pull up r18420 from trunk

 r18420@cathode-dark-space:  tlyu | 2006-08-08 15:26:40 -0400
 ticket: new
 subject: fix MITKRB5-SA-2006-001: multiple local privilege escalation vulnerabilities
 target_version: 1.5.1
 tags: pullup

 	* src/appl/gssftp/ftpd/ftpd.c (getdatasock, passive):
 	* src/appl/bsd/v4rcp.c (main):
 	* src/appl/bsd/krcp.c (main):
 	* src/appl/bsd/krshd.c (doit):
 	* src/appl/bsd/login.c (main):
 	* src/clients/ksu/main.c (sweep_up):
 	* src/lib/krb4/kuserok.c (kuserok): Check return values from
 	setuid() and related functions to avoid privilege escalation
 	vulnerabilities.  Fixes MITKRB5-SA-2006-001. [CVE-2006-3083,
 	VU#580124, CVE-2006-3084, VU#401660]

ticket: 4126
version_fixed: 1.4.4

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-4@18422 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/appl/bsd/krcp.c b/src/appl/bsd/krcp.c
index 707985a5a873716ecc3b74feb32947414d66c640..9cf85ed37a3790304ce3e8be318c842b52a07c19 100644 (file)
--- a/src/appl/bsd/krcp.c
+++ b/src/appl/bsd/krcp.c
@@ -620,7 +620,9 @@ int main(argc, argv)
                                   
                euid = geteuid();
                if (euid == 0) {
-                   (void) setuid(0);
+                   if (setuid(0)) {
+                       perror("rcp setuid 0"); errs++; exit(errs);
+                   }
                    if(krb5_seteuid(userid)) {
                        perror("rcp seteuid user"); errs++; exit(errs);
                    }
@@ -638,11 +640,17 @@ int main(argc, argv)
                  continue;
                rcmd_stream_init_normal();
 #ifdef HAVE_SETREUID
-               (void) setreuid(0, userid);
+               if (setreuid(0, userid)) {
+                   perror("rcp setreuid 0,user"); errs++; exit(errs);
+               }
                sink(1, argv+argc-1);
-               (void) setreuid(userid, 0);
+               if (setreuid(userid, 0)) {
+                   perror("rcp setreuid user,0"); errs++; exit(errs);
+               }
 #else
-               (void) setuid(0);
+               if (setuid(0)) {
+                 perror("rcp setuid 0"); errs++; exit(errs);
+               }
                if(seteuid(userid)) {
                  perror("rcp seteuid user"); errs++; exit(errs);
                }

diff --git a/src/appl/bsd/krshd.c b/src/appl/bsd/krshd.c
index 808adf5d538006db9453c842cdd75b88c2f16024..97e256adfe87845c08b1c94744d5ce121d673d2f 100644 (file)
--- a/src/appl/bsd/krshd.c
+++ b/src/appl/bsd/krshd.c
@@ -1379,9 +1379,15 @@ void doit(f, fromp)
      * If we're on a system which keeps track of login uids, then
      * set the login uid. 
      */
-    setluid((uid_t) pwd->pw_uid);
+    if (setluid((uid_t) pwd->pw_uid) < 0) {
+       perror("setluid");
+       _exit(1);
+    }
 #endif /* HAVE_SETLUID */
-    (void) setuid((uid_t)pwd->pw_uid);
+    if (setuid((uid_t)pwd->pw_uid) < 0) {
+       perror("setuid");
+       _exit(1);
+    }
     /* if TZ is set in the parent, drag it in */
     {
       char **findtz = environ;

diff --git a/src/appl/bsd/login.c b/src/appl/bsd/login.c
index b49bababb7262f144a7eeeebfbb367c174dc40a9..d9f5fccf9f173d48d691fedc44e4d634bac175c8 100644 (file)
--- a/src/appl/bsd/login.c
+++ b/src/appl/bsd/login.c
@@ -1648,7 +1648,10 @@ int main(argc, argv)
        }
 #endif /* HAVE_SETLUID */
 #ifdef _IBMR2
-    setuidx(ID_LOGIN, pwd->pw_uid);
+    if (setuidx(ID_LOGIN, pwd->pw_uid) < 0) {
+       perror("setuidx");
+       sleepexit(1);
+    };
 #endif
 
