[ advisories | exploits | discussions | news | conventions | security tools | texts & papers ]
 main menu
- feedback
- advertising
- privacy
- FightAIDS
- newsletter
- news
- read forum
- new topic
- search

- meetings list
- recent additions
- add your info
 top 100 sites
- visit top sites
- sign up now
- members

- add your url
- add domain
- search box
- link to us

- our projects
- free email
 m4d network
- security software
- secureroot
- m4d.com
Home : Advisories : unauthorized access via mount_union / mount_msdos (vfsload)

Title: unauthorized access via mount_union / mount_msdos (vfsload)
Released by: FREEBSD
Date: 17th May 1996
Printable version: Click here


FreeBSD-SA-96:09                                            Security Advisory

                                                    The FreeBSD Project, Inc.

Topic:          unauthorized access via mount_union / mount_msdos (vfsload)

Category:       core

Module:         libc

Announced:      1996-05-17

Affects:        FreeBSD 2.0, 2.0.5, 2.1, 2.1-stable, and 2.2-current

Corrected:      1996-05-17 2.1-stable and 2.2-current sources

Source:         FreeBSD native bug

FreeBSD only:   yes

Patches:        http://freebsd.org/pub/CERT/patches/SA-96:09/


I.   Background    

     A bug was found in the vfsload(3) library call that affects all

     versions of FreeBSD from 2.0 through 2.2-CURRENT that caused a

     system vulnerability.  This problem is present in all source

     code and binary distributions of FreeBSD version 2.x released

     before 1996-05-18.

     The FreeBSD project is aware of active exploits of this


     All FreeBSD users are encouraged to use the workaround provided

     until they can update their operating system to a version with

     this vulnerability fixed.

II.  Problem Description

     The mount_union and mount_msdos programs invoke another system

     utility in an insecure fashion while setuid root.

III. Impact

     The problem could allow local users to gain unauthorized


     This vulnerability can only be exploited by users with a valid

     account on the local system.

IV. Solution(s)

     Update operating system sources and binaries to FreeBSD 2.1-stable

     or FreeBSD 2.2-current as distributed later than 1996-05-18 or

     if you are currently running 2.1 or later, you may apply the

     solution patches available at the URL listed at the top of this


     The OS updates fix the actual problem in the vfsload(3) library

     routine.  Once the vfsload() library routine is fixed, the

     workaround listed below is not necessary to solve this problem.

     However, an additional stability problem has come to light

     (ref. FreeBSD SA-96:10) so the FreeBSD project suggests

     using both the setuid workaround and the solution for best results.

V. Workaround

     This vulnerability can quickly and easily be limited by removing

     the setuid permission bit from the mount_union and mount_msdos

     program.  This workaround will work for all versions of FreeBSD

     affected by this problem.


     As root, execute the command:

          % chmod u-s /sbin/mount_union /sbin/mount_msdos

     then verify that the setuid permissions of the files have been

     removed.  The permissions array should read "-r-xr-xr-x" as

     shown here:

           % ls -l /sbin/mount_union /sbin/mount_msdos

           -r-xr-xr-x  1 root  bin  151552 Apr 26 04:41 /sbin/mount_msdos

           -r-xr-xr-x  1 root  bin   53248 Apr 26 04:40 /sbin/mount_union

     In addition to changing the permissions on the executable files,

     if you have the source code installed, we suggest patching the

     sources so that mount_union will not be installed with the

     setuid bit set:

*** /usr/src/sbin/mount_union/Makefile  Sun Nov 20 14:47:52 1994

- - --- /usr/src/sbin/mount_union/Makefile        Fri May 17 10:36:09 1996


*** 8,14 ****

  CFLAGS+= -I${.CURDIR}/../../sys -I${MOUNT}

  .PATH:        ${MOUNT}


- - - BINOWN= root

- - - BINMODE=4555

- - - 


- - --- 8,11 ----

*** /usr/src/sbin/i386/mount_msdos/Makefile     Sun Dec  4 00:01:24 1994

- - --- /usr/src/sbin/i386/mount_msdos/Makefile   Fri May 17 11:31:57 1996


*** 6,14 ****

  SRCS= mount_msdos.c getmntopts.c

  MAN8= mount_msdos.8


- - - BINOWN=     root

- - - BINMODE= 4555

- - - 

  MOUNT=        ${.CURDIR}/../../mount


  .PATH:        ${MOUNT}

- - --- 6,11 ----


The FreeBSD Project, Inc.

Web Site:                       http://www.freebsd.com/

Confidential contacts:          security-officer@freebsd.org

PGP Key:                        http://freebsd.org/pub/CERT/public_key.asc

Security notifications:         security-notifications@freebsd.org

Security public discussion:     security@freebsd.org

Notice: Any patches in this document may not apply cleanly due to

        modifications caused by digital signature or mailer software.

        Please reference the URL listed at the top of this document

        for original copies of all patches if necessary.


(C) 1999-2000 All rights reserved.