-----BEGIN PGP SIGNED MESSAGE----- =============================================================================== Security Advisory CERT-NL =============================================================================== Author/Source : Teun Nijssen Index : S-97-07 Distribution : World Page : 1 Classification: External Version: 1 Subject : setlocale() buffer overflow Date : 06-feb-97 =============================================================================== By courtesy of the FreeBSD Security Officer we received the following information. - - ----------------------------------------------------------------------------- FreeBSD-SA-97:01 Security Advisory Revised: Wed Feb 05 09:58:56 PDT 1997 FreeBSD, Inc. Topic: setlocale() bug in all released versions of FreeBSD Category: core Module: libc Announced: 1997-02-05 Affects: FreeBSD 2.1.6 and earlier systems suffer from this vulnerability for all binaries due to setlocale() being called from crt0.o. Corrected: 1997-02-05 -stable, 1996-11-27 -current and RELENG_2_2 sources Source: FreeBSD specific bug FreeBSD only: unknown Patches: ftp://freebsd.org/pub/CERT/patches/SA-97:01/ - - ----------------------------------------------------------------------------- I. Background The setlocale() call contains a number of potential exploits through string overflows during environment variable expansion. Because the 2.1.6 and earlier versions of FreeBSD called setlocale() in the C runtime code, the problem is especially acute there in that it essentially effects all binaries on the system. In FreeBSD 2.2 BETA and later releases, the setlocale() call was removed from crt0.c and the exploit closed through additional checks. There has also been some confusion over the implications of loading locale data by privileged programs. The facility for a user to supply their own (possibly corrupt or abused) locale data to non-privileged processes was removed in all releases on 1997-02-04. This was originally a debugging facility that got little use and the user can now only direct system binaries to load system administrator sanctioned locale files. This problem is present in all source code and binary distributions of FreeBSD released on or before 1996-11-27. II. Problem Description The setlocale() library function looks for the environment variable "PATH_LOCALE" in the current process's environment, and if it exists, later copies the contents of this variable to a stack buffer without doing proper bounds checking. If the environment variable was specially initialized with the proper amount and type of data prior to running a setuid program, it is possible to cause the program to overflow its stack and execute arbitrary code which could allow the user to become root. III. Impact Any binary linked on a system with setlocale() built into crt0.c (see list of affected releases in section I above) or which calls setlocale() directly has the buffer overrun vulnerability. If this binary has the setuid or setgid bits set, or is called by another setuid/setgid binary (even if that other setuid/setgid binary does not have this vulnerability), unauthorized access may be allowed. IV. Solution(s) Recompiling libc with the following patches and then recompiling all staticly linked binaries (all in /sbin and /bin as well as chflags, gunzip, gzcat, gzip, ld, tar and zcat in /usr/bin) eliminates this vulnerability in FreeBSD 2.1.6 and earlier releases: However, a full solution may require a re-link of all setuid/setgid local binaries or all local binaries likely to be called from another setuid/setgid program that were originally linked statically under one of the affected OSs. Dynamically linked executables will benefit directly from this patch once libc is rebuilt and reinstalled and do not need to be relinked. Because of the severity of this security hole, a full update release for FreeBSD 2.1.6 will also be released very shortly, that release being provisionally assigned the version number of 2.1.7. Index: lib/libc/locale/collate.c =================================================================== RCS file: /home/ncvs/src/lib/libc/locale/collate.c,v retrieving revision 1.4.4.2 diff -c -r1.4.4.2 collate.c *** collate.c 1996/06/05 02:47:55 1.4.4.2 --- collate.c 1997/02/05 10:21:59 *************** *** 64,70 **** __collate_load_error = 1; if (!encoding) return -1; ! if (!path_locale && !