This article was contributed by John Richard Moser
Linux does not host the same applications as the more popular operating
systems; it does not cater to the same host of bugs those applications
provide to allow attackers to easily gain privileged access to the system.
Still, if the same classes of bugs exist in Linux applications, the same
problems arise. Linux is vulnerable to the same exploits as any other
operating system when bugs exist to facilitate those exploits.
Most popular Linux distributions do not make use of available security
technologies that would deflect a large number of these attacks. There are
technologies available today that allow the maintainers of distributions
such as Gentoo, Debian, or Mandrake to make the system more resilient if
not virtually invulnerable to these exploitable bugs. These technologies
are open source, GPL licensed solutions to the future problems that Linux
will face as it gains popularity.
There are many transparent security technologies available that maintainers
could use to improve the security of a Linux distribution, such as Stack Smash
Protection, PaX, and Position
Independent Executables (PIE). These, such as can be safely and easily
integrated with any distribution to improve security without altering the
users' experience or administration of the system.
Stack Smash Protection
Stack Smash Protection is a method of detection and mitigation of stack
based buffer overflow bugs in programs. There are several implementations;
the one focused on here is IBM's Stack
Smash Protector (SSP), formerly known as ProPolice. SSP prevents stack
based buffer overflow bugs from being used to exploit programs in many
cases.
A fair number of security exploits begin with stack based buffer overflows.
SSP rearranges local variables to put character arrays at the highest
address and copies pointers passed to the function to new local variables
below these arrays. This prevents a wide range of overflow based attacks.
It uses a strategically placed local variable known as a "canary" or "guard
value" to check for overflows.
SSP is implemented as a compiler patch to gcc. This patch alters the way
functions are generated so that they check for buffer overflows. It can be
used via the -fstack-protector and -fstack-protector-all
switches, or by passing --enable-stack-protector to the
configure script when building gcc. In either case,
-fno-stack-protetctor[-all] explicitly disables the
protection.
There are still
some
cases which SSP cannot catch, such as bugs affecting structures with
vulnerable layouts; but it is definitely a powerful tool for preventing
exploitation of many programming bugs. It may also expose some simple
programming bugs, such as those which overflow a buffer by a few bytes.
These bugs cause programs to crash during normal operation with SSP.
SSP was developed by Hiroaki Etoh and Kunikazu Yoda of the IBM Research
Division, based on StackGuard. It was
originally outlined in a paper
by its authors. StackGuard was developed by Immunix Inc., and first appeared in 1998
or earlier. There have also been other papers
examining stack smash protection techniques and implementation.
PaX
PaX is a patch to the Linux kernel source tree to implement memory
protections which make certain classes of exploits difficult or impossible.
Depending on architecture, PaX may have a very low or insignificant
overhead. It is a powerful tool for preventing a great many potential
exploits.
The Exec Shield (ES) technology contributed by Red Hat is somewhat similar
to PaX; however, PaX
supplies greater control over protections on individual binaries, as well
as greater accuracy in its NX emulation on x86 architectures. ES has been
compared to PaX on Wikipedia.
Unless otherwise specified, full PaX with all features enabled except
"Disallow ELF text relocations" will be discussed here.
PaX is a very feature rich technology. Instead of targeting a specific
attack vector, PaX targets entire classes of exploits. Attacks using
standard code injection are essentially impossible to successfully perform
on a task running under full PaX restrictions; many of the more complex
attacks are extremely difficult and often impossible to guarantee. Failed
attacks result in the immediate termination of the program.
PaX guarantees that no memory is both writable and executable. The system
administrator may deny all programs permission to use mprotect() to
transition to a state where the page may be executed at any time after it
could have been written to. It may emulate an NX bit to accomplish this;
this is done on x86 with measurable but low overhead.
PaX also allows full Address Space Layout Randomization (ASLR). ASLR
allows the stack, heap, mmap(), and even the .text of ET_EXEC executables
to be mapped into randomly chosen bases in Virtual Memory (VM) space. In
the absence of an information leak, an attacker would need to essentially
guess at where any needed target data is in memory.
Some programs malfunction under PaX. Usually these programs expect
behavior contrary to what PaX provides, and upon attempting to execute
certain logic, PaX terminates them as if it had detected an exploit. PaX
allows binaries to be "marked" with tools available to the system
administrator to disable any individual protection supplied by PaX.
