Subject: Bug#4190: Bug4190: serious security hole in libc (resolver)

From: Marek Michalkiewicz <[email-masked]>
Date: Thu, 29 Aug 1996 14:20:35 +0200 (MET DST)

Hi,

is there any way to change the subject line of an already existing
bug report?  This hole is a really *serious* (not moderate) one -
it lets any local and remote users read any file on the system.

I think there are two possible ways to fix it:
(1) ignore the dangerous environment variables completely (is anyone
    actually using them?  I heard about them for the first time from
    the security alert...).  If anyone needs these features - create
    a separate full-featured resolver library people can use (for
    non-setuid programs only) by setting LD_PRELOAD.

(2) ignore them if (geteuid() != getuid() || getegid() != getgid()).
    Problem: you can pass them to login via telnetd, so telnetd
    needs to be fixed too.  Anyway, I think telnetd should do what
    the one in NetKit-0.08 does: allow only a few (known to be safe)
    environment variables, and don't allow the rest.  Right now, we
    check for a few variables known to be dangerous - and we can't
    be sure that there are no more.  The bash man page mentions
    BASH_ENV in one place, and it's not checked by telnetd.

Marek

---

From: [email-masked] (David Engel)
Date: Thu, 29 Aug 1996 14:51:59 -0500 (CDT)

This is why I really wish H.J. Lu would make pure, bug-fix only
releases for the current, stable libcs.  Yes, I know Debian isn't
using the latest, stable libc, but this paritcular bug isn't fixed in
the current beta version either.

>     non-setuid programs only) by setting LD_PRELOAD.

Supposedly, the NSS support in libc 6 has a much better way of
handling things like this.

>     BASH_ENV in one place, and it's not checked by telnetd.

About the best I can do, without further guidance, is make libc not
echo the problem lines to stderr.  Is that acceptable?

David
-- 
David Engel                        Optical Data Systems, Inc.
[email-masked]                      1101 E. Arapaho Road
(214) 234-6400                     Richardson, TX  75081

---

From: Marek Michalkiewicz <[email-masked]>
Date: Thu, 29 Aug 1996 22:49:07 +0200 (MET DST)

> echo the problem lines to stderr.  Is that acceptable?

I'm not sure.  Someone could still read special files as root
(they would not see the contents, but merely reading them might
sometimes cause troubles too, if reading changes the state of
the device - as is the case with tapes, for example).

My suggestion (not tested, but it is rather simple) - replace
all occurrences of getenv() in the resolver with safe_getenv(),
implemented like this:

char *
safe_getenv(const char *name)
{
	if (geteuid() != getuid() || getegid() != getgid())
		return NULL;
	return getenv(name);
}

This assumes that telnetd will only pass known safe environment
variables to login, as suggested in another bug report against
netstd (I just got a response that the next netstd will be OK).
In the more paranoid version, safe_getenv() could simply always
return NULL.  Not all of the environment variables used by the
resolver might be dangerous - but I think it is better to err on
the safe side here...

Marek