Users login

Create an account »

JOIN XATRIX

Users login

Home » Security Advisories» FreeBSD » Sliplogin unauthorized access vulnerability

Sliplogin unauthorized access vulnerability

A bug was found in the sliplogin program. The program did not properly restrict the environment used when invoking child processes. This problem is present in all source code and binary distributions of FreeBSD version 2.0.5 and 2.1 released before 1996-04-21.

  • Vendor: FreeBSD
  • Vendor ID: FreeBSD-SA-96:01
  • Date: April 21, 1996


-----BEGIN PGP SIGNED MESSAGE-----

=======================================================================
FreeBSD-SA-96:01 Security Advisory
Revised: Wed May 22 00:18:51 PDT 1996 FreeBSD, Inc.

Topic: sliplogin unauthorized access vulnerability

Category: core
Module: sliplogin
Announced: 1996-04-21
Affects: FreeBSD 2.0.5 and 2.1.0 systems where sliplogin may
be invoked as a user shell (in /etc/passwd entries).
Corrected: 1996-04-21 -stable and -current sources
Source: Generic BSD bug
FreeBSD only: no

Reference: AUSCERT Advisory correspondence

Patches: ftp://freebsd.org/pub/CERT/patches/SA-96:01/

=======================================================================

I. Background

A bug was found in the sliplogin program. The program did
not properly restrict the environment used when invoking
child processes. This problem is present in all source code
and binary distributions of FreeBSD version 2.0.5 and 2.1
released before 1996-04-21.


II. Problem Description

The sliplogin program is used to allow a remote user to dial
into a FreeBSD system and start a SLIP connection. The sliplogin
program is typically used as replacement user "shell" in this
application. The sliplogin program invokes a child process that
may be compromised through the passing of certain environment
variables.


III. Impact

The problem could allow local users to gain unauthorized access
to a system or provide unauthorized access to remote users.
This problem is only exploitable on systems where the sliplogin
program has been configured to be invoked at login time (e.g. as
a user shell in /etc/passwd entries).

IV. Solution(s)

The following patch to sliplogin.c eliminates this vulnerability.

*** sliplogin.c 1996/01/06 07:19:55 1.3.4.1
--- sliplogin.c 1996/04/24 20:20:00 1.3.4.2
***************
*** 88,93 ****
--- 88,100 ----
#include
#include "pathnames.h"

+ extern char **environ;
+
+ static char *restricted_environ[] = {
+ "PATH=" _PATH_STDPATH,
+ NULL
+ };
+
int unit;
int slip_mode;
speed_t speed;
***************
*** 123,128 ****
--- 130,137 ----
char user[16];
char buf[128];
int i, j, n;
+
+ environ = restricted_environ; /* minimal protection for system() */

(void)strcpy(loginname, name);
if ((fp = fopen(_PATH_ACCESS, "r")) == NULL) {


V. Workaround

This vulnerability can quickly and easily be limited by disabling
any account that has sliplogin as the user shell in /etc/passwd or
by disabling access to the sliplogin command.

As root, execute the command:

# chmod 000 /usr/sbin/mount_union

then verify that all access permission to the file has been
disabled. The permissions array should read "----------" as
shown here:

# ls -l /usr/sbin/sliplogin
---------- 1 root bin 16384 Apr 26 04:47 /usr/sbin/sliplogin


=======================================================================
FreeBSD, Inc.

Web Site: http://www.freebsd.org/
Confidential contacts: [email protected]
PGP Key: ftp://freebsd.org/pub/CERT/public_key.asc
Security notifications: [email protected]
Security public discussion: [email protected]

Notice: Any patches in this document may not apply cleanly due to
modifications caused by digital signature or mailer software.
Please reference the URL listed at the top of this document
for original copies of all patches if necessary.
=======================================================================

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMaLAiVUuHi5z0oilAQFjMQQAlBJ/nnV0+FpmAdxkn1e3wr97oXPoGLfz
hKbTHbQACcsYAJBZXItC8gGxwbDze0H06PidR81anVOch8pkthRbam6rYNWUsAwZ
2PyWy7Q8pmeBz0vVhUYKQgLFWFzSdibvPJQjNA53uUvKymJHvEUeDj8MigQdxcvh
2MkW1XGtVyQ=
=8oT/
-----END PGP SIGNATURE-----

Newsletter signup

Signup to our monthly newsletter and stay in touch with IT news!

Free E-books

We've got ebooks! But they're not online. :( Please give us a few days to bring downloads back.

Contact

Have something to say or just wanna drop us a line? Please keep this in mind: to spam, we reply with spam.

Contact us »