summaryrefslogtreecommitdiff
path: root/ncpfs/03-multiple_security_issues.patch
diff options
context:
space:
mode:
Diffstat (limited to 'ncpfs/03-multiple_security_issues.patch')
-rw-r--r--ncpfs/03-multiple_security_issues.patch511
1 files changed, 511 insertions, 0 deletions
diff --git a/ncpfs/03-multiple_security_issues.patch b/ncpfs/03-multiple_security_issues.patch
new file mode 100644
index 000000000..5655712de
--- /dev/null
+++ b/ncpfs/03-multiple_security_issues.patch
@@ -0,0 +1,511 @@
+http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=572937
+
+http://seclists.org/fulldisclosure/2010/Mar/122
+
+The ncpmount, ncpumount, and ncplogin utilities, installed as part of the ncpfs
+package, contain several vulnerabilities.
+
+1. ncpmount, ncpumount, and ncplogin are vulnerable to race conditions that
+allow a local attacker to unmount arbitrary mountpoints, causing
+denial-of-service, or mount Netware shares to arbitrary directories,
+potentially leading to root compromise. This issue was formerly assigned
+CVE-2009-3297, but has since been re-assigned CVE-2010-0788 to avoid overlap
+with related bugs in other packages.
+
+2. ncpumount is vulnerable to an information disclosure vulnerability that
+allows a local attacker to verify the existence of arbitrary files, violating
+directory permissions. This issue has been assigned CVE-2010-0790.
+
+3. ncpmount, ncpumount, and ncplogin create lockfiles insecurely, allowing a
+local attacker to leave a stale lockfile at /etc/mtab~, causing other mount
+utilities to fail and creating denial-of-service conditions. This issue has
+been assigned CVE-2010-0791.
+
+--- a/sutil/ncplogin.c 2010-03-03 16:18:59.000000000 -0500
++++ b/sutil/ncplogin.c 2010-03-03 16:17:41.000000000 -0500
+@@ -934,7 +934,9 @@
+ NWDSFreeContext(ctx);
+ /* ncpmap, ncplogin must write in /etc/mtab */
+ {
++ block_sigs();
+ add_mnt_entry(mount_name, mount_point, info.flags);
++ unblock_sigs();
+ }
+ free(mount_name);
+ if (info.echo_mnt_pnt) {
+--- a/sutil/ncpm_common.c 2010-03-03 16:18:59.000000000 -0500
++++ b/sutil/ncpm_common.c 2010-03-03 16:17:41.000000000 -0500
+@@ -360,7 +360,7 @@
+ #endif
+
+ static inline int ncpm_suser(void) {
+- return setreuid(-1, 0);
++ return setresuid(0, 0, myuid);
+ }
+
+ static int ncpm_normal(void) {
+@@ -368,11 +368,31 @@
+ int v;
+
+ e = errno;
+- v = setreuid(-1, myuid);
++ v = setresuid(myuid, myuid, 0);
+ errno = e;
+ return v;
+ }
+
++void block_sigs(void) {
++
++ sigset_t mask, orig_mask;
++ sigfillset(&mask);
++
++ if(sigprocmask(SIG_SETMASK, &mask, &orig_mask) < 0) {
++ errexit(-1, _("Blocking signals failed.\n"));
++ }
++}
++
++void unblock_sigs(void) {
++
++ sigset_t mask, orig_mask;
++ sigemptyset(&mask);
++
++ if (sigprocmask(SIG_SETMASK, &mask, &orig_mask) < 0) {
++ errexit(-1, _("Un-blocking signals failed.\n"));
++ }
++}
++
+ static int proc_ncpm_mount(const char* source, const char* target, const char* filesystem, unsigned long mountflags, const void* data) {
+ int v;
+ int e;
+@@ -444,7 +464,7 @@
+ }
+ datav2.file_mode = data->file_mode;
+ datav2.dir_mode = data->dir_mode;
+- err = proc_ncpm_mount(mount_name, data->mount_point, "ncpfs", flags, (void*) &datav2);
++ err = proc_ncpm_mount(mount_name, ".", "ncpfs", flags, (void*) &datav2);
+ if (err)
+ return errno;
+ return 0;
+@@ -508,7 +528,7 @@
+ exit(0); /* Should not return from process_connection */
+ }
+ close(pp[0]);
+- err=proc_ncpm_mount(mount_name, data->mount_point, "ncpfs", flags, (void*) &datav3);
++ err=proc_ncpm_mount(mount_name, ".", "ncpfs", flags, (void*) &datav3);
+ if (err) {
+ err = errno;
+ /* Mount unsuccesful so we have to kill daemon */
+@@ -559,7 +579,7 @@
+ sprintf(mountopts, "version=%u,flags=%u,owner=%u,uid=%u,gid=%u,mode=%u,dirmode=%u,timeout=%u,retry=%u,wdogpid=%u,ncpfd=%u,infofd=%u",
+ NCP_MOUNT_VERSION_V5, ncpflags, data->mounted_uid, data->uid, data->gid, data->file_mode,
+ data->dir_mode, data->time_out, data->retry_count, wdog_pid, data->ncp_fd, pp[1]);
+- err=proc_ncpm_mount(mount_name, data->mount_point, "ncpfs", flags, mountopts);
++ err=proc_ncpm_mount(mount_name, ".", "ncpfs", flags, mountopts);
+ } else {
+ err=-1;
+ }
+@@ -577,7 +597,7 @@
+ datav4.file_mode = data->file_mode;
+ datav4.dir_mode = data->dir_mode;
+ datav4.wdog_pid = wdog_pid;
+- err = proc_ncpm_mount(mount_name, data->mount_point, "ncpfs", flags, (void*)&datav4);
++ err = proc_ncpm_mount(mount_name, ".", "ncpfs", flags, (void*)&datav4);
+ if (err) {
+ err = errno;
+ /* Mount unsuccesful so we have to kill daemon */
+@@ -1395,6 +1415,17 @@
+ }
+ #endif /* MOUNT3 */
+
++static int check_name(const char *name)
++{
++ char *s;
++ for (s = "\n\t\\"; *s; s++) {
++ if (strchr(name, *s)) {
++ return -1;
++ }
++ }
++ return 0;
++}
++
+ static const struct smntflags {
+ unsigned int flag;
+ const char* name;
+@@ -1416,6 +1447,9 @@
+ int fd;
+ FILE* mtab;
+
++ if (check_name(mount_name) == -1 || check_name(mpnt) == -1)
++ errexit(107, _("Illegal character in mount entry\n"));
++
+ ment.mnt_fsname = mount_name;
+ ment.mnt_dir = mpnt;
+ ment.mnt_type = (char*)"ncpfs";
+--- a/sutil/ncpm_common.h 2010-03-03 16:18:59.000000000 -0500
++++ b/sutil/ncpm_common.h 2010-03-03 16:17:41.000000000 -0500
+@@ -121,6 +121,9 @@
+ int proc_aftermount(const struct ncp_mount_info* info, NWCONN_HANDLE* conn);
+ int proc_ncpm_umount(const char* dir);
+
++void block_sigs(void);
++void unblock_sigs(void);
++
+ #define UNUSED(x) x __attribute__((unused))
+
+ #endif /* __NCPM_COMMON_H__ */
+--- a/sutil/ncpmount.c 2010-03-03 16:18:59.000000000 -0500
++++ b/sutil/ncpmount.c 2010-03-03 16:17:41.000000000 -0500
+@@ -359,11 +359,17 @@
+ usage();
+ return -1;
+ }
++
+ realpath(argv[optind], mount_point);
+
+- if (stat(mount_point, &st) == -1)
++ if (chdir(mount_point))
++ {
++ errexit(31, _("Could not change directory into mount target %s: %s\n"),
++ mount_point, strerror(errno));
++ }
++ if (stat(".", &st) == -1)
+ {
+- errexit(31, _("Could not find mount point %s: %s\n"),
++ errexit(31, _("Mount point %s does not exist: %s\n"),
+ mount_point, strerror(errno));
+ }
+ if (mount_ok(&st) != 0)
+@@ -714,7 +720,9 @@
+ ncp_close(conn);
+
+ if (!opt_n) {
++ block_sigs();
+ add_mnt_entry(mount_name, mount_point, info.flags);
++ unblock_sigs();
+ }
+ return 0;
+ }
+--- a/sutil/ncpumount.c 2010-03-03 16:18:59.000000000 -0500
++++ b/sutil/ncpumount.c 2010-03-03 16:17:41.000000000 -0500
+@@ -70,13 +70,24 @@
+ #include <mntent.h>
+ #include <pwd.h>
+
++#include <sched.h>
++
+ #include "private/libintl.h"
