-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=============================================================================
FreeBSD-SA-11:07.chroot Security Advisory
The FreeBSD Project

Topic: Code execution via chrooted ftpd

Category: core
Module: libc
Announced: 2011-12-23
Affects: All supported versions of FreeBSD.
Corrected: 2011-12-23 15:00:37 UTC (RELENG_7, 7.4-STABLE)
2011-12-23 15:00:37 UTC (RELENG_7_4, 7.4-RELEASE-p5)
2011-12-23 15:00:37 UTC (RELENG_7_3, 7.3-RELEASE-p9)
2011-12-23 15:00:37 UTC (RELENG_8, 8.2-STABLE)
2011-12-23 15:00:37 UTC (RELENG_8_2, 8.2-RELEASE-p5)
2011-12-23 15:00:37 UTC (RELENG_8_1, 8.1-RELEASE-p7)
2011-12-23 15:00:37 UTC (RELENG_9, 9.0-STABLE)
2011-12-23 15:00:37 UTC (RELENG_9_0, 9.0-RELEASE)

For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:http://security.FreeBSD.org/&gt;.

I. Background

Chroot is an operation that changes the apparent root directory for the
current process and its children. The chroot(2) system call is widely
used in many applications as a measure of limiting a process's access to
the file system, as part of implementing privilege separation.

The nsdispatch(3) API implementation has a feature to reload its
configuration on demand. This feature may also load shared libraries
and run code provided by the library when requested by the configuration
file.

II. Problem Description

The nsdispatch(3) API has no mechanism to alert it to whether it is
operating within a chroot environment in which the standard paths for
configuration files and shared libraries may be untrustworthy.

The FreeBSD ftpd(8) daemon can be configured to use chroot(2), and
also uses the nsdispatch(3) API.

III. Impact

If ftpd is configured to place a user in a chroot environment, then an
attacker who can log in as that user may be able to run arbitrary code
with elevated ("root") privileges.

IV. Workaround

Don't use ftpd with the chroot option.

V. Solution

Perform one of the following:

1) Upgrade your vulnerable system to 7-STABLE or 8-STABLE, or to
the RELENG_8_2, RELENG_8_1, RELENG_7_4, or RELENG_7_3 security
branch dated after the correction date.

2) To update your vulnerable system via a source code patch:

The following patches have been verified to apply to FreeBSD 7.4, 7.3,
8.2 and 8.1 systems.

a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.

[FreeBSD 7.3 and 7.4]

fetch http://security.FreeBSD.org/patches/SA-11:07/chroot7.patch

fetch http://security.FreeBSD.org/patches/SA-11:07/chroot7.patch.asc

[FreeBSD 8.1 and 8.2]

fetch http://security.FreeBSD.org/patches/SA-11:07/chroot8.patch

fetch http://security.FreeBSD.org/patches/SA-11:07/chroot8.patch.asc

b) Execute the following commands as root:

cd /usr/src

patch < /path/to/patch

c) Recompile the operating system as described in
<URL: http://www.freebsd.org/handbook/makeworld.html&gt; and reboot the
system.

3) To update your vulnerable system via a binary patch:

Systems running 7.4-RELEASE, 7.3-RELEASE, 8.2-RELEASE, or 8.1-RELEASE on
the i386 or amd64 platforms can be updated via the freebsd-update(8)
utility:

freebsd-update fetch

freebsd-update install

4) This update adds a new API, __FreeBSD_libc_enter_restricted_mode()
to the C library, which completely disables loading of shared libraries
upon return. Applications doing chroot(2) jails need to be updated
to call this API explicitly right after the chroot(2) operation as a
safety measure.

VI. Correction details

The following list contains the revision numbers of each file that was
corrected in FreeBSD.

CVS:

