Qualys quattro In OpenBSD, one vulnerability allows remote connections to some network services without authentication, while three others enable privilege escalation within the system. The Qualys report noted the rapid response of OpenBSD developers — all issues were addressed. in e addressed within 40 hours after private notification.
The remotely exploitable vulnerability is caused by an error in the authentication handler call organization in the libc library, which triggers
The program /usr/libexec/auth/login_style allows argument passing via the command line. This includes the invocation of login_style using the optional parameter "-s service" which permits the inclusion of the protocol name. If a username starts with a "-" character, it will be treated as an option when starting login_style. Therefore, if during authentication the username "-schallenge" or "-schallenge:passwd" is specified, login_style interprets the request as an attempt to use a handler. .
The issue is that the S/K protocol in login_style is supported only nominally and is effectively ignored, resulting in an indication of successful authentication. Consequently, an attacker can bypass authentication by presenting themselves as the user "-schallenge", gaining access without providing a password or keys. All network services utilizing standard libc calls for authentication could potentially be affected. For example, the ability to bypass authentication has been confirmed in smtpd (AUTH PLAIN), ldapd, and radiusd.
In sshd, the vulnerability does not manifest, as it has an additional protection mechanism that checks for the user's presence in the system. However, sshd can be used to check if the system is vulnerable — when accessing with the username "-sresponse:passwd", the connection hangs because sshd is waiting for the login_passwd to return the call parameters (challenge), while login_passwd is waiting for the missing parameters to be provided (the name "-sresponse" is treated as an option). A local attacker might attempt to circumvent authentication in the su utility, but passing the name "-sresponse" leads to a crash of the process due to the return of a null pointer in executing the getpwnam_r("-schallenge", …) function.
Altre vulnerabilità:
- CVE-2019-19520 — local privilege escalation through manipulation of the xlock utility, provided with the sgid flag, changing the group to "auth". In the xlock code, the overriding of library paths is only prohibited when changing the user ID (setuid), allowing an attacker to alter the environment variable "LIBGL_DRIVERS_PATH" and load their own shared library, the code of which will be executed after gaining privileges to the "auth" group.
- CVE-2019-19522 — allows a local user in the "auth" group to execute code with root privileges when S/K or YubiKey authentication is enabled in the system (by default, these are inactive). Membership in the auth group, which can be accessed by exploiting the aforementioned vulnerability in xlock, allows writing files in the /etc/skey and /var/db/yubikey directories. For instance, an attacker could add a new file /etc/skey/root to generate one-time keys for authenticating as the root user through S/K.
- CVE-2019-19519 — possibility of raising resource limits through manipulation with the su utility. When specifying the option "-L", which implies repeated authentication attempts in case of failure, the user class is set only once and not reset in subsequent attempts. An attacker could execute "su -l -L" and on the first attempt enter another user's login with a different account class, but on the second attempt successfully authenticate as themselves. In this situation, the user will have limits set that correspond to the user class indicated during the first attempt (for example, maximum process number or memory size for the process). This method only works for borrowing limits from unprivileged users, as root user requires presence in the wheel group.
Inoltre, si può notare in OpenBSD, a new method for verifying the permissibility of calling system calls, further complicating the exploitation of vulnerabilities. This method allows the execution of system calls only if they are made from previously registered memory areas. To mark memory areas a new system call .
Fonte: opennet.ru
