Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!


TUCoPS :: Unix :: General :: delega-1.htm

Delegate - many files/directories created that anyone can write to



Vulnerability

    delegate

Affected

    Those running delegate

Description

    Olaf Seibert found following.  Delegate is a multi-protocol  proxy
    deamon (ftp,  http, telnet,  etc).   Olaf noticed  that it creates
    lots of  files and  directories in  the DGROOT  directory that are
    writable for everybody (NetBSD as testing platform).  This was the
    configuration:

	-P21
	SERVER=ftp://ftp.[removed]
	PERMIT=[removed]
	DGROOT=/tmp/delegate
	OWNER=delegate

    Delegate is started from inetd.conf:

	ftp             stream  tcp     wait    delegate /usr/local/bin/delegated
		/usr/local/bin/delegated +=/etc/delegated.conf

    Output of ls -alR /tmp/delegate:

	total 14
	drwxrwxrwx  7 delegate  wheel  512 Jun 30 16:01 .
	drwxrwxrwt  4 root      wheel  512 Jun 30 16:07 ..
	drwxrwxrwx  5 delegate  wheel  512 Jun 30 16:01 act
	drwxrwxrwx  3 delegate  wheel  512 Jun 30 16:01 etc
	drwxrwxrwx  3 delegate  wheel  512 Jun 30 16:01 log
	drwxr-xr-x  3 delegate  wheel  512 Jun 30 16:06 tmp
	drwxrwxrwx  2 delegate  wheel  512 Jun 30 16:06 work

    [lots removed]

	delegate/tmp/resolvy/ab3f2cfb31e801face8fa9c06c38ab4b/byname:
	total 8
	drwxrwxrwx  2 delegate  wheel  512 Jun 30 16:01 .
	drwxrwxrwx  4 delegate  wheel  512 Jun 30 16:01 ..
	-rw-rw-rw-  1 delegate  wheel   50 Jun 30 16:01 09
	-rw-rw-rw-  1 delegate  wheel   49 Jun 30 16:01 12

    This is  of course  not good  from a  security viewpoint.  Another
    thing: If you  start delegate as  root, and it  changes to another
    user,  some  of  these  directories  are  made  as root, and later
    delegate claims it cannot create some other files.

Solution

    Nothing  yet.   This  is  an  un-official  fix for delegate 5.9.1.
    This   patch   changes   mode   777   ->   775,   and   it    puts
    "OWNER=delegate/delegate" option for  delegated.  Latest  delegate
    version is 5.9.3.

    diff -ur -x *.[oa] -x *.exe -x *.go delegate5.9.1.org/rary/file.c delegate5.9.1/rary/file.c
    --- delegate5.9.1.org/rary/file.c       Mon Mar 15 18:33:28 1999
    +++ delegate5.9.1/rary/file.c   Thu Apr 15 09:56:29 1999
    @@ -372,7 +372,7 @@
			    tmpdir = "/tmp";
	    }
	    if( !fileIsdir(tmpdir) )
    -               mkdir(tmpdir,0777);
    +               mkdir(tmpdir,0775);

	    if( path == NULL )
		    path = pathb;
    diff -ur -x *.[oa] -x *.exe -x *.go delegate5.9.1.org/resolvy/rescache.c delegate5.9.1/resolvy/rescache.c
    --- delegate5.9.1.org/resolvy/rescache.c        Mon Jan 11 03:47:49 1999
    +++ delegate5.9.1/resolvy/rescache.c    Thu Apr 15 09:57:43 1999
    @@ -65,8 +65,8 @@

	    if( fp == NULL && *mode != 'r' ){
		    mkdir(tmpdir,0755);
    -               if( mkdir(cdirs,0777) == 0 ) chmod(cdirs,0777);/*ignore umask*/
    -               if( mkdir(cdirg,0777) == 0 ){chmod(cdirg,0777);
    +               if( mkdir(cdirs,0775) == 0 ) chmod(cdirs,0775);/*ignore umask*/
    +               if( mkdir(cdirg,0775) == 0 ){chmod(cdirg,0775);
			    RES_getconf(conf);
			    sprintf(idfile,"%s/config",cdirg);
			    cfp = fopen(idfile,"w");
    @@ -81,7 +81,7 @@
			    fputs(conf,cfp);
			    fclose(cfp);
		    }
    -               if( mkdir(cdir1,0777) == 0 ) chmod(cdir1,0777);
    +               if( mkdir(cdir1,0775) == 0 ) chmod(cdir1,0775);

		    if( (fp = fopen(cpath,mode)) == NULL ){
			    cache_cantopen = time(0);
    @@ -89,7 +89,7 @@
		    }
	    }
	    if( fp != NULL && *mode != 'r' )
    -               chmod(cpath,0666);
    +               chmod(cpath,0664);

	    return fp;
     }
    @@ -184,7 +184,7 @@
				    debug(DBG_FORCE,"CACHE cant del.? %s\n",cpath);
			    if( rename(newpath,cpath) == 0 ){
				    debug(DBG_ANY,"CACHE truncated %s\n",cpath);
    -                               chmod(cpath,0666);
    +                               chmod(cpath,0664);
			    }
			    if( unlink(newpath) == 0 )
				    debug(DBG_FORCE,"CACHE salvaged %s\n",newpath);
    diff -ur -x *.[oa] -x *.exe -x *.go delegate5.9.1.org/src/cache.c delegate5.9.1/src/cache.c
    --- delegate5.9.1.org/src/cache.c       Fri Jul 10 18:22:56 1998
    +++ delegate5.9.1/src/cache.c   Thu Apr 15 09:54:02 1999
    @@ -174,7 +174,7 @@

	    if( dp = strrchr(file,'/') ){
		    *dp = 0;
    -               mkdirR(file,0777);
    +               mkdirR(file,0775);
		    *dp = '/';
	    }

