[ SOURCE: http://www.secureroot.com/security/advisories/9678027937.html ]

-----BEGIN PGP SIGNED MESSAGE-----



=============================================================================

FreeBSD-SA-00:43                                           Security Advisory

                                                                FreeBSD, Inc.



Topic:          brouted port allows gid kmem compromise



Category:       ports

Module:         brouted

Announced:      2000-08-28

Credits:        Discovered during internal auditing

Affects:        Ports collection prior to the correction date.

Corrected:      2000-08-22

Vendor status:  Contacted

FreeBSD only:   NO



I.   Background



brouted is a dynamic routing daemon.



II.  Problem Description



The brouted port is incorrectly installed setgid kmem, and contains

several exploitable buffer overflows in command-line arguments. An

attacker exploiting these to gain kmem privilege can easily upgrade to

full root access by manipulating kernel memory.



The brouted port is not installed by default, nor is it "part of

FreeBSD" as such: it is part of the FreeBSD ports collection, which

contains over 3700 third-party applications in a ready-to-install

format. The ports collections shipped with FreeBSD 3.5-RELEASE and

4.1-RELEASE contain this problem, since it was discovered after the

releases during internal auditing.



FreeBSD makes no claim about the security of these third-party

applications, although an effort is underway to provide a security

audit of the most security-critical ports.



III. Impact



Unprivileged local users can obtain group kmem privileges, and upgrade

further to full root privileges.



If you have not chosen to install the brouted port/package, then your

system is not vulnerable to this problem.



IV.  Workaround



Execute the following command as root to remove the setgid bit on the

/usr/local/sbin/brouted file:



# chmod g-s /usr/local/bin/brouted



V.   Solution



One of the following:



1) Upgrade your entire ports collection and rebuild the brouted port.



2) Deinstall the old package and install a new package dated after the

correction date, obtained from:



ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-3-stable/net/brouted-1.2b.tgz

ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/net/brouted-1.2b.tgz

ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/alpha/packages-4-stable/net/brouted-1.2b.tgz

ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/net/brouted-1.2b.tgz

ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/alpha/packages-5-current/net/brouted-1.2b.tgz



NOTE: It may be several days before updated packages are available. Be

sure to check the file creation date on the package, because the

version number of the software has not changed.



3) download a new port skeleton for the brouted port from:



http://www.freebsd.org/ports/



and use it to rebuild the port.



4) Use the portcheckout utility to automate option (3) above. The

portcheckout port is available in /usr/ports/devel/portcheckout or the

package can be obtained from:



ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-3-stable/devel/portcheckout-2.0.tgz

ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/devel/portcheckout-2.0.tgz

ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/alpha/packages-4-stable/devel/portcheckout-2.0.tgz

ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/devel/portcheckout-2.0.tgz

ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/alpha/packages-5-current/devel/portcheckout-2.0.tgz



-----BEGIN PGP SIGNATURE-----

Version: 2.6.2



iQCVAwUBOaqy+lUuHi5z0oilAQHDzwQApGoedKCQAZcpjqafuNA9jPQ0fQ2PaScu

OZlBlflrUVNAMcEkL3y9lmahdVTcdOBpKAALDzIxYnKYlSxGg1RTtxHoWhJiCD97

c2mc9Ni65YCHab5O90WBHK+VjTiFzfq+dpG+rXLB1W2Pfq68Xf8O2rb2eSjdVW3d

/wazSPNLcSg=

=V2xB

-----END PGP SIGNATURE-----