PaX was created by an anonymous author, originally supplying NX support
based on an observation about the x86 architecture made by the plex86
project. Other features such as ASLR were implemented later. PaX first
appeared in 2000, and was later incorporated into the grsecurity project.
The PaX project supplies much documentation, and Wikipedia
features an article about
PaX.
Position Independent Executables
Position Independent Executables, or PIE, are executables compiled as
Position Independent Code (PIC). PIC is usually slower than fixed position
code; however, it can be easily relocated in memory. PIE allows the safe
and efficient randomization of the base of executable binaries in VM by PaX
or ES, preventing an attacker from knowing beforehand where preexisting
code is in memory.
Compiling PIE binaries is done by passing gcc the -fPIC or
-fPIE switches;
linking them is done by passing -pie to gcc or to the linker. The
-fPIE
switch only works with gcc 3.4, but -fPIC will work for all.
Regardless of
which switch is used, the output is an executable ET_DYN binary.
Using PIE, the code in executable binaries suffers
measurable overhead,
the magnitude of which varies between CPU architectures. On x86, this is
approximately 1%; whereas on x86_64, the overhead is approximately 0.01%.
Because this overhead is not applied everywhere, it can usually be said to
be negligible on any architecture in relation to PIE.
Deployment
Many security focused open source operating systems deploy these or similar
technologies. OpenBSD supplies its own
PaX-type system, W^X; OpenBSD also uses SSP; but apparently does not supply a PIE base.
Hardened Gentoo and Adamantix supply PaX, SSP, and PIE;
along with other, more visible technologies such as SELinux or RSBAC. It
is left up to speculation why the most popular Linux distributions do not
supply the transparent features, although there is effort to persuade Debian to use these, by the Debian: Secure by Default and
the Hardened Debian
projects.
cyrus-sasl has a vulnerability involving a buffer overflow
in the digestmda5.c file. A remote attacker may be able
to compromise the system. Also, a local user may be able to
exploit a vulnerability by using the SASL_PATH environment
variable.
ed insecurely creates temporary files in world-writeable directories with
predictable names. Given that ed is used in various system shell scripts,
they are by extension affected by the same vulnerability. A local attacker
could create symbolic links in the temporary files directory, pointing to a
valid file somewhere on the filesystem. When ed is called, this would
result in file access with the rights of the user running the utility,
which could be the root user.
gettext insecurely creates temporary files in world-writeable directories
with predictable names. A local attacker could create symbolic links in
the temporary files directory, pointing to a valid file somewhere on the
filesystem. When gettext is called, this would result in file access with
the rights of the user running the utility, which could be the root user.
Several problems have been discovered in MySQL. Oleksandr Byelkin noticed
that ALTER TABLE ... RENAME checks CREATE/INSERT rights of the old table
instead of the new one. (CAN-2004-0835) Lukasz Wojtow noticed a buffer
overrun in the mysql_real_connect function. (CAN-2004-0836) Dean Ellis
noticed that multiple threads ALTERing the same (or different) MERGE tables
to change the UNION can cause the server to crash or stall. (CAN-2004-0837)
compress and uncompress do not properly check bounds on command line
options, including the filename. Large parameters would trigger a buffer
overflow. By supplying a carefully crafted filename or other option, an
attacker could execute arbitrary code on the system. A local attacker could
only execute code with his own rights, but since compress and uncompress
are called by various daemon programs, this might also allow a remote
attacker to execute code with the rights of the daemon making use of
ncompress.
The tiff library contains several buffer overflows which may be exploited
by way of maliciously-crafted image files. See this advisory for more information.
A stack-based buffer overflow exists in the ssl_util_uuencode_binary
function in ssl_util.c in Apache. When mod_ssl is configured to trust the
issuing CA, a remote attacker may be able to execute arbitrary code via a
client certificate with a long subject DN.
Aspell's word-list-compress utility fails to properly check bounds
when dealing with words that are more than 256 bytes long.
This can lead to arbitrary code execution by an attacker.
Versions of cups prior to 1.1.21 contain a denial of service vulnerability in their IPP implementation. A malicious UDP packet can cause cups to stop listening to the IPP port.
"fam" (file alteration monitor) watches files and directories for changes and lets interested applications know when something happens. This package has a flaw in its group handling that blocks some legitimate operations while, at the same time, exposing the names of files that should otherwise be invisible.
