-----BEGIN PGP SIGNED MESSAGE----- =========================================================================== AA-97.13 AUSCERT Advisory suidperl buffer overrun vulnerability 23 April 1997 Last Revised: 19 May 1997 Added information to remove confusion about whether the current version of perl was patched or not. Made find command a little less restrictive. Added specific vendor information. A complete revision history is at the end of this file. - --------------------------------------------------------------------------- AUSCERT has received information that a vulnerability exists in the suidperl program. This vulnerability affects perl versions 4.x and 5.x, up to and including perl 5.003. This vulnerability may allow local users to gain root privileges. Exploit information regarding this vulnerability has been made publicly available. AUSCERT recommends that sites take the steps outlined in section 3 as soon as possible. - --------------------------------------------------------------------------- 1. Description On some systems, setuid and setgid scripts (scripts written in the C shell, Bourne shell, or Perl, for example, with the set user or group ID permissions enabled) are insecure due to a race condition in the kernel. For those systems, Perl versions 4 and 5 attempt to work around this vulnerability with a special program named suidperl, also known as sperl. Even on systems that do provide a secure mechanism for setuid and setgid scripts, suidperl may still be installed although it is not needed. suidperl attempts to emulate the set-user-ID and set-group-ID features of the kernel. Depending on whether the script is set-user-ID, set-group-ID, or both, suidperl achieves this emulation by first changing its effective user or group ID to that of the original Perl script. suidperl then reads and executes the script as that effective user or group. To do these user and group ID changes correctly, suidperl must be installed as set-user-ID root. Due to insufficient bounds checking on arguments which are supplied by users, it is possible to overwrite the internal stack space of suidperl while it is executing. By supplying a carefully designed argument to suidperl, intruders may be able to force suidperl to execute arbitrary commands. As suidperl is setuid root, this may allow intruders to run arbitrary commands with root privileges. This vulnerability is known to affect suidperl versions 4.x and 5.x up to and including 5.003. The suidperl program may be installed as part of the standard operating system or optionally as a third party product. 2. Impact Local users may be able to gain root privileges on systems which have installed suidperl. 3. Workarounds/Solution AUSCERT recommends that sites determine if their system is vulnerable, and if so, immediately prevent the exploitation of this vulnerability by removing the setuid permissions from suidperl (Section 3.1). If the suidperl functionality is essential to your site, it is recommended that the patch given in section 3.2 is applied. Specific vendor information regarding this vulnerability has been added in Appendix A. If your vendor is not listed in this Appendix, please contact your vendor directly. 3.1 Determine if your system is vulnerable To determine if a system is vulnerable to this problem and to disable the programs that are believed to be vulnerable, use the following find command or a variant. Consult your local system documentation to determine how to tailor the find program on your system. You will need to run the find command on each system you maintain because the command examines files on the local disk only. Substitute the names of your local file systems for FILE_SYSTEM_NAMES in the example. Typical local file system names are /, /usr, and /var. You must do this as root. Note that this is one long command, though we have separated it onto three lines using back-slashes. find FILE_SYSTEM_NAMES -xdev -type f -user root \ \( -name 'sperl*' -o -name \ 'suidperl' \) -perm -04000 -print -ok chmod ug-s '{}' \; This command will find all files on a system that are - only in the file system you name (FILE_SYSTEM_NAMES -xdev) - regular files (-type f) - owned by root (-user root) - named appropriately (-name 'sperl*' -o -name 'suidperl') - setuid root (-perm -04000) Once found, those files will - have their names printed (-print) - have their modes changed, but only if you type `y' in response to the prompt (-ok chmod ug-s '{}' \;) 3.2 Install patched version If the suidperl functionality is essential to your system, the perl development coordinator Chip Salzenberg has released a patch for perl 5.003. This patch and installation instructions may be retrieved from: ftp://ftp.auscert.org.au/pub/auscert/tools/suidperl.patch Once patches have been applied to a clean version of perl 5.003, and installed, the output from the following command will be observed: % suidperl -v This is perl, version 5.003 with EMBED Locally applied patches: SUIDBUF - Buffer overflow fixes for suidperl security built under freebsd at Apr 24 1997 12:26:19 + two suidperl security patches Copyright 1987-1996, Larry Wall Perl may be copied only under the terms of either the Artistic License or the GNU General Public License, which may be found in the Perl 5.0 source kit. Note that "+ two suidperl security patches" have now been installed. Previous, vulnerable, versions of suidperl may only show "+ suidperl security patch". AUSCERT understands that this vulnerability has been removed in the upcoming perl 5.004 release. 