SuSE: 2005-062: permissions Security Update
Summary
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
______________________________________________________________________________
SUSE Security Announcement
Package: permissions
Announcement ID: SUSE-SA:2005:062
Date: Mon, 24 Oct 2005 08:00:00 +0000
Affected Products: SUSE LINUX 10.0
SUSE LINUX 9.3
SUSE LINUX 9.2
SUSE LINUX 9.1
SuSE Linux 9.0
SuSE Linux Desktop 1.0
SuSE Linux Enterprise Server 8
SUSE SLES 9
UnitedLinux 1.0
Vulnerability Type: information disclosure
Severity (1-10): 4
SUSE Default Package: yes
Cross-References: -
Content of This Advisory:
1) Security Vulnerability Resolved:
information disclosure via permissions package
Problem Description
2) Solution or Work-Around
3) Special Instructions and Notes
4) Package Location and Checksums
5) Pending Vulnerabilities, Solutions, and Work-Arounds:
- See SUSE Security Summary Report
6) Authenticity Verification and Additional Information
______________________________________________________________________________
1) Problem Description and Brief Discussion
SUSE LINUX ships with three pre defined sets of permissions, 'easy',
'secure' and 'paranoid'. The chkstat program contained in the
permissions package is used to set those permissions to the chosen
level. Level 'easy' which is the default allows some world writeable
directories. /usr/src/packages/RPMS and subdirectories is among
them. To prevent users from playing tricks in there e.g. linking to
/etc/shadow chkstat doesn't touch symlinks or files with an hardlink
count != 1.
Stefan Nordhausen discovered a way to trick this check. To gain
access to e.g. /etc/shadow a malicious user has to place a hardlink
to that file at a place that is modified by chkstat. chkstat will
not touch the file because it has a hardlink count of two. However,
if the administrator modifies the user database the original
/etc/shadow gets deleted and replaced by a new one. That means the
hardlink count of the file created by the malicious user drops to
one. At this point chkstat will modify the file's permissions so
anyone can read it. So it's technically impossible for chkstat to
modify permissions of files in world writeable directories in a
secure way.
One such world writeable directoy in level 'easy' is
/usr/src/packages/RPMS. Only subdirectories need to be adjusted in
this case. Since normal users cannot create hard links to
directories the problem can be solved by telling chkstat to not
accept regular files. Another problematic directory is /var/games.
Only members of group 'games' may write to it but it's likely that
games with setgid 'games' are exploitable to allow user to gain
group 'games' membership.
The updated permissions package now tells chkstat when to only
accept directories and no longer touches anything below /var/games
to solve the described problems. On SUSE Linux 9.0 xmcd contained
world writeable directories that suffered from the same problems.
Updated xmcd packages for SUSE Linux 9.0 are therefore provided as
well.
We like to thank Stefan Nordhausen for pointing out the problems.
2) Solution or Work-Around
In permissions level 'secure' no games are setgid 'games' and
/usr/src/packages is not world writeable. You are safe if you
switched to that level before any potentially malicious users could
log in.
3) Special Instructions and Notes
None
4) Package Location and Checksums
The preferred method for installing security updates is to use the YaST
Online Update (YOU) tool. YOU detects which updates are required and
automatically performs the necessary steps to verify and install them.
Alternatively, download the update packages for your distribution manually
and verify their integrity by the methods listed in Section 6 of this
announcement. Then install the packages using the command
rpm -Fhv
References
