*BSD user-ppp local root (when conditions permit)

[Eygene Ryabinkin]

Me again.

Sun, Mar 02, 2008 at 02:06:34AM +0300, Eygene Ryabinkin wrote:
> Fri, Feb 29, 2008 at 04:39:03PM -0000, sipherr at gmail.com wrote:
> > I just tested this on FreeBSD 6.3. This bug was discovered on NetBSD. It also works on OpenBSD (unconfirmed on 4.2)
> > 
> > Steps to reproduce:
> > 
> > 1. Run ppp
> > 
> > 2. type the following (or atleat some variation of)
> > 
> > ~/~/~/~/~/~/~/~/~/~/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
> > 
> > 
> > 
> > This will produce a segmentation violation (Core dumped).
> 
> Yes, good catch: looks like stack-based buffer overflow.  Also works
> on FreeBSD 7.0.  Could you please test the following rough patch --
> it seem to cure the situation.  Although it is a bit late for
> today and I will recheck it more carefully tomorrow.

About the possible exploitation scenarios: I see two of them in the
default FreeBSD installation, when ppp is setuid root and permitted
to run only for root and the 'network' group.

a) Trusted users from the group 'network': interactive privilege
   escalation and local root exploit.

b) Trusted users who can modify ppp's configuration files: non-interactive
   escalation and local root exploit (remote root exploit in the setups
   where some Web interface to the PPP configuration and like exists).

Had I missed something?
-- 
Eygene