Security

Address space randomization in 2.6

Arjan van de Ven has posted a series of patches which add some address space randomization to the 2.6 kernel. With these patches applied, each process's stack will begin at a random location, and the beginning of the memory area used for mmap() (which is where shared libraries go, among other things) will be randomized as well. These patches represent an improvement in the kernel's security infrastructure, but the reception on the public lists has been surprisingly hostile.

Many buffer overflow exploits, especially those used in large-scale attacks, contain hardcoded addresses. An exploit which overflows a stack variable will place some executable code on the stack; it then overwrites the return pointer so that the broken function "returns" into the exploit code. If you look at a given distribution's shipped version of a vulnerable program, an exploit will always be able to place its payload at the same address on the stack, so it can contain that address directly. If, instead, the exploit author does not know ahead of time where the payload will end up, actually getting the computer to execute that code will be much harder.

That is why the stack randomization patch helps. When the stack location is deterministic, a relatively simple exploit can be made to work on all systems running the vulnerable distribution. If the stack moves, instead, hardcoded addresses no longer work.

Moving the mmap() area has similar benefits. One popular type of exploit prepares the stack and then "returns" into a shared library somewhere. That return can, for example, cause the application to behave as if it had intentionally called system() or a similar library function. Moving the libraries around makes these attacks harder.

One of the biggest complaints that has been raised is that the amount of randomization is insufficient. The patches, as posted, vary the stack base within a 64KB area and the mmap() base within a 1MB range. Alignment requirements prevent just any address from being used with the result that only a relatively small number of possible base addresses exists. So a determined attacker could repeatedly run a hardcoded exploit with some assurance that, within a reasonable amount of time, the stack would land at the right place and the exploit would work. Placing a long series of no-op instructions at the beginning of the payload can also make an exploit more robust when faced with randomization.

Arjan responds that the amount of randomization is not the issue at the moment. He is trying to get the infrastructure into the kernel and tested in a minimally disruptive way; the degree of randomization can be tweaked upward later on. That amount may never get as high as some people would like, at least on 32-bit systems, because it cuts back on the available virtual address space. But it is likely to go up once the developers are convinced that things are working.

In any case, a larger randomness makes the problem harder, but does not change its fundamental nature. With the ability to keep trying, an attacker will eventually get around any degree of randomization possible on 32-bit systems (64-bit systems are a different story). Thus, says Ingo Molnar:

Randomization is not a magic bullet which solves a wide range of security problems. It does make an attack harder, however, and that can only be a good thing.

Comments (13 posted)

bind: validator function denial of service

Package(s):	bind	CVE #(s):	CAN-2005-0034
Created:	January 27, 2005	Updated:	February 1, 2005
Description:	A vulnerability was discovered in BIND version 9.3.0, an incorrect assumption in the validator function can be exploited by a remote attacker to cause named to exit prematurely.
Alerts:	Mandrake MDKSA-2005:023 bind 2005-01-26

Comments (none posted)

ClamAV: multiple issues

Package(s):	clamav	CVE #(s):	CAN-2005-0133
Created:	January 31, 2005	Updated:	March 3, 2005
Description:	ClamAV fails to properly scan ZIP files with special headers and base64 encoded images in URLs.
Alerts:	Conectiva CLA-2005:928 clamav 2005-03-03 Mandrake MDKSA-2005:025 clamav 2005-01-31 Gentoo 200501-46 clamav 2005-01-31

Comments (none posted)

cpio - file permissions error

Package(s):	cpio	CVE #(s):	CAN-1999-1572
Created:	February 2, 2005	Updated:	July 19, 2005
Description:	Some versions of cpio contain an ancient vulnerability where files created by that utility have overly generous access permissions.
Alerts:	Fedora-Legacy FLSA:152891 cpio 2005-07-15 Red Hat RHSA-2005:080-01 cpio 2005-02-18 Red Hat RHSA-2005:073-01 cpio 2005-02-15 Mandrake MDKSA-2005:032-1 cpio 2005-02-11 Mandrake MDKSA-2005:032 cpio 2005-02-10 Ubuntu USN-75-1 cpio 2005-02-04 Debian DSA-664-1 cpio 2005-02-02

Comments (none posted)

f2c: insecure temp files

Package(s):	f2c	CVE #(s):	CAN-2005-0017 CAN-2005-0018
Created:	January 27, 2005	Updated:	April 20, 2005
Description:	The f2c fortran to C translator has a vulnerability due to insecure opening of temporary files. A local attacker can use this to launch a symlink attack.
Alerts:	Debian DSA-661-2 f2c 2005-04-20 Gentoo 200501-43 f2c 2005-01-30 Debian DSA-661-1 f2c 2005-01-27

Comments (none posted)

FireHOL: insecure temporary file creation

Package(s):	FireHOL	CVE #(s):
Created:	February 1, 2005	Updated:	February 1, 2005
Description:	FireHOL insecurely creates temporary files with predictable names. A local attacker could create malicious symbolic links to arbitrary system files. When FireHOL is executed, this could lead to these files being overwritten with the rights of the user launching FireHOL, usually the root user.
Alerts:	Gentoo 200502-01 firehol 2005-02-01

Comments (none posted)

Gallery: cross-site scripting vulnerability

Package(s):	gallery	CVE #(s):
Created:	January 31, 2005	Updated:	February 10, 2005
Description:	Rafel Ivgi has discovered a cross-site scripting vulnerability where the 'username' parameter is not properly sanitized in 'login.php'. See this Gallery announcement for the release of 1.4.4-pl5 for more information.
Alerts:	Gentoo 200501-45:03 gallery 2005-01-30 Gentoo 200501-45 gallery 2005-01-30