+
+ #define _(X) X
+
++#ifndef MS_REC
++#define MS_REC 16384
++#endif
++#ifndef MS_SLAVE
++#define MS_SLAVE (1<<19)
++#endif
++
+ static char *progname;
+ static int is_ncplogout = 0;
+
++uid_t uid;
++
+ static void
+ usage(void)
+ {
+@@ -117,6 +128,40 @@
+ va_end(ap);
+ }
+
++/* Mostly copied from ncpm_common.c */
++void block_sigs(void) {
++
++ sigset_t mask, orig_mask;
++ sigfillset(&mask);
++ sigdelset(&mask, SIGALRM); /* Need SIGALRM for ncpumount */
++
++ if(setresuid(0, 0, uid) < 0) {
++ eprintf("Failed to raise privileges.\n");
++ exit(-1);
++ }
++
++ if(sigprocmask(SIG_SETMASK, &mask, &orig_mask) < 0) {
++ eprintf("Blocking signals failed.\n");
++ exit(-1);
++ }
++}
++
++void unblock_sigs(void) {
++
++ sigset_t mask, orig_mask;
++ sigemptyset(&mask);
++
++ if(setresuid(uid, uid, 0) < 0) {
++ eprintf("Failed to drop privileges.\n");
++ exit(-1);
++ }
++
++ if(sigprocmask(SIG_SETMASK, &mask, &orig_mask) < 0) {
++ eprintf("Un-blocking signals failed.\n");
++ exit(-1);
++ }
++}
++
+ static void alarmSignal(int sig) {
+ (void)sig;
+ }
+@@ -192,10 +237,13 @@
+ if (!numEntries)
+ return 0; /* don't waste time ! */
+
++ block_sigs();
++
+ while ((fd = open(MOUNTED "~", O_RDWR | O_CREAT | O_EXCL, 0600)) == -1) {
+ struct timespec tm;
+
+ if (errno != EEXIST || retries == 0) {
++ unblock_sigs();
+ eprintf(_("Can't get %s~ lock file: %s\n"), MOUNTED, strerror(errno));
+ return 1;
+ }
+@@ -206,6 +254,7 @@
+ alarm(0);
+ close(fd);
+ if (err) {
++ unblock_sigs();
+ eprintf(_("Can't lock lock file %s~: %s\n"), MOUNTED, _("Lock timed out"));
+ return 1;
+ }
+@@ -223,26 +272,205 @@
+ err = __clearMtab(mount_points, numEntries);
+
+ if ((unlink(MOUNTED "~") == -1) && (err == 0)){
++ unblock_sigs();
+ eprintf(_("Can't remove %s~"), MOUNTED);
+ return 1;
+ }
++ unblock_sigs();
+ return err;
+ }
+
++
++int ncp_mnt_umount(const char *abs_mnt, const char *rel_mnt)
++{
++ if (umount(rel_mnt) != 0) {
++ eprintf(_("Could not umount %s: %s\n"),
++ abs_mnt, strerror(errno));
++ return -1;
++ }
++ return 0;
++}
++
++
++static int check_is_mount_child(void *p)
++{
++ const char **a = p;
++ const char *last = a[0];
++ const char *mnt = a[1];
++ int res;
++ const char *procmounts = "/proc/mounts";
++ int found;
++ FILE *fp;
++ struct mntent *entp;
++
++ res = mount("", "/", "", MS_SLAVE | MS_REC, NULL);
++ if (res == -1) {
++ eprintf(_("Failed to mark mounts slave: %s\n"),
++ strerror(errno));
++ return 1;
++ }
++
++ res = mount(".", "/tmp", "", MS_BIND | MS_REC, NULL);
++ if (res == -1) {
++ eprintf(_("Failed to bind parent to /tmp: %s\n"),
++ strerror(errno));
++ return 1;
++ }
++
++ fp = setmntent(procmounts, "r");
++ if (fp == NULL) {
++ eprintf(_("Failed to open %s: %s\n"),
++ procmounts, strerror(errno));
++ return 1;
++ }
++
++ found = 0;
++ while ((entp = getmntent(fp)) != NULL) {
++ if (strncmp(entp->mnt_dir, "/tmp/", 5) == 0 &&
++ strcmp(entp->mnt_dir + 5, last) == 0) {
++ found = 1;
++ break;
++ }
++ }
++ endmntent(fp);
++
++ if (!found) {
++ eprintf(_("%s not mounted\n"), mnt);
++ return 1;
++ }
++
++ return 0;
++}
++
++
++static int check_is_mount(const char *last, const char *mnt)
++{
++ char buf[131072];
++ pid_t pid, p;
++ int status;
++ const char *a[2] = { last, mnt };
++