(path_locale = getenv("PATH_LOCALE"))) path_locale = _PATH_LOCALE; strcpy(buf, path_locale); strcat(buf, "/"); --- 64,70 ---- __collate_load_error = 1; if (!encoding) return -1; ! if (!path_locale) path_locale = _PATH_LOCALE; strcpy(buf, path_locale); strcat(buf, "/"); Index: lib/libc/locale/rune.c =================================================================== RCS file: /home/ncvs/src/lib/libc/locale/rune.c,v retrieving revision 1.2.6.3 diff -c -r1.2.6.3 rune.c *** rune.c 1996/06/05 02:47:59 1.2.6.3 --- rune.c 1997/02/05 10:22:00 *************** *** 71,77 **** return(0); } ! if (!PathLocale && !(PathLocale = getenv("PATH_LOCALE"))) PathLocale = _PATH_LOCALE; (void) strcpy(name, PathLocale); --- 71,77 ---- return(0); } ! if (!PathLocale) PathLocale = _PATH_LOCALE; (void) strcpy(name, PathLocale); Index: lib/libc/locale/setlocale.c =================================================================== RCS file: /home/ncvs/src/lib/libc/locale/setlocale.c,v retrieving revision 1.3.4.2.2.1 diff -c -r1.3.4.2.2.1 setlocale.c *** setlocale.c 1996/06/05 02:48:03 1.3.4.2.2.1 --- setlocale.c 1997/02/05 10:22:00 *************** *** 58,64 **** int found, i, len; char *env, *r; ! if (!PathLocale && !(PathLocale = getenv("PATH_LOCALE"))) PathLocale = _PATH_LOCALE; if (category < 0 || category >= _LC_LAST) --- 58,64 ---- int found, i, len; char *env, *r; ! if (!PathLocale) PathLocale = _PATH_LOCALE; if (category < 0 || category >= _LC_LAST) Index: lib/libc/locale/startup_setlocale.c =================================================================== RCS file: /home/ncvs/src/lib/libc/locale/Attic/startup_setlocale.c,v retrieving revision 1.2.4.2 diff -c -r1.2.4.2 startup_setlocale.c *** startup_setlocale.c 1995/08/28 05:06:50 1.2.4.2 --- startup_setlocale.c 1997/02/05 10:22:00 *************** *** 23,29 **** int found, i, len; char *env, *r; ! if (!PathLocale && !(PathLocale = getenv("PATH_LOCALE"))) PathLocale = _PATH_LOCALE; if (category < 0 || category >= _LC_LAST) --- 23,29 ---- int found, i, len; char *env, *r; ! if (!PathLocale) PathLocale = _PATH_LOCALE; if (category < 0 || category >= _LC_LAST) ============================================================================= CERT-NL is the Computer Emergency Response Team for SURFnet customers. SURFnet is the Dutch network for educational, research and related institutes. CERT-NL is a member of the Forum of Incident Response and Security Teams (FIRST). All CERT-NL material is available under: http://www.surfnet.nl/surfnet/security/cert-nl.html ftp://ftp.surfnet.nl/surfnet/net-security In case of computer or network security problems please contact your local CERT/security-team or CERT-NL (if your institute is NOT a SURFnet customer please address the appropriate (local) CERT/security-team). CERT-NL is one/two hour(s) ahead of UTC (GMT) in winter/summer, i.e. UTC+0100 in winter and UTC+0200 in summer (DST). Email: cert-nl@surfnet.nl Phone: +31 302 305 305 Fax: +31 302 305 329 Snailmail: SURFnet bv Attn. CERT-NL P.O. Box 19035 NL - 3501 DA UTRECHT The Netherlands A 7 * 24 hours phone number is available to SURFnet SSC's and FIRST members on request. ============================================================================== -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: cp850 iQCVAwUBMvrxD0U5nQkWIq1FAQGOJwQAhoM3ldz+1I5J+I4aDdhGDYCs8aHN+b1E n1jGP++1eTGcXfgXMpvOzvwcnKUVrDIPc0kZZZaVyDKVKUH1Bw8pQ+eSjBDI9Jj+ KQBLIo8MeUp0w48cTz/jR/oJIwAdAblXi6f8hz/0xMLqCLh2qyxBm3mqiw8T9xul +5lvS+miEP8= =nbUh -----END PGP SIGNATURE-----