-----BEGIN PGP SIGNED MESSAGE----- TW-CA-2004-046-[FreeBSD-SA-04:03.jail: Jailed processes can attach to other jails] - -------------------------------------------------------------------------------- TWCERT发布日期：2004-03-02 原漏洞发布日期：2004-02-25 原漏洞最新更新日期：-- 通用安全漏洞编号： 分类：Info Leak, 来源参考：FreeBSD-SA-04:03.jail - ------ 简述 ------------------------------------------------------------------- 系统管理者使用jail(2)系统呼叫将程序及其子程序封锁在封闭的环境里以限制对主要系统 的影响，即使是具有 superuser 权限的程序，是传统 UNIX chroot(2)系统呼叫的延伸。 jail_attach(2)系统呼叫是在 5.1-RELEASE 之前引入 FreeBSD 5 中，让未封锁(non-jailed) 的程序能永久地转移到现存的 jail 中。 - ------ 说明 ------------------------------------------------------------------- jail_attach(2) 系统呼叫程式设计上的错误在验证呼叫程序权限时会造成影响。 只有改变呼叫程序的根目录後 jail_attach(2) 系统呼叫会发生错误，假如呼叫程序已经 被 jail 则不受影响。 - ------ 影响平台 --------------------------------------------------------------- 受影响版本: FreeBSD 5.1-RELEASE FreeBSD 5.2-RELEASE 已修正版本: 2004-02-19 23:26:39 UTC (RELENG_5_2, 5.2.1-RC2) 2004-02-25 20:03:35 UTC (RELENG_5_1, 5.1-RELEASE-p14) CVE Name: CAN-2004-0126 FreeBSD only: YES - ------ 修正方式 --------------------------------------------------------------- 使用下列方式之一： 1)将受影响的系统更新至修正日期後的 RELENG_5.2.1-RELEASE 或 RELENG_5_2 或 　RELENG_5_2 security branch。 2)修正现有系统： 下列修正已验证过适用於 FreeBSD 5.1 和 5.2 系统。 a)从下列位址下载相关修正档，并使用 PGP 工具加以验证。 # fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:03/jail.patch # fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:03/jail.patch.asc b)使用修正档修正原始码。 # cd /usr/src # patch &lt; /path/to/patch c)依照 http://www.freebsd.org/handbook/kernelconfig.html 的说明重新编译 kernel 　并重新开机。 - ------ 影响结果 --------------------------------------------------------------- 在 jail 中具有 superuser 权限的程序能将本身的根目录改变成其他 jail 的根目录，以 存取目标 jail 中的档案和目录。 ─----- 连络 TWCERT/CC -------------------------------------------------------- Tel: 886-7-5250211 FAX: 886-7-5250212 886-2-23563303 886-2-23924082 Email: [email protected] URL: http://www.cert.org.tw/ PGP key: http://www.cert.org.tw/eng/pgp.htm - ------------------------------------------------------------------------------- 附件：[Jailed processes can attach to other jails] - ------ 原文 ------------------------------------------------------------------- ============================================================================= FreeBSD-SA-04:03.jail Security Advisory The FreeBSD Project Topic: Jailed processes can attach to other jails Category: core Module: kernel Announced: 2004-02-25 Credits: JAS Group (http://www.cs.mu.oz.au/jas/) Affects: FreeBSD 5.1-RELEASE FreeBSD 5.2-RELEASE Corrected: 2004-02-19 23:26:39 UTC (RELENG_5_2, 5.2.1-RC2) 2004-02-25 20:03:35 UTC (RELENG_5_1, 5.1-RELEASE-p14) CVE Name: CAN-2004-0126 FreeBSD only: YES For general information regarding FreeBSD Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit <URL:http://www.freebsd.org/security/>. I. Background The jail(2) system call allows a system administrator to lock up a process and all its descendants inside a closed environment with very limited ability to affect the system outside that environment, even for processes with superuser privileges. It is an extension of, but far more stringent than, the traditional Unix chroot(2) system call. The jail_attach(2) system call, which was introduced in FreeBSD 5 before 5.1-RELEASE, allows a non-jailed process to permanently move into an existing jail. II. Problem Description A programming error has been found in the jail_attach(2) system call which affects the way that system call verifies the privilege level of the calling process. Instead of failing immediately if the calling process was already jailed, the jail_attach(2) system call would fail only after changing the calling processs root directory. III. Impact A process with superuser privileges inside a jail could change its root directory to that of a different jail, and thus gain full read and write access to files and directories within the target jail. IV. Workaround No workaround is available. V. Solution Do one of the following: 1) Upgrade your vulnerable system to 5.2.1-RELEASE, or to the RELENG_5_2 or RELENG_5_1 security branch dated after the correction date. OR 2) Patch your present system: The following patch has been verified to apply to FreeBSD 5.1 and 5.2 systems. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. # fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:03/jail.patch # fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:03/jail.patch.asc b) Apply the patch. # cd /usr/src # patch < /path/to/patch c) Recompile your kernel as described in and reboot the system. VI. Correction details The following list contains the revision numbers of each file that was corrected in FreeBSD. Branch Revision Path - - ------------------------------------------------------------------------- RELENG_5_2 src/sys/kern/kern_jail.c 1.34.2.1 RELENG_5_1 src/UPDATING 1.251.2.16 src/sys/conf/newvers.sh 1.50.2.16 src/sys/kern/kern_jail.c 1.33.2.1 - - ------------------------------------------------------------------------- VII. References -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com> iQEVAwUBQERp+6cyQYefg2/NAQEWwwf9Hx3G/sKJB/X9uis7+1LBz5WZ+LB70Oho P2wpnwgri0uXUrw4I15kl6/dJ653ek5+EoZN7Lk+PIJ1FfGTVe56+Betqn2pChdE NFna3qga0iaLmXI99/GAxPJNZ2w8tZP1u364OaFJfF5u+NStcPBhOsoMAe4NjYDP aMRT2/FRO5Eaw8yJaEhv+QB9Cv0TwpJRSpS5aAIMyUYoNm0vEq/ZTyFoXuJ3i5fS /YxkN928YlJdBBgBxpSafkxeKwjBQpD/Jf4TZSyI8OpBxE3X/B3SwC0Jp0fK8TDT nMZDNppOlHLPY2BwjV2OQW281wK5dX3gY59Sq8RlNu2v8gbenA0+Hw== =tDat -----END PGP SIGNATURE----- -- Taiwan Computer Emergency Response Team Security Advisory mailing list. Mail to : [email protected] and include a line "subscribe advisory". Please visit http://www.cert.org.tw/. PGP key : http://www.cert.org.tw/eng/pgp.htm -- 注音文，实际上叫做分散式阻断中文攻击（Distributed Denial of Chinese） 　 定义： 攻击者利用某种发音符号参杂在文句之中，使其阅读困难， 称为阻断中文攻击（Denial of Chinese），简称 DoC。 而使整篇文章充满非中文的发音符号，则称为分散式阻断中文攻击， 简称 DDoC。 范例：http://www.oz.nthu.edu.tw/~u910238/gallery/-_-.jpg -- ※ Origin: 元智大学 风之塔 <bbs.yzu.edu.tw> ※ From : u148-154.u203-204.giga.net.tw