++ pid = clone(check_is_mount_child, buf + 65536, CLONE_NEWNS, (void *) a);
++ if (pid == (pid_t) -1) {
++ eprintf(_("Failed to clone namespace: %s\n"),
++ strerror(errno));
++ return -1;
++ }
++ p = waitpid(pid, &status, __WCLONE);
++ if (p == (pid_t) -1) {
++ eprintf(_("Waitpid failed: %s\n"),
++ strerror(errno));
++ return -1;
++ }
++ if (!WIFEXITED(status)) {
++ eprintf(_("Child terminated abnormally (status %i)\n"),
++ status);
++ return -1;
++ }
++ if (WEXITSTATUS(status) != 0)
++ return -1;
++
++ return 0;
++}
++
++
++static int chdir_to_parent(char *copy, const char **lastp, int *currdir_fd)
++{
++ char *tmp;
++ const char *parent;
++ char buf[PATH_MAX];
++ int res;
++
++ tmp = strrchr(copy, '/');
++ if (tmp == NULL || tmp[1] == '\0') {
++ eprintf(_("Internal error: invalid abs path: <%s>\n"),
++ copy);
++ return -1;
++ }
++ if (tmp != copy) {
++ *tmp = '\0';
++ parent = copy;
++ *lastp = tmp + 1;
++ } else if (tmp[1] != '\0') {
++ *lastp = tmp + 1;
++ parent = "/";
++ } else {
++ *lastp = ".";
++ parent = "/";
++ }
++ *currdir_fd = open(".", O_RDONLY);
++ if (*currdir_fd == -1) {
++ eprintf(_("Failed to open current directory: %s\n"),
++ strerror(errno));
++ return -1;
++ }
++ res = chdir(parent);
++ if (res == -1) {
++ eprintf(_("Failed to chdir to %s: %s\n"),
++ parent, strerror(errno));
++ return -1;
++ }
++ if (getcwd(buf, sizeof(buf)) == NULL) {
++ eprintf(_("Failed to obtain current directory: %s\n"),
++ strerror(errno));
++ return -1;
++ }
++ if (strcmp(buf, parent) != 0) {
++ eprintf(_("Mountpoint moved (%s -> %s)\n"),
++ parent, buf);
++ return -1;
++
++ }
++
++ return 0;
++}
++
++
++static int unmount_ncp(const char *mount_point)
++{
++ int currdir_fd = -1;
++ char *copy;
++ const char *last;
++ int res;
++
++ copy = strdup(mount_point);
++ if (copy == NULL) {
++ eprintf(_("Failed to allocate memory\n"));
++ return -1;
++ }
++ res = chdir_to_parent(copy, &last, &currdir_fd);
++ if (res == -1)
++ goto out;
++ res = check_is_mount(last, mount_point);
++ if (res == -1)
++ goto out;
++ res = ncp_mnt_umount(mount_point, last);
++
++out:
++ free(copy);
++ if (currdir_fd != -1) {
++ fchdir(currdir_fd);
++ close(currdir_fd);
++ }
++
++ return res;
++}
++
+ static int
+ do_umount(const char *mount_point)
+ {
+ int fid = open(mount_point, O_RDONLY, 0);
+ uid_t mount_uid;
++ int res;
+
+ if (fid == -1) {
+- eprintf(_("Could not open %s: %s\n"),
+- mount_point, strerror(errno));
++ eprintf(_("Invalid or unauthorized mountpoint %s\n"),
++ mount_point);
+ return -1;
+ }
+ if (ncp_get_mount_uid(fid, &mount_uid) != 0) {
+ close(fid);
+- eprintf(_("%s probably not ncp-filesystem\n"),
++ eprintf(_("Invalid or unauthorized mountpoint %s\n"),
+ mount_point);
+ return -1;
+ }
+@@ -253,12 +481,8 @@
+ return -1;
+ }
+ close(fid);
+- if (umount(mount_point) != 0) {
+- eprintf(_("Could not umount %s: %s\n"),
+- mount_point, strerror(errno));
+- return -1;
+- }
+- return 0;
++ res = unmount_ncp(mount_point);
++ return res;
+ }
+
+
+@@ -409,7 +633,8 @@
+ int allConns = 0;
+ const char *serverName = NULL;
+ const char *treeName = NULL;
+- uid_t uid = getuid();
++
++ uid = getuid();
+
+ progname = strrchr(argv[0], '/');
+ if (progname) {
generated by cgit v1.2.3-70-g09d2 (git 2.47.0) at 2024-11-23 15:16:15 +0000