Fixed local AIX V43 vulnerabilities

[Esa Etelavuori <eetelavu () CC HUT FI>]

-----BEGIN PGP SIGNED MESSAGE-----

Just for the record, here are some local AIX vulnerabilities we have found,
and which have been fixed by IBM this year. If you have been applying fixes,
there should be no problem with these anymore. But it might be interesting
to know what some of those massive fixes available on IBM's site actually are
correcting.

Release Date: 20001201

System

    AIX 4.{3,2}.x

Affected Programs

    setuid root                          V43 APARs  V42 APARs
        /usr/bin/setsenv *                IY08812    IY10721
            [ x=$s ]
        /usr/lib/lpd/digest *             IY08143    IY08287
            [ $s x ]
        /usr/sbin/portmir *               IY07832
            [ -t $s -d x ]
        /usr/bin/enq                      IY08143    IY08287
            [ -M $s ]
        /usr/bin/setclock                 IY07831    IY07790
            [ $s ]
        /usr/lib/lpd/pio/etc/pioout       IY12638
            [ PIO{DEVNAME,PTRTYPE}=$s ]

    setgid printq
        /usr/lib/lpd/piobe *              IY12638
            [ PIOSTATUSFILE=x PIO{TITLE,VARDIR}=$s ]
        /usr/lib/lpd/pio/etc/piomkapqd *  IY12638
            [ -p $s ]
        /usr/bin/splp                     IY12638
            [ $s ]
                                          [*] Confirmed exploitable.

Description

    Exploitable buffer overflows in several setuid and setgid binaries (libs)
    allow local users to gain root access. Portmir can also be used to kill
    other processes as root.

Details

    AIX has a world writable system lock directory which allows playing with
    hardlinks to kill other processes like cron using portmir. The portmir
    overflow is trivial to exploit. Note that these are yet additional
    vulnerabilities to those corrected in 1997.

    Gaining access to printq group gives write access to printer subsystem
    configuration files and directories which contain other binaries. Printer
    subsys programs seem to expect that they are executed by other printer
    programs with correctly set up environment. There are nicely looking
    variables such as PIO_IPCWRITEFD. Printq group has also access to run
    several other suid root binaries from which atleast /usr/lib/lpd/digest
    is exploitable.

    The overflow in digest is a bit more interesting. Our exploit uses two
    overflows. The first one overwrites a pointer located after an overflowed
    library (?) buffer which overflows another buffer on the stack afterwards.
    By that time digest has "dropped" its privileges, but the saved uid is
    still zero.

    Enq was not examined at all. Buffer overflows in setclock and splp happen
    in main(), so atleast argv and env pointers can be overwritten, but seems
    like no interesting data can be accessed. Pioout dies due to never-ending
    strcpy() of the stored PIODEVNAME environment variable on the heap.

    That does not mean they are not exploitable, we just did not investigate
    them thoroughly because debugging binary only executables on free time
    with no reason gets boring quite quickly. Or maybe we interpreted the
    disassembly wrong.

Solution

    Fixes have been available at
    http://techsupport.services.ibm.com/rs6k/fixes.html for some time.

    Notifications of security fixes can be get by sending email to
    aixserv () austin ibm com with a subject of "subscribe Security_APARs".

    Proactive measures such as stripping s[ug]id bits from unused binaries,
    limiting access to the rest of them, and possibly applying suid wrappers
    for command line arguments and environment variables are recommended.
    IBM's informative web site has other AIX specific security guides.

    We have not verified that the fixes are working due to lack of resources.
    If someone is willing to give me (EE) access to a new AIX based
    (super)computer and does not mind occasional system crashes, I might
    provide a complete report. :-)

Credits & Acknowledgements

    Vulnerabilities were found by Esa Etelavuori (http://www.iki.fi/ee/)
    and Jouko Pynnönen (jouko () solutions fi).

    Thanks to Troy Bollinger and others of the AIX security team for swift
    responses.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.4 (DreamOS)
Comment: For info see http://www.gnupg.org

iQCVAwUBOicMvVZDrCkIweM9AQGqGwQAmlkFT9qqvPwYSE83/SPctScwqq7Qk6Zj
+G8ms7f5BdPvdazAsadH3l31FpaET5sZdYuiUcHEfXAOIbQbT1mJWEnVDaVVbj2p
zmCNJXO6CpjC5GtxImV5fE+F8aD9c0lV156ZUasiWyCc1YZt0hzpxl3eUOtJ11qe
8OHs85Hbozk=
=Q6S6
-----END PGP SIGNATURE-----