There is a vulnerability in the foomatic-filters package. This
vulnerability is due to insufficient checking of command-line parameters
and environment variables in the foomatic-rip filter. This vulnerability
may allow both local and remote attackers to execute arbitrary commands on
the print server with the permissions of the spooler.
The gdk-pixbuf and gtk2 libraries contain vulnerabilities in their handling of BMP and XPM files which can lead to denial of service and, potentially, code execution attacks.
Silvio Cesare discovered a potential information leak in glibc. It allows
LD_DEBUG on SUID binaries where it should not be allowed. This has various
security implications, which may be used to gain confidential information.
An attacker can gain the list of symbols a SUID application uses and their
locations and can then use a trojaned library taking precedence over those
symbols to gain information or perform further exploitation.
Several scripts packaged with gnome-vfs, using its "extfs" capability, have security flaws. These scripts tend not to be used on many systems, but their presence can still be a threat.
GtkHTML is the HTML rendering widget used by the Evolution mail reader.
GtkHTML supplied with versions of Evolution prior to 1.2.4 contain a bug
when handling HTML messages. Alan Cox discovered that certain malformed
messages could cause the Evolution mail component to crash.
Apache2 contains an integer error in the apr_uri_parse() function when handling IPv6 addresses. The result is a code execution vulnerability on BSD systems, and a denial of service vulnerability under Linux.
The ImageMagick graphics library has several buffer overflow
vulnerabilities that allow an attacker to crash the reading process
by creating mal-formed video or image files in the AVI, BMP, or DIB format.
Paul Starzetz discovered
flaws in the Linux kernel when handling file
offset pointers. These consist of invalid conversions of 64 to 32-bit file
offset pointers and possible race conditions. A local unprivileged user
could make use of these flaws to access large portions of kernel memory.
Note that this vulnerability affects all 2.4 kernels through 2.4.26 and 2.6 kernels through 2.6.7.
The kernel-utils package contains several utilities that can be used to
control the kernel or machine hardware. In Red Hat Linux 8.0 this package
contains user mode linux (UML) utilities.
The uml_net utility in kernel-utils packages with Red Hat Linux 8.0 was
incorrectly shipped setuid root. This could allow local users to control
certain network interfaces, add and remove arp entries and routes, and put
interfaces in and out of promiscuous mode.
All users of the kernel-utils package should update to these packages that
contain a version of uml_net that is not setuid root.
Alternatively, as a work-around to this vulnerability issue the following
command as root:
The lha archiving and compression utility has a
stack-based buffer overflow vulnerability. A modified
archive could allow an attacker to execute code when a victim
extracts or test the archive.
Yuuichi Teranishi discovered a flaw in libxml2 versions prior to 2.6.6.
When fetching a remote resource via FTP or HTTP, libxml2 uses special
parsing routines. These routines can overflow a buffer if passed a very
long URL. If an attacker is able to find an application using libxml2 that
parses remote resources and allows them to influence the URL, then this
flaw could be used to execute arbitrary code.
Several vulnerabilities exist in the Mozilla web browser and derived
products, the most serious of which could allow a remote attacker to
execute arbitrary code on an affected system. See the CERT advisory for details.
A vulnerability was discovered in mpg321, a command-line mp3 player,
whereby user-supplied strings were passed to printf(3) unsafely. This
vulnerability could be exploited by a remote attacker to overwrite
memory, and possibly execute arbitrary code. In order for this
vulnerability to be exploited, mpg321 would need to play a malicious
mp3 file (including via HTTP streaming).
Michal Zalewski discovered a bug in the netkit-telnet server (telnetd)
whereby a remote attacker could cause the telnetd process to free an
invalid pointer. This causes the telnet server process to crash, leading
to a straightforward denial of service (inetd will disable the service if
telnetd is crashed repeatedly), or possibly the execution of arbitrary code
with the privileges of the telnetd process (by default, the 'telnetd'
user).
netpbm is graphics conversion toolkit made up of a large number of
single-purpose programs. Many of these programs were found to create
temporary files in an insecure manner, which could allow a local
attacker to overwrite files with the privileges of the user invoking a
vulnerable netpbm tool.
