9 ms·
Authentication Vulnerabilities in OpenBSD
- zdw 7y agoUpstream eratta and binary patches to address these issues is available: https://www.openbsd.org/errata66.html https://www.openbsd.org/errata66.html
- LeonM 7y agoThe patch is still fresh so it's not distributed to most mirrors yet. In case syspatch doesn't appear to do anything, check your /etc/updateurl, set it to the OpenBSD CDN, then run again.
- tptacek 7y agoOh, wow, this is brutal. They're shelling out to a command line program to do authentication, and not catching the "-" metacharacter in the username they shell out with, so you can pass options to that program.
- fluffything 7y agoYep, very cool.
- akira2501 7y agoThat's why I like DBJs method. You still use a command line program, but you pass a filehandle that the authentication data can be read from.. this seems much safer than trying to parse and re-format that data as an intermediary. Also avoids any data leaks through the often unprotected 'cmdline'. Is there some technical reason OpenBSD doesn't do this?
- mjevans 7y agoProbably historic compatibility. If making a breaking change this might be a good time to implement a design benefiting from decades of real world experiences.
- anthk 7y agoThat's literally what OpenBSD was doing over decades, starting with binary compatibility with Linux and a lot of legacy stuff which came from NetBSD and BSD 4.4 lite/BSD 4.3. You described OpenBSD with that comment. - Xenocara with rootless privileges as a fork of X - LibreSSL - Linux compat going away - Pledge/Unveil - Some daemons belonging to ports - HTTPD/SMTPD and so on as replacement of bloated daemons - OpenSSH itself - Retguard This vulnerability is bad, but pledge and unveil will have even more prominent roles in base soon, so even if you get privs, you can do either nil or just crash because of pledge.
- k_sze 7y agoWhat does “DBJ” stand for?
- gautamcgoel 7y agoI think he means Daniel Bernstein, a prominent cryptographer and coder.
- inferiorhuman 7y agoDaniel Bernstein, author of qmail, djbdns, and daemontools among others.
- kick 7y agoThat's DJB. DBJs is a Javascript database thing. There is possible ambiguity here.
- inferiorhuman 7y agoFair point. I associate DJB with security and coding best practices, Javascript not so much. I can only hope the comment I replied to meant DJB the person.
- kick 7y agoI hope so too.
- k_sze 7y agoAnd where does that auth-info-via-file-handle come from? I did a bit of duckduckgoing and couldn’t spot anything about that.
- simtel20 7y agoThe qmail source code has this convention.
- jstewartmobile 7y agoThank God for DJB. His entire website should be required reading for software developers.
- skunkpocalypse 7y agoI am convinced that DJB is actually the reincarnation of John von Neumann. Seriously, how many other people make contributions in areas ranging all the way from number theory to hand-written machine code?
- TheAceOfHearts 7y agoThanks for the recommendation, I'd previously heard of DJB but was unaware of his writings. Here's the link to his website: https://cr.yp.to/djb.html https://cr.yp.to/djb.html
- kbenson 7y agoThis feels like an old school vulnerability. Things like this were the norm in the 90's and early 2000's. It feels weird to see an exploit like this now in a large and well known project, and very weird for it to be in OpenBSD. It just goes to show, as a user you can make informed choices in what software to use to reduce your security exposure, but that's not enough. You still need to pay attention to new problems that might pop up. No software is guaranteed to be safe in perpetuity.
- conradev 7y agoIn a world where we harden all of the things and write code in memory safe languages maybe memory corruption will be the old school vulnerability and this type of thing will be all that is left
- quotemstr 7y agoYeah. It's a shame how few people invoking shell commands use tricks like "--" to suppress option parsing and "./*" to suppress bad globs. :-(
- asveikau 7y ago> They're shelling out to a command line program to do authentication Interesting to track who exactly "they" might have been, as many commenters are saying this is uncharacteristic for OpenBSD. Looking at the patch, the first OpenBSD commit of this file [1] is from 2000 and says "from BSDI" in the commit message, did fork()+execve() at that time, and the BSDI copyright comment says 1995-1997. Probable to say more recent OpenBSD stuff is likely not written this way, but that they have baggage like this in the tree from earlier times. [1] https://cvsweb.openbsd.org/src/lib/libc/gen/auth_subr.c?rev=1.1&content-type=text/x-cvsweb-markup https://cvsweb.openbsd.org/src/lib/libc/gen/auth_subr.c?rev=...
- linusnext 7y agoThere have been many bugs in NetBSD code that are found and fixed. Quite often these bugs are in code shared with OpenBSD, but you never see them list it as such, as they import said fixes from NetBSD. edited: make verb plural.
- notaplumber 7y ago> We thank Theo de Raadt and the OpenBSD developers for their incredibly quick response: they published patches for these vulnerabilities less than 40 hours after our initial contact. Awesome.