4. Additional measures Most Unix systems ship with numerous programs which have setuid or setgid privileges. Often the functionality supplied by these privileged programs is not required by many sites. The large number of privileged programs that are shipped by default are to cater for all possible uses of the system. AUSCERT encourages sites to examine all the setuid/setgid programs and determine the necessity of each program. If a program does not absolutely require the setuid/setgid privileges to operate (for example, it is only run by the root user), the setuid/setgid privileges should be removed. Furthermore, if a program is not required at your site, then all execute permissions should be removed. A sample command to find all setuid/setgid programs is (run as root): # find / \( -perm -4000 -o -perm -2000 \) -type f -exec ls -l {} \; It is AUSCERT's experience that many vulnerabilities are being discovered in setuid/setgid programs which are not necessary for the correct operation of most systems. Sites can increase their security by removing unnecessary setuid/setgid programs. For example, the functionality provided by the suidperl program is not needed by many sites. If sites had previously disabled this program, they would not have been susceptible to this latest vulnerability. ........................................................................... Appendix A Vendor information Below is a list of the vendors who have provided information for this advisory. We will update this appendix as we receive additional information. If your vendor is not listed below, or you require further vendor information, please contact the vendor directly. RedHat Linux ============ There is a critical security hole in perl (specifically /usr/bin/sperl*) which affects all versions of Red Hat Linux. A new version, perl-5.003-8, is now available for Red Hat Linux 4.0 and 4.1 for all platforms. If you are running an earlier version of Red Hat, we strongly encourage you to upgrade to 4.1 as soon as possible, as many critical security fixes have been made. The new version of perl is PGP signed with the Red Hat PGP key. Thanks to Chip Salzenberg for putting together this patch. You may upgrade to the new version as follows: Red Hat 4.1 - ------------- i386: rpm -Uvh ftp://ftp.redhat.com/updates/4.1/i386/perl-5.003-8.i386.rpm alpha: rpm -Uvh ftp://ftp.redhat.com/updates/4.1/alpha/perl-5.003-8.alpha.rpm SPARC: rpm -Uvh ftp://ftp.redhat.com/updates/4.1/sparc/perl-5.003-8.sparc.rpm Red Hat 4.0 - ------------- i386: rpm -Uvh ftp://ftp.redhat.com/updates/4.0/i386/perl-5.003-8.i386.rpm alpha: rpm -Uvh ftp://ftp.redhat.com/updates/4.0/alpha/perl-5.003-8.alpha.rpm SPARC: rpm -Uvh ftp://ftp.redhat.com/updates/4.0/sparc/perl-5.003-8.sparc.rpm ........................................................................... - --------------------------------------------------------------------------- AUSCERT acknowledges CERT/CC for much of the technical description used in this advisory. AUSCERT also thanks Chip Salzenberg for his quick response to this vulnerability. - --------------------------------------------------------------------------- The AUSCERT team have made every effort to ensure that the information contained in this document is accurate. However, the decision to use the information described is the responsibility of each user or organisation. The appropriateness of this document for an organisation or individual system should be considered before application in conjunction with local policies and procedures. AUSCERT takes no responsibility for the consequences of applying the contents of this document. If you believe that your system has been compromised, contact AUSCERT or your representative in FIRST (Forum of Incident Response and Security Teams). AUSCERT is located at The University of Queensland within the Prentice Centre. AUSCERT is a full member of the Forum of Incident Response and Security Teams (FIRST). AUSCERT maintains an anonymous FTP service which is found on: ftp://ftp.auscert.org.au/pub/. This archive contains past SERT and AUSCERT Advisories, and other computer security information. AUSCERT also maintains a World Wide Web service which is found on: http://www.auscert.org.au/. Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 4477 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AUSCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for emergencies. Postal: Australian Computer Emergency Response Team Prentice Centre Brisbane Qld. 4072. AUSTRALIA ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Revision History 19 May 1997 The command "perl -v" under perl 5.003 says a security patch is already installed which is misleading. Updated advisory to remove this ambiguity. Altered the find command in Section 3.1 to be less restrictive. Added Appendix A to contain specific vendor information. Added information on RedHat Linux to this section. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv Comment: ftp://ftp.auscert.org.au/pub/auscert/AUSCERT_PGP.key iQCVAwUBM4CDYyh9+71yA2DNAQG2lwP8CGpV1kpS3yZ7jqWDLIx6nqZxfFsnhQgN WQ9O8rp8PJUH126kg/bFZXAE9lbsL6mOsx4OYfXlm31+O/D6Iv0zv2C8F1+74NHp 8mC0XhsZ0+Ai8wJSGT/hjWQSKBxuWIG4bHewQwT5leHcQlTCdevouM8MS5FXD1jz ZNdQZ7687R4= =/IPe -----END PGP SIGNATURE-----