__________________________________________________________ The U.S. Department of Energy Computer Incident Advisory Capability ___ __ __ _ ___ / | /_\ / \___ __|__ / \ \___ __________________________________________________________ INFORMATION BULLETIN FreeBSD - Delegate Proxy Server Vulnerability February 24, 2000 17:00 GMT Number K-023 ______________________________________________________________________________ PROBLEM: Delegate is an optional third-party protocol proxy system distributed with FreeBSD. If installed the software may allow an attacker to execute arbitrary commands on a FreeBSD system, typically as user nobody. PLATFORM: The FreeBSD ports collection before 2/2/2000. DAMAGE: A local or remote user who can connect to the delegate port(s), or malicious servers that a user accesses using the delegate proxy, can potentially execute arbitrary code on the attacked system as user nobody. SOLUTION: There are no patches available to fix this problem. Follow the FreeBSD solution for your operating system, or remove the package. ______________________________________________________________________________ VULNERABILITY The risk is low. The optional third-party software package ASSESSMENT: must be installed. ______________________________________________________________________________ [Start FreeBSD, Inc. Advisory] ============================================================================= FreeBSD-SA-00:04 Security Advisory FreeBSD, Inc. Topic: Delegate port contains numerous buffer overflows Category: ports Module: delegate Announced: 2000-02-19 Affects: Ports collection before the correction date. Corrected: 2000-02-02 FreeBSD only: NO I. Background An optional third-party port distributed with FreeBSD contains numerous remotely-exploitable buffer overflows which allow an attacker to execute arbitrary commands on the local system, typically as the 'nobody' user. II. Problem Description Delegate is a versatile application-level proxy. Unfortunately it is written in a very insecure style, with potentially dozens of different exploitable buffer overflows (including several demonstrated ones), each of which could allow an attacker to execute arbitrary code on the delegate server. This code will run as the user ID of the 'delegated' process, typically 'nobody' in the recommended configuration, but this still represents a security risk as the attacker may be able to mount a local attack to further upgrade his or her access privileges. Note that the delegate utility is not installed by default, nor is it "part of FreeBSD" as such: it is part of the FreeBSD ports collection, which contains over 3100 third-party applications in a ready-to-install format. FreeBSD makes no claim about the security of these third-party applications, although an effort is underway to provide a security audit of the most security-critical ports. III. Impact If you have not chosen to install the delegate port/package, then your system is not vulnerable. If you have, then local or remote users who can connect to the delegate port(s), or malicious servers which a user accesses using the delegate proxy, can potentially execute arbitrary code on your system in any number of ways. IV. Workaround Remove the delegate port/package, if you have installed it. V. Solution Unfortunately no simple fix is available - the problems with the delegate software are too endemic to be fixed by a simple patch. It is hoped the software authors will take security to heart and correct the security problems in a future version, although user caution is advised given the current state of the code. Depending on your local setup and your security threat model, using a firewall/packet filter such as ipfw(8) or ipf(8) to prevent remote users from connecting to the delegate port(s) may be enough to meet your security needs. Note that this will not prevent legitimate proxy users from attacking the delegate server, although this may not be an issue if they have a shell account on the machine anyway. Note also that this does not prevent "passive" exploits in which a user is convinced through other means into visiting a malicious server using the proxy, which may be able to compromise it by sending back invalid data. Several flaws of this type have been discovered during a brief survey of the code. If you are running FreeBSD 4.0, a possible solution might be to confine the delegate process inside a "jail" (see the jail(8) manpage). A properly configured jail will isolate the contents in their own separate "virtual machine", which can be suitably secured so that an attacker who gains control of a process running inside the jail cannot escape and gain access to the rest of the machine. Note that this is