     /* This call MUST succeed */

diff --git a/src/appl/bsd/v4rcp.c b/src/appl/bsd/v4rcp.c
index 2354a2c590f8889b0e9b11f19e4c1fed11c50d42..67bf87786ff1a52ae766944adfe22b00fcaf22ea 100644 (file)
--- a/src/appl/bsd/v4rcp.c
+++ b/src/appl/bsd/v4rcp.c
@@ -436,7 +436,10 @@ int main(argc, argv)
                        kstream_set_buffer_mode (krem, 0);
 #endif /* KERBEROS && !NOENCRYPTION */
                        (void) response();
-                       (void) setuid(userid);
+                       if (setuid(userid)) {
+                           error("rcp: can't setuid(user)\n");
+                           exit(1);
+                       }
                        source(--argc, ++argv);
                        exit(errs);
 
@@ -452,7 +455,10 @@ int main(argc, argv)
                                krem = kstream_create_from_fd (rem, 0, 0);
                        kstream_set_buffer_mode (krem, 0);
 #endif /* KERBEROS && !NOENCRYPTION */
-                       (void) setuid(userid);
+                       if (setuid(userid)) {
+                           error("rcp: can't setuid(user)\n");
+                           exit(1);
+                       }
                        sink(--argc, ++argv);
                        exit(errs);
 

diff --git a/src/appl/gssftp/ftpd/ftpd.c b/src/appl/gssftp/ftpd/ftpd.c
index 6655e0d62a7bbdc6812a86535b5b2a72129a489c..ee135aa88b04d1b1b274f94433dfab72c110121f 100644 (file)
--- a/src/appl/gssftp/ftpd/ftpd.c
+++ b/src/appl/gssftp/ftpd/ftpd.c
@@ -1368,7 +1368,9 @@ getdatasock(fmode)
                        goto bad;
                sleep(tries);
        }
-       (void) krb5_seteuid((uid_t)pw->pw_uid);
+       if (krb5_seteuid((uid_t)pw->pw_uid)) {
+               fatal("seteuid user");
+       }
 #ifdef IP_TOS
 #ifdef IPTOS_THROUGHPUT
        on = IPTOS_THROUGHPUT;
@@ -1378,7 +1380,9 @@ getdatasock(fmode)
 #endif
        return (fdopen(s, fmode));
 bad:
-       (void) krb5_seteuid((uid_t)pw->pw_uid);
+       if (krb5_seteuid((uid_t)pw->pw_uid)) {
+               fatal("seteuid user");
+       }
        (void) close(s);
        return (NULL);
 }
@@ -2187,7 +2191,9 @@ passive()
                (void) krb5_seteuid((uid_t)pw->pw_uid);
                goto pasv_error;
        }
-       (void) krb5_seteuid((uid_t)pw->pw_uid);
+       if (krb5_seteuid((uid_t)pw->pw_uid)) {
+               fatal("seteuid user");
+       }
        len = sizeof(pasv_addr);
        if (getsockname(pdata, (struct sockaddr *) &pasv_addr, &len) < 0)
                goto pasv_error;

diff --git a/src/clients/ksu/main.c b/src/clients/ksu/main.c
index d6b001b7928cf3935fb0aff6afe0ac217dff333f..241aa76927530996dc2fb3d2259366df87f796e6 100644 (file)
--- a/src/clients/ksu/main.c
+++ b/src/clients/ksu/main.c
@@ -892,9 +892,12 @@ static void sweep_up(context, cc)
     const char * cc_name;
     struct stat  st_temp;
 
-    krb5_seteuid(0);
-    krb5_seteuid(target_uid);
-    
+    if (krb5_seteuid(0) < 0 || krb5_seteuid(target_uid) < 0) {
+       com_err(prog_name, errno,
+               "while returning to source uid for destroying ccache");
+       exit(1);
+    }
+
     cc_name = krb5_cc_get_name(context, cc);
     if ( ! stat(cc_name, &st_temp)){
        if ((retval = krb5_cc_destroy(context, cc))){

diff --git a/src/lib/krb4/kuserok.c b/src/lib/krb4/kuserok.c
index e2f673001e25b85b6467b6756e022aa5d26f4811..f18d9ec24bc852c398d2e63d1f5298360e0cac54 100644 (file)
--- a/src/lib/krb4/kuserok.c
+++ b/src/lib/krb4/kuserok.c
@@ -159,9 +159,11 @@ kuserok(kdata, luser)
         */
         if(getuid() == 0) {
          uid_t old_euid = geteuid();
-         seteuid(pwd->pw_uid);
+         if (seteuid(pwd->pw_uid) < 0)
+             return NOTOK;
          fp = fopen(pbuf, "r");
-         seteuid(old_euid);      
+         if (seteuid(old_euid) < 0)
+             return NOTOK;
          if ((fp) == NULL) {
            return(NOTOK);
          }