- pg_is_a_butt 7y ago40 hours to add a shell_escape() call??? Lame. Not using some form of shell escape in the first place, or knowing that they should? Very lame.
- alberth 7y agoImportant quote: “this vulnerability is remotely exploitable in smtpd, ldapd, and radiusd, but its real-world impact should be studied on a case-by-case basis. For example, sshd is not exploitable thanks to its defense-in-depth mechanisms.” Edit: formatting.
- procinct 7y ago> this vulnerability is remotely exploitable in smtpd, ldapd, and radiusd, but its real-world impact should be studied on a case-by-case basis. For example, sshd is not exploitable thanks to its defense-in-depth mechanisms. Does this mean OpenBSD will have to update the tagline on their website that says "Only two remote holes in the default install, in a heck of a long time!"?
- tptacek 7y agoYes.
- notaplumber 7y agoNo.
- anthk 7y agoHow? Show me how can I, remotely: - Login with no SSH account - Enable SSH - Change PF rules - Change the smtpd config - Enable radiusd/ldapd without being root - Running Xenocara's xlock when is not available on servers and I have no permissions
- tptacek 7y agoThis is an extremely silly set of conditions to attach to "remote hole". You can litigate it, and maybe win the argument, but you're just bold-facing the asterisk that was already next to that already-tortured claim.
- anthk 7y agoYou mean, overriding defaults as conditions to get a remote hole? Can you exploit a bare OpenBSD install by default remotely, yes or not? Everything else is bullshit.
- pvg 7y agoThis is a bit like whether Magneto can escape the Plastic Prison (yes or no) without Logan traveling back in time and altering the timeline.
- keyle 7y agoWhat's very cool about this to me is how well put this report is in layman's terms. Also is this going to increment the "X remote vulnerabilities in X years"?
- anthk 7y agoAs long as you override a default PF install, go on. Because you can't. Even with a PF rule being set, you must set up smtpd.conf right. Also no ldapd and radiusd is listening by default, and SSHD is secure by itself. And you are asked in the first install if you want to enable it at boot, btw.
- juped 7y agoWorth noting that this vuln passes you through authentication as an almost certainly invalid user - I expect the devs to put in more username validity checks, like the one ssh has, to mitigate this class of issues in the future. (The second vuln listed is less sexy but escalates you to a real group.)
- anthk 7y ago>/usr/X11R6/bin/xlock is installed by default Most servers will not install Xenocara at all in order to avoid most security and space issues, as a lot of them now are using vmm(4) for testing purposes. Also as xlock moved upsteeam, OpenBSD will stop importing xlock and maybe the will implement a patched and pledge(4)d slock (with some features such as passwd display as asterisks) as the Xenocara's workstation locker. If would not be weird at all. Today the default wm is FVWM because of historical respect to BSD's/Unix, but the most common WM used by OpenBSD fans is, by far, CWM, which came from evilwm. As Xenocara was already a fork of X, having a patched slock as "xenolock" would be the next logical step. Because xlock(4) is a shitty security fest by itself. Not to blame the OpenBSD developers, but the main project. It's full of features and slock matches better the OpenBSD's philosophy.
- adamrt 7y agoI'm a big OpenBSD fan, but the OpenBSD devs recommend you install Xenocara, otherwise its considered a non-default install.
- linusnext 7y agoYeah, the "it's secure as long as you don't use it for anything" gets old.
- anthk 7y agoWell, if it's a CLI based server I'd doubt X would be needed at all. OpenBSD Amsterdam (A well known provider in the circle of OpenBSD users) doesn't enable X by default on its autoinstall file: https://openbsd.amsterdam/setup.html https://openbsd.amsterdam/setup.html EDIT: It enables xbase.tgz but not the rest.
- yellowapple 7y agoYikes. This one just turned my mail server into an open relay (assuming any would-be attackers picked up on it running smtpd). Went ahead and shut off outbound mail delivery (so smtpd only accepts mail destined for my domain) until I can get this patched. Kudos to the OpenBSD folks for getting a patch whipped up so quick, and thankfully SSH ain't affected, but Jesus.
- themattress 7y agoTangential, but it appears openwall.com is on several of my pi hole blocklists. I'm guessing its because of the tools they offer?
- gautamcgoel 7y agoSo... are they gonna update the OpenBSD webpage to say "only three remote vulnerabilities in a heck of a long time?" Do these bugs represent a vulnerability to real systems deployed in the wild, or are they more of a theoretical threat?
- rsecora 7y agoThis is the new -froot!!! [1]http://seclab.cs.ucdavis.edu/projects/testing/vulner/18.html http://seclab.cs.ucdavis.edu/projects/testing/vulner/18.html [2]https://www.symantec.com/security_response/attacksignatures/detail.jsp?asid=22145 https://www.symantec.com/security_response/attacksignatures/...