Comments (none posted)

ncpfs: multiple vulnerabilities

Package(s):	ncpfs	CVE #(s):	CAN-2005-0013 CAN-2005-0014
Created:	January 31, 2005	Updated:	May 15, 2006
Description:	Erik Sjolund discovered two vulnerabilities in the programs bundled with ncpfs: there is a potentially exploitable buffer overflow in ncplogin (CAN-2005-0014), and due to a flaw in nwclient.c, utilities using the NetWare client functions insecurely access files with elevated privileges (CAN-2005-0013).
Alerts:	Fedora-Legacy FLSA:152904 ncpfs 2006-05-12 Fedora FEDORA-2005-435 ncpfs 2005-08-16 Red Hat RHSA-2005:371-01 ncpfs 2005-05-17 Mandrake MDKSA-2005:028 ncpfs 2005-02-01 Gentoo 200501-44 ncpfs 2005-01-30

Comments (none posted)

ngIRCd: buffer overflow

Package(s):	ngIRCd	CVE #(s):
Created:	January 28, 2005	Updated:	February 1, 2005
Description:	Florian Westphal discovered a buffer overflow caused by an integer underflow in the Lists_MakeMask() function of lists.c. See the ngIRCd 0.8.2 release announcement for more information.
Alerts:	Gentoo 200501-40 ngIRCd 2005-01-28

Comments (none posted)

openswan: stack based buffer overflow

Package(s):	openswan	CVE #(s):	CAN-2005-0162
Created:	January 28, 2005	Updated:	February 1, 2005
Description:	A stack-based buffer overflow in the get_internal_addresses function in the pluto application for Openswan 1.x before 1.0.9, and Openswan 2.x before 2.3.0, when compiled XAUTH and PAM enabled, allows remote authenticated attackers to execute arbitrary code.
Alerts:	Fedora FEDORA-2005-082 openswan 2005-01-28

Comments (none posted)

perl: setuid vulnerabilities

Package(s):	perl	CVE #(s):	CAN-2005-0155 CAN-2005-0156
Created:	February 2, 2005	Updated:	August 11, 2006
Description:	There are two vulnerabilities with perl when it is used in a setuid mode. The PERLIO_DEBUG environment variable can be used to overwrite arbitrary files; there is also an associated buffer overflow which can be exploited to gain root access.
Alerts:	Red Hat RHSA-2006:0605-01 Perl 2006-08-10 Fedora FEDORA-2005-353 perl 2005-05-02 Red Hat RHSA-2005:103-01 Perl 2005-02-15 Gentoo 200502-13 perl 2005-02-11 SuSE SUSE-SR:2005:004 ruby perl perl-DBI konversation 2005-02-11 Mandrake MDKSA-2005:031 perl 2005-02-08 Red Hat RHSA-2005:105-01 Perl 2005-02-07 Ubuntu USN-72-1 perl 2005-02-02

Comments (none posted)

postgresql: privilege escalation via LOAD

Package(s):	postgresql	CVE #(s):	CAN-2005-0227
Created:	February 1, 2005	Updated:	February 7, 2005
Description:	John Heasman has discovered a local privilege escalation in the PostgreSQL server. Any user could use the LOAD extension to load any shared library into the PostgreSQL server; the library's initialization function was then executed with the permissions of the server.
Alerts:	Fedora FEDORA-2005-125 postgresql 2005-02-07 Fedora FEDORA-2005-124 postgresql 2005-02-07 Gentoo 200502-08 postgresql 2005-02-07 Ubuntu USN-71-1 postgresql 2005-02-01

Comments (none posted)

SquirrelMail: multiple vulnerabilities

Package(s):	squirrelmail	CVE #(s):	CAN-2005-0075 CAN-2005-0103 CAN-2005-0104
Created:	January 28, 2005	Updated:	July 19, 2005
Description:	SquirrelMail 1.4.4 has been released, fixing a number of security issues that have been resolved since 1.4.3a.
Alerts:	Fedora-Legacy FLSA:152900 squirrelmail 2005-07-16 Fedora FEDORA-2005-260 squirrelmail 2005-03-28 Fedora FEDORA-2005-259 squirrelmail 2005-03-28 Debian DSA-662-2 squirrelmail 2005-03-14 Red Hat RHSA-2005:099-01 Squirrelmail 2005-02-15 Red Hat RHSA-2005:135-01 Squirrelmail 2005-02-10 Debian DSA-662-1 squirrelmail 2005-02-01 Gentoo 200501-39 squirrelmail 2005-01-28

Comments (none posted)

uw-imap: authentication bypass

Package(s):	uw-imap imap	CVE #(s):	CAN-2005-0198
Created:	February 2, 2005	Updated:	March 1, 2005
Description:	The uw-imap package, prior to version 2004b, contains a vulnerability which can enable a remote attacker to bypass the authentication mechanism. This bug only affects CRAM-MD5 authentication, which is not enabled on all distributions.
Alerts:	SuSE SUSE-SA:2005:012 imap 2005-03-01 Red Hat RHSA-2005:128-01 imap 2005-02-23 Mandrake MDKSA-2005:026 imap 2005-02-01 Gentoo 200502-02 uw-imap 2005-02-02

Comments (1 posted)