From the advisory:
"During a pen-test we stumbled across a nasty bug in OpenSSH-portable
with PAM support enabled (via the --with-pam configure script switch). This
bug allows a remote attacker to identify valid users on vulnerable systems,
through a simple timing attack. The vulnerability is easy to exploit and
may have high severity, if combined with poor password policies and other
security problems that allow local privilege escalation."
Stefan Esser has issued an advisory regarding a
remotely exploitable hole in PHP (through version 4.3.7). If the
memory_limit feature is in use (as it should be, to prevent denial
of service attacks), allocation failures can be forced at highly
inopportune times, and those failures can be exploited to execute arbitrary
code. The exploit is described as "quite easy," and it can be done
regardless of whether Apache1 or Apache2 is in use. Upgrading to PHP 4.3.8 fixes the
problem; yesterday's PHP 5.0 release also contains the fix (but the
final release candidate did not).
php: information disclosure and file upload vulnerabilities
Package(s):
php
CVE #(s):
Created:
October 6, 2004
Updated:
October 6, 2004
Description:
Versions of PHP prior to 4.3.9 suffer from vulnerabilities which can disclose the contents of random memory to an attacker and allow uploads of files to any location writable by the web server.
Max Vozeler discovered a vulnerability in pppoe, the PPP over Ethernet
driver from Roaring Penguin. When the program is running setuid root
(which is not the case in a default Debian installation), an attacker
could overwrite any file on the file system.
This August 2004 rsync
advisory reports that there is a path-sanitizing bug that affects
daemon mode in all recent rsync versions (including 2.6.2) but only if
chroot is disabled. It does NOT affect the normal send/receive filenames
that specify what files should be transferred (this is because these names
happen to get sanitized twice, and thus the second call removes any
lingering leading slash(es) that the first call left behind). It does
affect certain option paths that cause auxilliary files to be read or
written.
Andres Salomon noticed a problem in the CGI session management of Ruby, an
object-oriented scripting language. CGI::Session's FileStore (and
presumably PStore, but not in Debian woody) implementations store session
information insecurely. They simply create files, ignoring permission
issues. This can lead an attacker who has also shell access to the
webserver to take over a session.
A security vulnerability has been located in Samba 2.2.x <= 2.2.11 and
Samba 3.0.x <= 3.0.5. A remote attacker may be able to gain access to files
which exist outside of the share's defined path. Such files must still be
readable by the account used for the connection.
According to this errata only Samba 3.0.x
<= 3.0.2a contains the exploitable code.
sharutils contains two buffer overflows. Ulf Harnhammar discovered a buffer
overflow in shar.c, where the length of data returned by the wc command is
not checked. Florian Schilhabel discovered another buffer overflow in
unshar.c. An attacker could exploit these vulnerabilities to execute
arbitrary code as the user running one of the sharutils programs.
SpamAssassin contains an unspecified Denial of Service vulnerability. By
sending a specially crafted message an attacker could cause a Denial of
Service attack against the SpamAssassin service.
Subversion has a remote Denial of Service vulnerability
that may allow a server that runs svnserve to execute
arbitrary code. See this advisory for more information.
The tar utility does not properly filter file names containing
"../", meaning that a hostile archive can, if unpacked by an
unsuspecting user, overwrite any file that is writable by that user. GNU
tar versions 1.13.19 and earlier are vulnerable; unzip through version 5.42
has the same vulnerability.
XChat is vulnerable to a stack overflow that may allow a remote attacker to
run arbitrary code. The SOCKS 5 proxy code in XChat is vulnerable to a
remote exploit. Users would have to be using XChat through a SOCKS 5
server, enable SOCKS 5 traversal which is disabled by default and also
connect to an attacker's custom proxy server. This vulnerability may allow
an attacker to run arbitrary code within the context of the user ID of the
XChat client.
Shaun Colley discovered a problem in xine-ui, the xine video player
user interface. A script contained in the package to possibly remedy
a problem or report a bug does not create temporary files in a secure
fashion. This could allow a local attacker to overwrite files with
the privileges of the user invoking xine.
David A. Wheeler
writes about the prevention of race conditions on IBM developerWorks.
"Learn what a race condition is and why it can cause security
problems. This article shows you how to handle common race conditions on
UNIX®-like systems, including how to create lock files correctly,
alternatives to lock files, how to handle the filesystem, and how to handle
shared directories (and in particular how to correctly create temporary
files in the /tmp directory). You'll also learn a bit about signal
handling."
