[20314] in bugtraq
Re: OpenBSD 2.8 ftpd/glob exploit (breaks chroot)
daemon@ATHENA.MIT.EDU (Peter van Dijk)
Thu Apr 19 14:20:30 2001
Mail-Followup-To: BUGTRAQ@SECURITYFOCUS.COM
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Message-ID: <20010418211139.A74228@dataloss.nl>
Date: Wed, 18 Apr 2001 21:11:39 +0200
Reply-To: Peter van Dijk <peter@DATALOSS.NL>
From: Peter van Dijk <peter@DATALOSS.NL>
To: BUGTRAQ@SECURITYFOCUS.COM
In-Reply-To: <200104181401.f3IE1tP03684@syn.hamachi.org>; from
sommerfeld@ORCHARD.ARLINGTON.MA.US on Wed, Apr 18,
2001 at 10:01:51AM -0400
On Wed, Apr 18, 2001 at 10:01:51AM -0400, Bill Sommerfeld wrote:
> seteuid(0); a = open("..", O_RDONLY); mkdir("adfa", 555);
> chroot("adfa"); fchdir(a); for(cnt = 100; cnt; cnt--)
> chdir("..");
> chroot(".."); execve("/bin//sh", ..);
>
> For the record, I blocked this way of breaking out of chroot in NetBSD
> in 1999; the fix is present in NetBSD 1.4 and later releases. I'm
> surprised that this hasn't been picked up by more distributions.
On FreeBSD, the kern.chroot_allow_open_directories sysctl should be
able to prevent this trick. If disabled (set to zero), it makes chroot
fail if any directories are open. If enabled (set to one, the
default), it makes chroot fail if any directories are open and a
chroot call is already in effect. (any other value disables all
checks).
Looks to me like FreeBSD isn't vulnerable to this trick either, then.
Greetz, Peter.