    @@ -731,7 +731,7 @@
	    fclose(cachefp);

	    if( gotok ){
    -               if( renameR(xcpath,cpath,0777) == 0 )
    +               if( renameR(xcpath,cpath,0775) == 0 )
			    sv1log("CACHE: got = [%d] %s\n",size,cpath);
		    else    sv1log("CACHE: can't link %s => %s\n",cpath,xcpath);
	    }else{
    diff -ur -x *.[oa] -x *.exe -x *.go delegate5.9.1.org/src/delegated.c delegate5.9.1/src/delegated.c
    --- delegate5.9.1.org/src/delegated.c   Mon Mar 15 19:18:15 1999
    +++ delegate5.9.1/src/delegated.c       Thu Apr 15 09:54:16 1999
    @@ -3473,7 +3473,7 @@
			    fprintf(stderr,"WORKDIR=%s\n",wdir);
	    }

    -       mkdirR(wdir,0777);
    +       mkdirR(wdir,0775);
	    getcwd(cwd,sizeof(cwd));
	    originWD = strdup(cwd);

    diff -ur -x *.[oa] -x *.exe -x *.go delegate5.9.1.org/src/editconf.c delegate5.9.1/src/editconf.c
    --- delegate5.9.1.org/src/editconf.c    Tue Oct  6 15:51:05 1998
    +++ delegate5.9.1/src/editconf.c        Thu Apr 15 09:55:18 1999
    @@ -370,7 +370,7 @@
			    fprintf(stderr,"#### %s\n",msg);
			    YesOrNo(stderr,stdin,"#### Create Cachedir",yn);
			    if( yn[0] == 'y' )
    -                       if( mkdirR(sdir,0777) == 0 ){
    +                       if( mkdirR(sdir,0775) == 0 ){
				    fprintf(stderr,"#### Created: %s\n",sdir);
				    sv1log("#### CACHEDIR created: %s\n",sdir);
				    return 0;
    diff -ur -x *.[oa] -x *.exe -x *.go delegate5.9.1.org/src/log.c delegate5.9.1/src/log.c
    --- delegate5.9.1.org/src/log.c Mon Mar 15 19:39:35 1999
    +++ delegate5.9.1/src/log.c     Thu Apr 15 09:55:35 1999
    @@ -410,7 +410,7 @@
     loglog("AGEFILE(%x,%s,%s,%s,%s) %d\n",ofp,file,current,mode,tmpdir,was_active);

	    unlink(current);
    -       linkR(file,current,0777); /* should use symbolic link ? */
    +       linkR(file,current,0775); /* should use symbolic link ? */

     REOPEN:
	    nfp = fopen(file,mode);
    diff -ur -x *.[oa] -x *.exe -x *.go delegate5.9.1.org/src/nntp.c delegate5.9.1/src/nntp.c
    --- delegate5.9.1.org/src/nntp.c        Fri Mar  5 17:08:41 1999
    +++ delegate5.9.1/src/nntp.c    Thu Apr 15 09:55:57 1999
    @@ -5266,7 +5266,7 @@

	    if( 0 < xsize ){
		    sprintf(apath1,"%s#",apath);
    -               if( linkR(xapath,apath1,0777) != 0 ){
    +               if( linkR(xapath,apath1,0775) != 0 ){
			    sv1log("#### linkR(%s,%s) failed(%d).\n",
				    xapath,apath1,errno);
			    return afp;
    @@ -5295,7 +5295,7 @@
	    }else{
		    if( xsize == 0 )
			    unlink(xapath);
    -               linkR(apath,xapath,0777);
    +               linkR(apath,xapath,0775);
		    sv1log("LINKED-2 [%s] from [%s]\n",apath,xapath);
	    }

    diff -ur -x *.[oa] -x *.exe -x *.go delegate5.9.1.org/src/uns.c delegate5.9.1/src/uns.c
    --- delegate5.9.1.org/src/uns.c Tue Aug  4 22:41:29 1998
    +++ delegate5.9.1/src/uns.c     Thu Apr 15 09:56:11 1999
    @@ -165,7 +165,7 @@
		    if( dp = strrpbrk(dir,"/\\") )
			    *dp = 0;
		    if( !fileIsdir(dir) ){
    -                       mkdirR(dir,0777);
    +                       mkdirR(dir,0775);
			    if( !fileIsdir(dir) )
				    errlog("bind_un: cannot mkdir %s\n",dir);
		    }


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH