The evilness of setuid(getuid())

We recently had a discussion after a code review that a setuid(getuid()) inside a suid without error checking
and program execution afterwards should be fixed. A lot of people think that this could
never fail. getuid() indeed can never fail, but setuid() can. Lets put aside theoretical issues such
as missing CAP_SETUID or signals and lets have a look how the kernel is executing a setuid()
in the first picture. CAP_SETUID should be ok since we talk about a setuid root program which is
executing setuid(getuid()). Obviously we can trigger an error return of EAGAIN if set_user() fails
which is only called if the real UID is changed during the call. That may only happen if some of the set*uid() functions with a different UID than at startup time of the program has been called already.
For instance a setuid root program runs at startup with the real UID of the user and calls setuid(0)
in order to to obtain full privileges. It then calls setuid(getuid()) to drop the privileges again.
How can this fail? Lets have a look at set_user() in the second picture. Obviously if the
RLIMIT_NPROC limit is exceeded and its not setuid'ing to root (which is the case) then
an error is returned. Huh! Lowering limits is always allowed ;-)
The sample program in picture three demonstrates how a setuid root program dropping
its privileges in this way can be tricked into executing other programs as root.

I apologize if you already knew this trick. I also apologize for the madness of this' blog
editing program which always places the pictures as it wants to and which makes me nuts.

FireBox

In case you are tired of yet another unknown web browser vulnerability, you might
try firebox. This small script sets up a chroot environment for firefox which then runs
unprivileged, has no access to suid-files, /proc, /dev, /sys etc and can only create files
inside a loopback mount; so possible exploits triggered from evil websites can't modify
your homedir or system-files (as long as theres no kernel-0day of course :-).
Java, flash and all that sh** is not working yet but that might even be an advantage.

Happy new year!

Although a little bit late, I wish every reader a happy new year!

The 24c3 event was great. I missed some old and known faces, but had some interesting evening
with an italian a french and a dutch hacker at a steak house restaurant. Never made and heared so
many jokes on software. :-)

Even in the new year I am continously asked by the famous hakin9 magazine
to write an article for them. There must be a rumor/confusion somewhere about my person -- I am not a hacker! :-)

boot graphs

The exec-notify program can be used together with the exec2dot script to generate program
calling graphs from booting or something like a KDE startup. Especially the boot process from a laptop
looks very interesting.
Sample graphs may be found here and here.

satire II

Sorry, the following is only in german due to my limited native language skills :-)

Ich sass neulich in der S-Bahn auf dem Weg zum recurity-labs summit, um
ein paar Freunde wiederzutreffen. In der S-Bahn um mich herum lauter wirklich tolle Leute mit viel
Ahnung ueber Web 2.0, flat-rate-preise und natuerlich - BLOGS!
Dazu die Jungs mit den haengenden Hosen und dieser komischen Musik
(ey, alter - das ging so: uz, uz, uzz. Nee, warte... uzzzzz,uz,uz!) Man lese mehr dazu hier.

Da kam mir die Idee, unsere heutige Welt in einem kleinen Gedicht zusammenzufassen.
Den verantwortlichen Rapper fuer den Originalsong werden die Meisten sicher leidlich kennen,
auch wenn er einem im Radio mittlerweile seltener aufgenoetigt wird.
Wer wirklich gute Musik mag, vertieft sich natuerlich in die Gitarre von Mark Tremonti.
:->

genug geschwafelt:

Mein blog!
---------------

ich habe nichts zu sagen
und das kann ich nicht ertragen,
darum schreib ich das in - mein' blog!

ich gehe noch zur schule,
ich find das alles voll schwul hier,
das schreibe ich in - mein' blog!

besser gesagt geh' ich in die achte,
genau wie die bei der ich immer uebernachte,
wies war schreib ich in - mein' blog!

der typ aus der fuenften,
tut mich immer beschimpfen,
das schreibe ich in - mein' blog!

wenn ich gross bin werd ich politiker,
oder vielleicht auch filmkritiker,
wofuer ich mich entscheide, kommt in - mein' blog!

ich habe weder hefter noch anstand,
und beim tanzen mach ich handstand
ich habe nur - nen block!

Eyes on Exec reloaded

10 years ago or so, I wrote a tool called "Eyes on Exec" (EoE) which was a kernel module for the 2.0, 2.2 and 2.4 Kernel.
It created a device /dev/exec from which one could read all the commands executed recently
including callers PID, EUID etc. Some simple hostbased IDS used this input to ensure that e.g.
pop3d never executed anything. It worked very well. Additionally, code reviewers (myself :)
found it usefull since you easily see if some daemons/applications execute shell programs
in a way that is not obvious to the auditor due to weird library calls. The famous modprobe bug
which used ping as a trigger was found by me with the help of EoE (google for rootprobe exploit).

2.2 times are gone, but the new 2.6 Kernel has a nice API called proc connector which allows
to register for certain events such as fork/exec etc. into the proc FS. One is then notified
whenever the questioned event arrives. Ever wanted to know what man really executes or how
acroread is handling mail sent from within a PDF? :-) Jump towards here.

Puzzle solved

Of course you all found the bug I was talking about after I uploaded the correct
screenshot! ;-) Bash me. You even found minor other issues which should however
not be exploitable.
Nevertheless, wpa_supplicant has got an excellent code structure which is fun to review.
If you ever want to learn how to write your own TLSv1 implementation, have a look at their code.

Spot the fed^H^H^Hbug

There is an interesting bug within wpa_supplicant's ASN.1 parsing. Usually, it uses the OpenSSL
libraray to obtain and parse the X509 certificates. However, it can be compiled to use built-in
X509 e.g. ASN.1 parsing routines to do so. Nearly all X509 functions use
asn1_get_next(). There is a buffer overflow condition within this function. Found it?
Make a comment!

P.S. Our packages do not use the vulnerable parsing code.

P.P.S. Puzzle-solving coming soon :-)

pcapSharp

Check out my libpcap C# binding.
It is a first draft version without Makefile, README etc. but contains all
pcap functions, structures, callbacks etc you need to use libpcap via your mono
environment. If you remove the Main() function you can build your own DLL
and can capture and send packets easier than you ever did in C or C++ ;-)

CVE-2007-4091

It still pays to have a look at open source projects.
rsync 2.6.9 contains two off by one stack overflows, one from which the target buffer is next to the
saved frame pointer.
The problematic function is f_name().
Obviously it expects a target buffer size
of MAXPATHLEN bytes. Otherwise
the size parameter calculation to
strlcpy() is wrong.
Lets have a look at f_name() calls within the two following pictures.
An offset is added to the fname buffer
which is of size MAXPATHLEN.
The offset is the stringlen of dir.root
plus one (due to the slash).
Within successfull_send(), the buffer
should be neighbor of the saved
frame pointer since MAXPATHLEN
does not need to be aligned.
Thus the assumption within the f_name() function about its target buffer size
is wrong.
However there is a check in make_file()
that looks whether any received
dir and pathnames would overrun
MAXPATHLEN bytes. flist_dir_len is exactly what becomes strlen of dir.root later. However, the trailing slash is missing! :-) Happy PoCing!!!
Updated rsync-packages for SUSE are already available via the online updater.
A fix is also available.