Users login

Create an account »

JOIN XATRIX

Users login

Home » Security Advisories» FreeBSD » FreeBSD-SA-02:24-k5su

FreeBSD-SA-02:24-k5su

The k5su utility is a SU utility similar to su(1), and is used to switch privileges after authentication using Kerberos 5 or the local passwd(5) file. k5su is installed as part of the `krb5' distribution, or when building from source with MAKE_KERBEROS5 set. Neither of these are default settings.

  • Vendor: FreeBSD
  • Vendor ID: SA-02:24
  • Date: May 21, 2002


II. Problem Description

Historically, the BSD SU utility only allows users who are members
of group `wheel' (group-ID 0) to obtain superuser
privileges. The k5su utility, however, does not honor this convention
and does not verify group membership if a user has successfully
authenticated.

k5su also lacks other features of su(1), such as checking for
password expiration, implementing login classes, and checking
for the target user's login shell in /etc/shells.

III. Impact

Contrary to the expectations of many BSD system administrators, users
not in group `wheel' may use k5su to attempt to obtain superuser
privileges. Note that this would require knowledge of the root
account password, or an explicit entry in the Kerberos 5 `.k5login'
ACL for the root account.

IV. Solution

Remove the set-user-ID bit from the k5su utility:

# chmod u-s /usr/bin/k5su

This will completely disable k5su.

Sites which wish to use Kerberos 5 authentication for SU and are
comfortable with its limitations may choose to leave the set-user-ID
bit enabled. As of the correction date, FreeBSD (including the
upcoming 4.6-RELEASE) will install k5su if requested, but the
set-user-ID bit will not be enabled by default. See also the
ENABLE_SUID_K5SU option in make.conf(5).

VI. Correction details

The following list contains the revision numbers of each file that was
corrected in FreeBSD.

Path Revision
Branch
- -------------------------------------------------------------------------
src/UPDATING
RELENG_4 1.73.2.67
RELENG_4_5 1.73.2.50.2.12
RELENG_4_4 1.73.2.43.2.12
src/etc/defaults/make.conf
RELENG_4 1.97.2.65
RELENG_4_5 1.97.2.59.2.1
RELENG_4_4 1.97.2.58.2.1
src/kerberos5/usr.bin/k5su/Makefile
RELENG_4 1.73.2.67
RELENG_4_5 1.97.2.59.2.1
RELENG_4_4 1.1.2.2.2.1
src/share/man/man5/make.conf.5
RELENG_4 1.12.2.16
RELENG_4_5 1.12.2.12.2.1
RELENG_4_4 1.12.2.10.2.1
- -------------------------------------------------------------------------

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (FreeBSD)
Comment: FreeBSD: The Power To Serve

iQCVAwUBPOkdtFUuHi5z0oilAQFd1wP8CUxrBx+DJhQZqLpOocpF4yd8IWclz4Uu
8I8LT5RaWNKMrOt9FB6/jGthRFNqTL72XeDaezxT72IFSUHIpF9wI87aKNVDknPp
vQxh0Pr8/8EqvOLhvT6Hu/20xKrBZe2bht/lUQ/HxrgriaZteTAMfMYL653xgP5U
M+0f/mfSm3w=
=lTOo
-----END PGP SIGNATURE-----

Newsletter signup

Signup to our monthly newsletter and stay in touch with IT news!

Free E-books

We've got ebooks! But they're not online. :( Please give us a few days to bring downloads back.

Contact

Have something to say or just wanna drop us a line? Please keep this in mind: to spam, we reply with spam.

Contact us »