different from a traditional chroot(8), since it does not just attempt to isolate processes inside portions of the filesystem. This solution is not possible under standard FreeBSD 3.x or earlier. [End FreeBSD, Inc. Advisory] _____________________________________________________________________________ CIAC wishes to acknowledge the contributions of FreeBSD, Inc. for the information contained in this bulletin. ______________________________________________________________________________ CIAC, the Computer Incident Advisory Capability, is the computer security incident response team for the U.S. Department of Energy (DOE) and the emergency backup response team for the National Institutes of Health (NIH). CIAC is located at the Lawrence Livermore National Laboratory in Livermore, California. CIAC is also a founding member of FIRST, the Forum of Incident Response and Security Teams, a global organization established to foster cooperation and coordination among computer security teams worldwide. CIAC services are available to DOE, DOE contractors, and the NIH. CIAC can be contacted at: Voice: +1 925-422-8193 FAX: +1 925-423-8002 STU-III: +1 925-423-2604 E-mail: ciac@llnl.gov For emergencies and off-hour assistance, DOE, DOE contractor sites, and the NIH may contact CIAC 24-hours a day. During off hours (5PM - 8AM PST), use one of the following methods to contact CIAC: 1. Call the CIAC voice number 925-422-8193 and leave a message, or 2. Call 888-449-8369 to send a Sky Page to the CIAC duty person or 3. Send e-mail to 4498369@skytel.com, or 4. Call 800-201-9288 for the CIAC Project Leader. Previous CIAC notices, anti-virus software, and other information are available from the CIAC Computer Security Archive. World Wide Web: http://www.ciac.org/ (or http://ciac.llnl.gov -- they're the same machine) Anonymous FTP: ftp.ciac.org (or ciac.llnl.gov -- they're the same machine) Modem access: +1 (925) 423-4753 (28.8K baud) +1 (925) 423-3331 (28.8K baud) CIAC has several self-subscribing mailing lists for electronic publications: 1. CIAC-BULLETIN for Advisories, highest priority - time critical information and Bulletins, important computer security information; 2. SPI-ANNOUNCE for official news about Security Profile Inspector (SPI) software updates, new features, distribution and availability; 3. SPI-NOTES, for discussion of problems and solutions regarding the use of SPI products. Our mailing lists are managed by a public domain software package called Majordomo, which ignores E-mail header subject lines. To subscribe (add yourself) to one of our mailing lists, send the following request as the E-mail message body, substituting ciac-bulletin, spi-announce OR spi-notes for list-name: E-mail to ciac-listproc@llnl.gov or majordomo@rumpole.llnl.gov: subscribe list-name e.g., subscribe ciac-bulletin You will receive an acknowledgment E-mail immediately with a confirmation that you will need to mail back to the addresses above, as per the instructions in the E-mail. This is a partial protection to make sure you are really the one who asked to be signed up for the list in question. If you include the word 'help' in the body of an E-mail to the above address, it will also send back an information file on how to subscribe/unsubscribe, get past issues of CIAC bulletins via E-mail, etc. PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing communities receive CIAC bulletins. If you are not part of these communities, please contact your agency's response team to report incidents. Your agency's team will coordinate with CIAC. The Forum of Incident Response and Security Teams (FIRST) is a world-wide organization. A list of FIRST member organizations and their constituencies can be obtained via WWW at http://www.first.org/. This document was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor the University of California nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation or favoring by the United States Government or the University of California. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or the University of California, and shall not be used for advertising or product endorsement purposes. LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC) K-013: Buffer Overflow in Sun Solstice AdminSuite Daemon sadmind K-014: HP-UX Aserver Vulnerability K-015: ColdFusion Information Exposure (CFCACHE Tag) K-016: Microsoft "Malformed IMAP Request" Vulnerability K-017: Microsoft "Malformed RTF Control Word" Vulnerability K-018: HP-UX - Security Vulnerability with PMTU Strategy K-019: Microsoft - "Spoofed LPC Port Request" Vulnerability K-020: Majordomo open() call Vulnerability K-021: Malicious HTML Tags Vulnerability K-022: FreeBSD - Asmon/Ascpu Vulnerability