Branch Revision
Path

---

RELENG_7
src/include/unistd.h 1.80.2.4
src/lib/libc/include/libc_private.h 1.17.2.4
src/lib/libc/Versions.def 1.3.2.3
src/lib/libc/net/nsdispatch.c 1.14.2.3
src/lib/libc/gen/Symbol.map 1.6.2.7
src/lib/libc/gen/Makefile.inc 1.128.2.6
src/lib/libc/gen/libc_dlopen.c 1.2.2.2
src/libexec/ftpd/popen.c 1.26.10.2
src/libexec/ftpd/ftpd.c 1.212.2.2
RELENG_7_4
src/UPDATING 1.507.2.36.2.7
src/sys/conf/newvers.sh 1.72.2.18.2.10
src/include/unistd.h 1.80.2.3.4.2
src/lib/libc/include/libc_private.h 1.17.2.3.4.2
src/lib/libc/Versions.def 1.3.2.2.4.2
src/lib/libc/net/nsdispatch.c 1.14.2.2.2.2
src/lib/libc/gen/Symbol.map 1.6.2.6.4.2
src/lib/libc/gen/Makefile.inc 1.128.2.5.4.2
src/lib/libc/gen/libc_dlopen.c 1.2.4.2
src/libexec/ftpd/popen.c 1.26.10.1.2.2
src/libexec/ftpd/ftpd.c 1.212.2.1.6.2
RELENG_7_3
src/UPDATING 1.507.2.34.2.11
src/sys/conf/newvers.sh 1.72.2.16.2.13
src/include/unistd.h 1.80.2.3.2.2
src/lib/libc/include/libc_private.h 1.17.2.3.2.2
src/lib/libc/Versions.def 1.3.2.2.2.2
src/lib/libc/net/nsdispatch.c 1.14.2.1.6.2
src/lib/libc/gen/Symbol.map 1.6.2.6.2.2
src/lib/libc/gen/Makefile.inc 1.128.2.5.2.2
src/lib/libc/gen/libc_dlopen.c 1.1.2.1
src/libexec/ftpd/popen.c 1.26.24.2
src/libexec/ftpd/ftpd.c 1.212.2.1.4.2
RELENG_8
src/include/unistd.h 1.95.2.2
src/lib/libc/include/libc_private.h 1.20.2.3
src/lib/libc/Versions.def 1.8.2.3
src/lib/libc/net/nsdispatch.c 1.18.2.3
src/lib/libc/gen/Symbol.map 1.21.2.6
src/lib/libc/gen/Makefile.inc 1.144.2.7
src/lib/libc/gen/libc_dlopen.c 1.1.4.2
src/libexec/ftpd/popen.c 1.26.22.3
src/libexec/ftpd/ftpd.c 1.214.2.3
RELENG_8_2
src/UPDATING 1.632.2.19.2.7
src/sys/conf/newvers.sh 1.83.2.12.2.10
src/include/unistd.h 1.95.2.1.6.2
src/lib/libc/include/libc_private.h 1.20.2.2.4.2
src/lib/libc/Versions.def 1.8.2.2.4.2
src/lib/libc/net/nsdispatch.c 1.18.2.2.2.2
src/lib/libc/gen/Symbol.map 1.21.2.5.2.2
src/lib/libc/gen/Makefile.inc 1.144.2.6.2.2
src/lib/libc/gen/libc_dlopen.c 1.2.8.2
src/libexec/ftpd/popen.c 1.26.22.2.4.2
src/libexec/ftpd/ftpd.c 1.214.2.1.6.2
RELENG_8_1
src/UPDATING 1.632.2.14.2.10
src/sys/conf/newvers.sh 1.83.2.10.2.11
src/include/unistd.h 1.95.2.1.4.2
src/lib/libc/include/libc_private.h 1.20.2.2.2.2
src/lib/libc/Versions.def 1.8.2.2.2.2
src/lib/libc/net/nsdispatch.c 1.18.2.1.4.2
src/lib/libc/gen/Symbol.map 1.21.2.3.2.2
src/lib/libc/gen/Makefile.inc 1.144.2.4.2.2
src/lib/libc/gen/libc_dlopen.c 1.2.10.2
src/libexec/ftpd/popen.c 1.26.22.2.2.2
src/libexec/ftpd/ftpd.c 1.214.2.1.4.2
RELENG_9
src/include/unistd.h 1.101.2.2
src/lib/libc/include/libc_private.h 1.26.2.2
src/lib/libc/Versions.def 1.9.2.2
src/lib/libc/net/nsdispatch.c 1.19.2.2
src/lib/libc/gen/Symbol.map 1.38.2.2
src/lib/libc/gen/Makefile.inc 1.159.2.2
src/lib/libc/gen/libc_dlopen.c 1.1.6.2
src/lib/libc/iconv/citrus_module.c 1.1.2.2
src/libexec/ftpd/popen.c 1.27.2.2
src/libexec/ftpd/ftpd.c 1.220.2.2
RELENG_9_0
src/include/unistd.h 1.101.2.1.2.2
src/lib/libc/include/libc_private.h 1.26.2.1.2.2
src/lib/libc/Versions.def 1.9.2.1.2.2
src/lib/libc/net/nsdispatch.c 1.19.2.1.2.2
src/lib/libc/gen/Symbol.map 1.38.2.1.2.2
src/lib/libc/gen/Makefile.inc 1.159.2.1.2.2
src/lib/libc/gen/libc_dlopen.c 1.2.6.2
src/lib/libc/iconv/citrus_module.c 1.1.2.1.2.2
src/libexec/ftpd/popen.c 1.27.2.1.2.2
src/libexec/ftpd/ftpd.c 1.220.2.1.2.2

---

Subversion:

Branch/path Revision

---

stable/7/ r228843
releng/7.4/ r228843
releng/7.3/ r228843
stable/8/ r228843
releng/8.2/ r228843
releng/8.1/ r228843
stable/9/ r228843
releng/9.0/ r228843

---

VII. References

The latest revision of this advisory is available at
http://security.FreeBSD.org/advisories/FreeBSD-SA-11:07.chroot.asc
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.18 (FreeBSD)

iEYEARECAAYFAk70nOoACgkQFdaIBMps37ILmgCgjVxRH+NsPpnXOVdwWmuxlSDp
h9wAniE0tokORcqQlFJim5Pc1Z65ybwl
=45yE
-----END PGP SIGNATURE-----