----------------------------------------------------------------------------



                        OpenBSD Security Advisory



                             October 3, 2000



Format string vulnerability in libutil pw_error(3) function



----------------------------------------------------------------------------



SYNOPSIS



A format string vulnerability present in the pw_error() function of

OpenBSD 2.7's libutil library can yield localhost users root access through

the setuid /usr/bin/chpass utility. This particular vulnerability was

repaired three months ago on June 30th in OpenBSD-current during a complete

source tree audit for format string problems.



OpenBSD developers became aware of an exploit circulating for the chpass(1)

program on the evening of October 2, 2000.



----------------------------------------------------------------------------



AFFECTED SYSTEMS



This vulnerability affects OpenBSD versions through 2.7. FreeBSD 4.0 is

vulnerable, but patches have been backported, and FreeBSD versions 4.1 and

4.1.1 are safe. Bill Sommerfield committed a fix to NetBSD today shortly

after we notified him of the problem.



OpenBSD users running -current (2.8-beta) with a system dated July 1st

or thereafter are safe.



----------------------------------------------------------------------------



DETAILS



In recent months a myriad of "format string" vulnerabilities have been

discovered in a number of software packages. In response to this threat,

the OpenBSD team immediately began a complete source tree audit, identifying

and fixing dozens of these format bugs. While most of the issues were

harmless, a few such as the bug in xlock and one in the OpenBSD ftpd daemon

raised the red flag and patches were released to correct these problems.

Unfortunately, the severity of the format string bug that was fixed in

pw_error() was not fully realized at the time.



In addition to fixing the bugs, CAVEATS sections were added to all stdarg

function man pages (printf, syslog, setproctitle, err/warn) to warn

programmers that user-supplied strings should never be passed to these

routines without using the "%s" conversion specifier.



----------------------------------------------------------------------------



TECHNICAL DETAILS



To understand a format string attack, you need only understand how varargs

(see "man stdarg") functions work. For example, the printf() function

accepts a variable number of arguments depending on the supplied format.

Here is the function prototype:



int

printf(const char *format, ...);



The problem occurs when one of these functions is used thusly:



printf(user_supplied_string);



An attacker can put their own format specifiers in user_supplied_string.

The printf() function does not know where it's arguments stop on the stack.

If you put 100 `%s' format specifiers in the string, but give it no

arguments, the function will happily continue on down the stack blindly.



The problem is magnified by special conversion specifiers such as `%n'

which let you write to memory. Further attack details are beyond the scope

of this advisory. For more information see Guardent's white paper on

"Format String Attacks" by Tim Newsham at the following URL:



http://www.guardent.com/docs/FormatString.PDF



----------------------------------------------------------------------------



RESOLUTION



/bin/chmod u-s /usr/bin/chpass



Use this command to protect yourself until you are patched. (Note that the

vulnerability is actually in the libutil library, which chpass is linked to,

not the chpass program itself.)



Then, apply the fix below to your OpenBSD 2.7 source tree. The patch is also

available at http://www.openbsd.org/errata.html (025).



----------------------------------------------------------------------------



CREDITS



This vulnerability was originally extinguished on June 30th in a mass

format string repair commit by Todd C. Miller of the OpenBSD project. Other

developers who contributed to the audit include Theo de Raadt, Todd Fries,

and Aaron Campbell.



OpenBSD would also like to thank Kyle Hufford and Eric Jackson for their

assistance in creating this advisory.



----------------------------------------------------------------------------



OPENBSD 2.7 PATCH



Apply by doing:

cd /usr/src

patch -p0 < 025_pw_error.patch



And then rebuild and install libutil.

cd lib/libutil

make depend

make

make install



Index: lib/libutil/passwd.c

===================================================================

RCS file: /cvs/src/lib/libutil/passwd.c,v

retrieving revision 1.20

retrieving revision 1.21

diff -u -r1.20 -r1.21

--- lib/libutil/passwd.c 1998/11/16 07:10:32 1.20

+++ lib/libutil/passwd.c 2000/06/30 16:00:07 1.21

@@ -579,7 +579,7 @@

  char   *master = pw_file(_PATH_MASTERPASSWD);



  if (err)

- warn(name);

+ warn("%s", name);

  if (master)

  warnx("%s: unchanged", master);

  pw_abort();