Qualys Company four in OpenBSD, one of which allows remote connections without authentication to certain network services, while three others escalate their privileges in the system. The Qualys report notes the quick response from OpenBSD developers — all issues were downward API support (simultaneously with this in and addressed within 40 hours after private notification.
The remotely exploitable vulnerability is caused by an error in the organization of the authentication handler call in the libc library, which calls
the program /usr/libexec/auth/login_style by passing arguments in the command line. In particular, when calling login_style using the optional parameter “-s service”, the protocol name can be passed. If the username starts with a “-” character, this name will be processed as an option when starting login_style. Therefore, if the username for authentication is specified as “-schallenge” or “-schallenge:passwd”, login_style will interpret the request as a request to use the handler .
The problem is that the S/Key protocol in login_style is only supported formally and is actually ignored, resulting in an indication of successful authentication. Thus, an attacker can impersonate the user “-schallenge”, bypass authentication, and gain access without providing a password or keys. All network services that use standard libc calls for authentication are potentially affected by this issue. For instance, the ability to bypass authentication has been confirmed in smtpd (AUTH PLAIN), ldapd, and radiusd.
In sshd, the vulnerability does not manifest, as it has additional protection by checking the user's presence in the system. However, sshd can be used to check the system's vulnerability — when accessed with the username “-sresponse:passwd”, the connection hangs as sshd awaits the return of call parameters (challenge) from login_passwd, while login_passwd is waiting for the missing parameters (the name “-sresponse” is interpreted as an option). A potential local attacker may attempt to bypass authentication in the su utility, but passing the name “-sresponse” causes the process to crash due to a null pointer return when executing the getpwnam_r(“-schallenge”, …) function.
Other vulnerabilities:
- CVE-2019-19520 — local privilege escalation through manipulation of the xlock utility, supplied with the sgid flag, which changes the group to 'auth'. In the xlock code, the redirection of library paths is only prohibited when changing the user ID (setuid), allowing an attacker to modify the 'LIBGL_DRIVERS_PATH' environment variable and load their own shared library, the code of which will be executed after gaining privileges to the 'auth' group.
- CVE-2019-19522 — allows a local user in the 'auth' group to execute code with root privileges when using authentication via S/Key or YubiKey (disabled by default). Entry into the 'auth' group, accessible through exploitation of the aforementioned vulnerability in xlock, allows writing files into the /etc/skey and /var/db/yubikey directories. For instance, an attacker can add a new file /etc/skey/root to generate one-time keys for authenticating as the root user via S/Key.
- CVE-2019-19519 — possibility of increasing resource limits through manipulation of the su utility. When specifying the '-L' option, which implies cyclic retries for authentication upon failure, the user class is set only once and is not reset on subsequent attempts. An attacker can perform 'su -l -L', and on the first attempt enter someone else's login with a different account class, but on the second attempt successfully authenticate as themselves. In this situation, the user will have limits corresponding to the user class specified during the first attempt (e.g., maximum number of processes or memory size for the process). This method only works for borrowing limits from unprivileged users, as for the root user, membership in the wheel group is required.
Additionally, it can be noted in OpenBSD with a new method for validating system call access, further complicating the exploitation of vulnerabilities. The method allows the execution of system calls only if they are made from pre-registered memory regions. To mark memory areas new system call .
Source: opennet.ru
