OpenBSD local DOS and root exploit

Contributed by Dengue on 2002-05-16 from the never-trust-the-users dept.

http://security-protocols.com/article.php?sid=1239
" On current OpenBSD systems, any local user (being or not in the wheel group) can fill the kernel file descriptors table, leading to a denial of service. Because of a flaw in the way the kernel checks closed file descriptors 0-2 when running a setuid program, it is possible to combine these bugs and earn root access by winning a race condition.
The following is research material from FozZy from Hackademy and Hackerz Voice newspaper ( http://www.hackerzvoice.org ) and can be distributed modified or not if proper credits are given to them. For educational purposes only, no warranty of any kind, I may be wrong, this post could kill you mail reader, etc. "

Patch 003 fixes this condition in OpenBSD 3.1, and Patch 021 fixes this condition in OpenBSD 3.0. See errata.html for more details.

(Comments are closed)

Comments

By Anonymous Coward () on 2002-05-17 13:04

Isn't this bug the same seen on freebsd about a month ago ?
Comments
1. By Cindy_Montreal () on 2002-05-17 13:27
  
  Yeah, OpenBSD ports over all the bugs, flaws, and other problems. Then fixes them.
  
  What would be nice, if in ports there was packages that contains nothing but bugs, flaws, security risks, and other problems. This way anyone who feels they need to install security problem could. :)
  
  -- Cindy_Montreal
  Comments
  1. By Anonymous Coward () on 2002-05-17 06:45
    
    Thought you were from Calgary too?
    
    Comments
    
    By Anonymous Coward () on 2002-05-17 07:41
    
    And this is theo taht find the bug on freebsd
    i think it is better if he audits openbsd
    rather than freebsd...
    
    By Cindy_Montreal () on 2002-05-17 11:23
    
    No, Relocated back to Montreal for a bit. But soon shall be back in the land of Ralph, with all the gohpers.
    
    Comments
    
    By Roo () on 2002-05-19 20:57
    
    Lucky you in Montreal... I loved MTL so much that I ended up extending my holiday from 2 weeks to 6 and then another 2 week stint later in the year. :)
    
    Grand Prix should be coming up soon, that place goes mad during GP week !
    
    Favourite places to eat out were Kaizen, Primadonna and for somewhere less pricey I used to love the Mess Hall in Westmount. That was near where I was staying - handy.
    
    It's possible that I might be heading back out there for a couple of weeks in June. Here's hoping, love that City !
    
    Cheers,
    Roo
By Anonymous Coward () on 2002-05-17 03:24

I wonder if that vulnerability was one of the reasons for the recent wave of stripping the current tree from suid bits...
Comments
1. By Anonymous Coward () on 2002-05-17 04:39
  
  When I saw this notice, I thought I better zip on
  over to openbsd.org to get the patch.
  But this bug was found and fixed on May 8 so I did
  not need to do anything.
  NEWS??

Latest Articles

Sat, Nov 30
- 18:42 Initial list of 21 EuroBSDcon 2024 videos released (0)
- 18:39 Rafael Sadowski on dpb(1) (1)
Fri, Nov 29
- 09:31 -current now has more flexible performance policy (0)
Mon, Nov 25
- 07:13 unwind: wildcard in blacklist (0)
Fri, Nov 22
- 07:33 Game of Trees 0.106 released (0)
Fri, Nov 15
- 06:51 Game of Trees 0.105 released (0)
Wed, Oct 23
- 07:12 Game of Trees 0.104 released (0)
Tue, Oct 15
- 08:46 LibreSSL 4.0.0 Released (0)
Mon, Oct 14
- 07:05 sshd(8) splitting continues (1)

Credits

Copyright © 2004-2008 Daniel Hartmeier. All rights reserved. Articles and comments are copyright their respective authors, submission implies license to publish on this web site. Contents of the archive prior to April 2nd 2004 as well as images and HTML templates were copied from the fabulous original deadly.org with Jose's and Jim's kind permission. This journal runs as CGI with httpd(8) on OpenBSD, the source code is BSD licensed. undeadly \Un*dead"ly\, a. Not subject to death; immortal. [Obs.]