I notify ...

I wonder it took so long to discover that DNS is vulnerable to a birthday attack :-)
A 16 bit ID in the DNS header never added any security and I doubt that source port randomization will.

Anyway... While I was hunting down some race conditions recently I remembered the
new inotify(2) system calls in recent Linux 2.6 kernels. Some of you might not be aware of
this, but this is an excellent way to win races. Beside that you can re-write tmp-watch to work
really reliable. While up-to-then tools (including my own) needed to rescan directories to find out changes
which was prone to error and racy in itself, you can now watch the lifetime of a file from creation,
during chmod until closing. The short screenshot shows the basics.
You can download the small helper program here.
It is very interesting to watch mail and print spoolers using this program! :-)
If you find any exploitable tmp-races using my program, feel free to credit and inotify me :-)

rsync xattr item_list heap overflow

Last week I discovered a classical integer wrap around which leads to a heap
overflow in rsync 3.0. A source patch can be found here.
We backported the xattr feature to some of our 2.6.9 and 2.6.8 versions.
Even though the code base is different there, the vulnerability also exists.
Updated packages will soon be available.

BOSS 2.0 LiveCD owned / Bundestrojaner entdeckt

The BOSS LiveCD (BSI OSS Security LiveCD) is a bootable Morphix Linux
distribution basically with a nessus scanner and some other security tools.
Its distributed for administrators to check their network for vulnerabilities.
The aim is to make the network more secure.

However there is a backdoor: If you boot this CD in your network it sets up
the network interface(s) via DHCP. It also starts an OpenSSH daemon and guess what,
it has a DSA private key for the user 'slad' placed in slad's homedir. The passphrase
for this key is 'bosscd'. And... the root password to su to root after ssh login
(root login via SSH is disabled) is also 'bosscd'.
One may argue that this is a LiveCD system and this does not matter. Wrong! The laptop
you boot has got a harddisk! And you are behind the firewall!

So, if you are responsible for your network, DO NOT BOOT THIS CD. You are subject to
immidiate owning. It is very easy to scan whole class A networks for this DSA key
within a short period of time, so do not think that "just running it half a hour" is short enough
for you to survive.

More info about the BOSS CD/Bundestrojaner here.

Update:
After contacting the "Bundesamt für Sicherheit in der Informationstechnik" (BSI) they responded
and included a security notice about the LiveCD in their website. Although I do not think
that, due to automatic WLAN setup during boot, a splitted testing environment is possible,
I recognize that they reacted within one day which is very fast for a government agency.

Mono trickery

I always spot the best bugs during coding. While coding tjmd5 (see last posting) I ran across
an interesting mono feature. For each 'foo' C# file that it compiles it lookups 'foo.so'
in /usr, /usr/lib etc directories and 'foo.so.la' in the cwd. This can be abused to execute
arbitrary code while someone is just compiling an C#-file. I am not sure about the impact since
you can say that the dude is executing the .exe after he was compiling it. Well.
Depending on the comments you all make I will decide whether this is something to tell Miguel :-)

Trapper John MD5

During hackweek in Nuremberg I lifted my C#-skills and wrote a MD5 based filesystem
and web integrity checker from scratch. In .NET, from scratch means you plug a few classes
and API calls together and get a complex application in 100 lines :-)
C# is fun coding nevertheless. Never heared again from tripwire, one of my faves
back in the 90's. You can download trapper john md5 here.

Fail!

While reading planet security
to get updated about what ubercool bugz the scene is producing I stumbled across the
fail blog. Definitely worth reading :-) Especially "wet squirrel" was funny after
serious and hard work on vlock which I had a look at. "Satellite" shows that hardware-engineers
are experiencing the same problems as computer scientists with software: it crashes all day long.
Heads up guys!

The evilness of setuid(getuid())

We recently had a discussion after a code review that a setuid(getuid()) inside a suid without error checking
and program execution afterwards should be fixed. A lot of people think that this could
never fail. getuid() indeed can never fail, but setuid() can. Lets put aside theoretical issues such
as missing CAP_SETUID or signals and lets have a look how the kernel is executing a setuid()
in the first picture. CAP_SETUID should be ok since we talk about a setuid root program which is
executing setuid(getuid()). Obviously we can trigger an error return of EAGAIN if set_user() fails
which is only called if the real UID is changed during the call. That may only happen if some of the set*uid() functions with a different UID than at startup time of the program has been called already.
For instance a setuid root program runs at startup with the real UID of the user and calls setuid(0)
in order to to obtain full privileges. It then calls setuid(getuid()) to drop the privileges again.
How can this fail? Lets have a look at set_user() in the second picture. Obviously if the
RLIMIT_NPROC limit is exceeded and its not setuid'ing to root (which is the case) then
an error is returned. Huh! Lowering limits is always allowed ;-)
The sample program in picture three demonstrates how a setuid root program dropping
its privileges in this way can be tricked into executing other programs as root.

I apologize if you already knew this trick. I also apologize for the madness of this' blog
editing program which always places the pictures as it wants to and which makes me nuts.

FireBox

In case you are tired of yet another unknown web browser vulnerability, you might
try firebox. This small script sets up a chroot environment for firefox which then runs
unprivileged, has no access to suid-files, /proc, /dev, /sys etc and can only create files
inside a loopback mount; so possible exploits triggered from evil websites can't modify
your homedir or system-files (as long as theres no kernel-0day of course :-).
Java, flash and all that sh** is not working yet but that might even be an advantage.

Happy new year!

Although a little bit late, I wish every reader a happy new year!

The 24c3 event was great. I missed some old and known faces, but had some interesting evening
with an italian a french and a dutch hacker at a steak house restaurant. Never made and heared so
many jokes on software. :-)

Even in the new year I am continously asked by the famous hakin9 magazine
to write an article for them. There must be a rumor/confusion somewhere about my person -- I am not a hacker! :-)

boot graphs

The exec-notify program can be used together with the exec2dot script to generate program
calling graphs from booting or something like a KDE startup. Especially the boot process from a laptop
looks very interesting.
Sample graphs may be found here and here.