bin/man then verify that the setuid permissions of the files have been removed. The permissions array should read "-r-xr-xr-x" as shown here: # ls -l /usr/bin/man -r-xr-xr-x 1 man bin 28672 May 19 20:38 /usr/bin/man We also suggest applying the following patch to the source distribution so that the man program will not be installed setuid man should you rebuild from sources: *** /usr/src/gnu/usr.bin/man/man/Makefile Sun Feb 25 13:39:52 1996 --- /usr/src/gnu/usr.bin/man/man/Makefile Wed May 22 00:13:05 1996 *************** *** 1,7 **** PROG= man SRCS= man.c manpath.c glob.c - BINMODE=4555 - BINOWN= man .if exists(${.CURDIR}/../lib/obj) LDADD= -L${.CURDIR}/../lib/obj -lman --- 1,5 ---- V. Solution The FreeBSD team is in the process of rewriting portions of the manual program to avoid this and similar vulnerabilities. This security advisory will be updated when a complete solution is available. ============================================================================= FreeBSD, Inc. Web Site: http://www.freebsd.org/ Confidential contacts: security-officer@freebsd.org PGP Key: ftp://freebsd.org/pub/CERT/public_key.asc Security notifications: security-notifications@freebsd.org Security public discussion: security@freebsd.org ============================================================================== CERT-NL is the Computer Emergency Response Team for SURFnet customers. SURFnet is the Dutch network for educational, research and related institutes. CERT-NL is a member of the Forum of Incident Response and Security Teams (FIRST). All CERT-NL material is available under: http://www.surfnet.nl/surfnet/security/cert-nl.html ftp://ftp.surfnet.nl/surfnet/net-security In case of computer or network security problems please contact your local CERT/security-team or CERT-NL (if your institute is NOT a SURFnet customer please address the appropriate (local) CERT/security-team). CERT-NL is one/two hour(s) ahead of UTC (GMT) in winter/summer, i.e. UTC+0100 in winter and UTC+0200 in summer (DST). Email: cert-nl@surfnet.nl Phone: +31 302 305 305 Fax: +31 302 305 329 Snailmail: SURFnet bv Attn. CERT-NL P.O. Box 19035 NL - 3501 DA UTRECHT The Netherlands A 7 * 24 hours phone number is available to SURFnet SSC's and FIRST members on request. ============================================================================== -----BEGIN PGP SIGNATURE----- Version: 2.6.2i iQCVAwUBMaRJMmL2fnkJN/jpAQFkowQAhF65sRTI050MzehkEIiaZ5pIugZz8p0U 1O2LxpBNBOuR4/YdQyU5XS01TEU9bpalZAjQlTskjCLgV4YQ4MvSXTIITeLwzp2u bexjpelBTFQsdBX3wWeufvFcynNL655f2FlgIXDVvb8dHpL1tKnan+0MOKN0U01N cssIq3w5Q7s= =WUXN -----END PGP SIGNATURE-----